ZATCA Phase 2
ZATCA E-Invoicing for Odoo (Saudi Arabia)
End-to-end ZATCA Phase 2 (Integration / Fatoora) compliance inside Odoo — cryptographic stamping, real-time clearance for standard invoices, 24-hour reporting for simplified invoices, TLV QR codes, CSID registration per device, and 6-year archive. Built and shipped for Saudi-based businesses already in scope and for those waiting on a ZATCA wave letter.
Last reviewed:
What it is
ZATCA (Zakat, Tax and Customs Authority) Phase 2 — known as the Integration Phase or Fatoora — is Saudi Arabia's mandatory e-invoicing regime. It went live on 1 January 2023 and is being rolled out in waves based on annual VAT-taxable revenue. Every wave-eligible business must (a) generate invoices in ZATCA's prescribed XML format (UBL 2.1 based), (b) cryptographically stamp each invoice using a Cryptographic Stamp Identifier (CSID), (c) embed a TLV-encoded QR code, (d) clear standard tax invoices through Fatoora before issuing them to the buyer, and (e) report simplified tax invoices to Fatoora within 24 hours. Our Odoo build wires every step natively — no third-party clearance vendor, no parallel system, one source of truth.
Why it matters
Non-compliance with ZATCA Phase 2 carries fines from SAR 1,000 to SAR 50,000 per violation, plus the operational risk of being unable to issue valid tax invoices to customers. The cost of bolting compliance on top of a non-native ERP is high: separate clearance vendors charge per-document fees that scale with volume, integration glue breaks on each Fatoora API revision, and audit-time reconciliation between ERP and clearance tool eats finance team hours. Native Odoo e-invoicing collapses that cost — one system, one archive, one audit trail, one renewal cycle.
Features
-
Standard tax invoice clearance (B2B)
Real-time submission to Fatoora before the invoice copy reaches the buyer. ZATCA's clearance response (cleared, warning, rejected) is captured inline and surfaced to the AR team. Average round-trip: under 4 seconds in our production deployments.
-
Simplified tax invoice reporting (B2C)
Generated, stamped, and given to the customer at point of sale or service. Reported to Fatoora in batches within the 24-hour statutory window with automatic retries on transient failures.
-
Cryptographic Stamp Identifier (CSID)
CSID issued by ZATCA per EGS unit (Electronic Generation Solution — usually a PoS terminal, branch, or back-office). We provision the CSID, install it in Odoo, and handle annual renewals as part of ongoing support.
-
TLV-encoded QR code
Tag-Length-Value QR code printed on every invoice carries seller name, VAT number, timestamp, total, VAT amount, hash, and signature — meeting ZATCA's exact byte-level spec for inspector scanning.
-
UBL 2.1 XML generation
Invoice XML built to ZATCA's adapted UBL 2.1 schema with all mandatory fields (seller VAT, buyer VAT for B2B, line items, tax breakdown, payment means, previous invoice hash for the chain).
-
Multi-EGS, multi-branch
Each branch, warehouse, or PoS terminal registers as its own EGS with its own CSID. One Odoo instance handles dozens of EGS units cleanly — no separate compliance silo per branch.
-
Phase 2 wave readiness check
Pre-implementation audit against ZATCA's wave criteria: are you in this wave's revenue bracket? What invoice volume should we expect? Which entities are in scope vs. exempt? Output: written readiness report.
-
6-year archive with regulator retrieval
Statutory archive retention with searchable retrieval — by invoice number, buyer VAT, date range, or hash. We've supported ZATCA inspection requests with Odoo as the system of record.
How it works
-
Wave assessment
We confirm your wave assignment using ZATCA's published thresholds and (where issued) your wave notification letter. Output: scope of EGS units, expected invoice volume, target go-live date 6 months from notification.
-
CSID provisioning
Production CSIDs issued from ZATCA's Fatoora portal per EGS unit. Requires the entity's ZATCA portal credentials and EGS registration. Typical lead time: 1–2 weeks.
-
Odoo configuration
Saudi Arabia localization module activated. Tax codes (15% standard VAT, 0% zero-rated, exempt), invoice templates (Arabic + English bilingual), and Fatoora API endpoints configured per EGS.
-
Sandbox testing
End-to-end test transactions submitted to ZATCA's developer portal. Standard and simplified flows exercised, including credit notes, debit notes, and B2B/B2C edge cases. ZATCA's test responses validated.
-
Production cutover
Move from sandbox CSIDs to production CSIDs. First 48 hours: real-time monitoring on every submission, with engineering on-call. First 30 days: daily status report on clearance rates and any rejections.
-
Renewal + ongoing support
CSID annual renewals, ZATCA spec updates (the schema evolves), and rejection-triage runbooks. Bundled into our standard ongoing-support engagement.
Deployment timeline
From a green-lit project: 4–6 weeks for a single-entity, single-EGS deployment; 6–10 weeks for multi-entity or multi-branch (10+ EGS units). The hard floor is CSID provisioning (1–2 weeks) and sandbox certification (1–2 weeks) — both gated by ZATCA's turnaround, not by us. If you've received a wave letter, ZATCA gives you 6 months — we recommend starting in month 1, not month 4.
Best for
VAT-registered businesses in Saudi Arabia in any Phase 2 wave (effectively every business above the wave revenue threshold — the threshold drops each wave). Especially valuable for: multi-branch retail and hospitality (each PoS is an EGS), B2B operators with high invoice volumes (clearance latency matters), and group structures running multiple Saudi entities under one parent (one Odoo instance handles them all). Also relevant for non-Saudi businesses with Saudi subsidiaries — we deploy Odoo for the KSA entity even when group HQ runs a different ERP.
Frequently asked questions
-
What are the ZATCA Phase 2 waves and how do I know which one I'm in?
ZATCA assigns waves based on the prior year's VAT-taxable revenue. Wave 1 started 1 January 2023 (revenue above SAR 3 billion). Subsequent waves have stepped down the threshold — Wave 18 onwards covers businesses with revenue above SAR 1 million. ZATCA notifies each business via the Fatoora portal at least 6 months before its integration date. If you're VAT-registered and above the wave threshold, you're in. If you're unsure, we run a free wave-eligibility check as part of the discovery call.
-
What's the difference between standard and simplified tax invoices?
Standard tax invoices (B2B) must be cleared with ZATCA in real time before the buyer copy is issued — clearance latency matters because the customer waits. Simplified tax invoices (B2C, retail, hospitality) are issued to the customer immediately at the point of sale and reported to ZATCA within 24 hours. The QR code and cryptographic stamp are required on both. Odoo handles both flows on one platform, routing by invoice type and customer profile.
-
Do I need a separate compliance vendor, or is Odoo enough?
Odoo is enough. ZATCA's spec is publicly published and the Fatoora APIs are direct — there's no required intermediary in Saudi Arabia (unlike Mexico's PAC model). Most compliance vendors in the market are layering a middleware between your ERP and Fatoora, which adds per-invoice cost and another vendor relationship. Our Odoo build talks to Fatoora directly with no middleware.
-
What happens if ZATCA rejects an invoice?
Rejection is rare in steady-state — usually 0.1–0.5% of submissions — and almost always validation issues (missing VAT number for B2B, mismatched tax codes, malformed Arabic field). Rejected invoices route to a triage queue with ZATCA's error code attached. Most are fixed in seconds and resubmitted; persistent issues escalate to your finance team. Auto-retry handles transient Fatoora outages.
-
Can Odoo handle multiple branches with separate EGS units?
Yes — multi-branch is a first-class scenario. Each branch (or PoS terminal, warehouse, e-commerce channel) registers as its own EGS with its own CSID. Odoo routes each invoice through the right EGS automatically based on the issuing branch. We've shipped this for retail chains with dozens of EGS units running off one Odoo instance.
-
What about Arabic-language invoices?
ZATCA requires Arabic on the invoice (English is optional alongside). Our Odoo invoice templates are bilingual: every field, line item, tax label, and payment-terms block is rendered in Arabic and English, with right-to-left layout where Arabic is primary. The XML submitted to Fatoora uses the language ZATCA requires per field; the printed/PDF copy is bilingual.
-
How long does CSID provisioning take, and can it be parallelised?
Per-EGS CSID provisioning typically takes 1–2 weeks end-to-end. For multi-EGS deployments, we run provisioning in parallel — you can have 20 CSIDs provisioned in the same 1–2 week window if your team can supply the EGS registration details up front. The bottleneck is usually internal coordination, not ZATCA's turnaround.
-
What's the cost?
Single-entity, single-EGS implementation typically lands between SAR 35,000 and SAR 70,000 fixed-price, depending on existing Odoo state and integration complexity. Multi-entity or multi-branch with 5–20 EGS units: SAR 60,000–SAR 150,000. Ongoing support (CSID renewals, schema updates, rejection runbooks) is usually folded into a broader Odoo support retainer.
-
Do you also handle ZATCA VAT returns?
Yes — Odoo's Saudi localization includes the VAT return template aligned with ZATCA's filing format. Output and input tax breakdowns reconcile against the e-invoicing archive, so the VAT return is a one-click generation from production data rather than a separate spreadsheet exercise.
-
What if I'm already on Odoo but not yet ZATCA-compliant?
Common scenario — and faster than a greenfield build. We audit your current Odoo version, your Saudi localization state, your tax-code setup, and the invoice volume by type. Output: a fixed-scope quote and a 3–6 week timeline to ZATCA compliance without disrupting other Odoo workflows.
-
We're a non-Saudi parent with a Saudi subsidiary. Does this still apply?
Yes — ZATCA applies to the Saudi entity regardless of parent geography. We frequently deploy Odoo (or just the Saudi localization layer of an existing Odoo instance) for the KSA subsidiary even when group HQ runs a different ERP. Inter-company flows reconcile cleanly, and the parent's reporting consolidates from Odoo data.