Kingdom of Saudi Arabia • ZATCA Fatoora Phase 2 Mandate

Saudi Arabia ZATCA E-Invoicing Phase 2 in Odoo: The Complete Implementation Guide

A comprehensive, end-to-end technical guide for KSA enterprises and CFOs to achieve 100% compliance with ZATCA Phase 2 (Integration Phase) using Odoo ERP. Learn how to automate Fatoora CSID onboarding, UBL 2.1 XML signing, real-time B2B invoice clearance, and tamper-proof cryptographic audit trails.

Schedule Free ZATCA Compliance AuditDirect WhatsApp KSA Desk
Official Odoo Ready PartnerOdoo 16, 17, 18, 19 & 20 Supported100% ZATCA Wave Compliant

Understanding ZATCA Phase 2: What KSA Businesses Must Know

The Zakat, Tax and Customs Authority (ZATCA) in the Kingdom of Saudi Arabia rolled out the e-Invoicing regulation under the umbrella of Saudi Vision 2030 to combat shadow economy transactions, minimize tax evasion, and promote fair market competition.

While Phase 1 (Generation Phase), which commenced in December 2021, required taxpayers to issue and store invoices electronically via compliant ERP solutions without manual handwriting or editing, Phase 2 (Integration Phase) is a comprehensive technical overhaul. It requires businesses to establish a real-time REST API integration between their ERP system—specifically Odoo Accounting—and ZATCA's centralized Fatoora Platform.

Official Odoo Reference

Odoo provides standard Saudi fiscal localization modules (l10n_sa_edi). As detailed in the official Odoo Saudi Arabia Fiscal Localization Documentation, achieving production compliance requires tailored onboarding of cryptographic certificates, journal rules, and XML signature validation.

Phase 1 vs. Phase 2: Technical Comparison Matrix

Review how requirements shift dramatically from simple invoice generation to cryptographic integration:

ParameterPhase 1 (Generation)Phase 2 (Integration)
Integration with Tax AuthorityOffline generation; no direct link to ZATCAReal-time automated REST API integration with Fatoora Portal
Invoice File FormatPDF or electronic format with basic QR codeStandardized UBL 2.1 XML format embedded into PDF/A-3
Cryptographic SecurityStandard ERP database integrityECDSA secp256k1 digital signatures & CSID certificate stamps
Invoice Chaining & Tamper ProtectionInternal ERP sequence numberingPrevious Invoice Hash (PIH) SHA-256 cryptographic chaining
B2B Standard InvoicesIssued directly to buyerMandatory pre-clearance by ZATCA before issuing to buyer
B2C Simplified InvoicesPrinted QR code given to consumerCryptographically signed QR code + 24-hr batch reporting API
Credit & Debit NotesBasic return notes linked internallyMandatory UBL BillingReference linking original invoice UUID & hash

Step-by-Step ZATCA Phase 2 Onboarding Architecture in Odoo

Maifelz Technologies implements an automated, fault-tolerant onboarding and clearance workflow directly inside your Odoo environment:

1

Company & Branch Configuration

Configuring company details in Odoo with valid Arabic Commercial Registration (CRN), 15-digit VAT Identification Number (starting and ending with 3), National Address (building number, street name, district, postal code, and additional number).

2

CSR Generation & Cryptographic Stamp

Generating the Certificate Signing Request (CSR) along with private keys using the ECDSA secp256k1 curve directly from Odoo. This identifies your specific ERP EGS (Electronic Generation Solution) unit.

3

Fatoora Portal Authentication via OTP

Logging into the official ZATCA Fatoora Portal, generating a One-Time Password (OTP) for the device, and requesting the Compliance CSID (CCSID) from ZATCA API endpoints.

4

Sandbox Compliance Validation

Transmitting sample Standard Invoices, Simplified Invoices, Credit Notes, and Debit Notes against the ZATCA Compliance engine to confirm zero schema, tax, or signature validation errors.

5

Production CSID Activation & Live Clearance

Migrating the EGS unit to Production CSID (PCSID). From this point forward, every invoice posted in Odoo automatically undergoes digital signing, UBL 2.1 XML compilation, and real-time clearance/reporting transmission.

Technical Anatomy: The Core Building Blocks of an Odoo Phase 2 Invoice

UBL 2.1 XML Format

Complies strictly with ISO/IEC 19845 (UBL 2.1) syntax including invoice type codes (388 for invoice, 381 for credit note, 383 for debit note), tax subtotal calculations, and Arabic legal identifiers.

ECDSA secp256k1 Signature

The invoice XML canonical hash is signed using an Elliptic Curve Digital Signature Algorithm (ECDSA) with SHA-256 and the private key corresponding to your registered CSID X.509 certificate.

Previous Invoice Hash (PIH)

Every invoice cryptographically links to the SHA-256 hash of the preceding invoice in the journal sequence. This creates an unalterable blockchain-like chain, preventing invoice tampering or retroactive deletions.

Phase 2 TLV QR Code

Contains 9 TLV tags encoded in Base64: Seller Name, VAT Number, Timestamp, Total with VAT, VAT amount, XML Hash, ECDSA Digital Signature, ECDSA Public Key, and Cryptographic Stamp (CSID signature).

ZATCA Phase 2 Rollout Waves Timeline

Updated for 2025–2026 Mandates

ZATCA notifies taxpayers at least 6 months before their mandatory enforcement date based on annual VAT revenue. Check where your organization falls:

Wave 1

Revenue > SAR 3 Billion

January 1, 2023
Wave 2

Revenue > SAR 500 Million

July 1, 2023
Wave 3

Revenue > SAR 250 Million

October 1, 2023
Wave 4

Revenue > SAR 150 Million

November 1, 2023
Wave 5

Revenue > SAR 100 Million

December 1, 2023
Wave 6

Revenue > SAR 70 Million

January 1, 2024
Wave 7

Revenue > SAR 50 Million

March 1, 2024
Wave 8

Revenue > SAR 40 Million

March 1, 2024
Wave 9

Revenue > SAR 30 Million

June 1, 2024
Wave 10

Revenue > SAR 25 Million

October 1, 2024
Wave 11

Revenue > SAR 15 Million

November 1, 2024
Wave 12

Revenue > SAR 10 Million

December 1, 2024
Wave 13+

Revenue > SAR 7 Million & Expanding to All Taxpayers

2025 – 2026 Active

Why Saudi Businesses Partner with Maifelz Technologies

As an Official Odoo Ready Partner, Maifelz Technologies LLP delivers proven, compliant ERP implementations for KSA businesses, backed by our dedicated Saudi ERP desk in Riyadh, Jeddah, Dammam, and our offshore technical hub in India (Kerala).

Turnkey CSID Setup: We handle complete CSR generation, OTP verification, and compliance testing with zero hassle for your finance team.
Multi-Branch & Multi-Company: Dedicated EGS registration and cryptographic certificates for each commercial branch (CRN).
Arabic Localization: Bilingual Arabic-English invoices, right-to-left (RTL) POS, and Saudi payroll rules (GOSI).
24/7 SLA Support: Automated API queue retry and alert systems to prevent invoice clearance delays.
Request KSA ConsultationVerify Odoo Partner Listing

Frequently Asked Questions (FAQ)

What is the difference between ZATCA Phase 1 and Phase 2 in Odoo?

Phase 1 (Generation Phase) required businesses in Saudi Arabia to generate and store electronic invoices with basic TLV QR codes without editing capabilities. Phase 2 (Integration Phase) mandates direct API integration between Odoo ERP and the ZATCA Fatoora platform, requiring cryptographic stamps (CSID), ECDSA digital signatures, UBL 2.1 XML formats, and real-time clearance for B2B invoices.

Which Odoo versions support ZATCA Phase 2 e-Invoicing?

ZATCA Phase 2 is supported in Odoo Enterprise (versions 16, 17, 18, 19, and 20) via the official fiscal localization module (l10n_sa_edi). Maifelz Technologies also provides customized, turnkey Phase 2 enterprise connectors for Odoo Community and customized enterprise multi-branch setups.

How does the Cryptographic Stamp Identifier (CSID) onboarding work in Odoo?

Onboarding requires generating a Certificate Signing Request (CSR) directly from Odoo, requesting an OTP from the ZATCA Fatoora Portal, authenticating with ZATCA to receive the Compliance CSID (CCSID), passing sandbox compliance test invoices, and finally obtaining the Production CSID (PCSID) for live transactional clearance.

What happens if our Odoo server loses internet connectivity during invoicing?

For B2C simplified tax invoices, ZATCA allows a 24-hour reporting grace period, meaning Odoo queues invoices and syncs them automatically once connectivity is restored. For B2B standard invoices requiring real-time clearance, Maifelz configures automated failover retry queues and alert notifications to ensure zero business disruption.

Can Maifelz integrate ZATCA Phase 2 for multi-company and multi-branch operations?

Yes. Maifelz Technologies specializes in multi-company and multi-branch KSA setups, where each legal commercial registration (CRN) or branch has its dedicated CSID certificate, journal sequencing, and automated Fatoora reporting pipeline within a single unified Odoo database.