What is the ZATCA CSID in Saudi Arabia's e-invoicing system?
The CSID (Cryptographic Stamp Identifier) is a unique cryptographic identifier assigned to each Phase 2 e-invoice in Saudi Arabia's ZATCA Fatoorah system. The CSID is derived from the invoice hash and the taxpayer's compliance cryptographic stamp key, and is embedded in the invoice XML. The CSID enables ZATCA to verify invoice authenticity and detect tampering after clearance.
How does the CSID work in ZATCA Phase 2?
Phase 2 (integration phase) workflow: (1) Taxpayer generates a UBL 2.1 XML invoice with the required ZATCA extensions; (2) The invoice is hashed using SHA-256; (3) A digital signature is applied using the taxpayer's compliance cryptographic stamp certificate issued by ZATCA; (4) The invoice is submitted to the ZATCA clearance API; (5) ZATCA validates format, hash, and signature; (6) If approved, ZATCA adds its own cryptographic stamp (the CSID) and returns the cleared invoice; (7) The cleared invoice (with CSID) is sent to the buyer.
Frequently Asked Questions
- What is the difference between ZATCA Phase 1 and Phase 2?
- Phase 1 (generation phase, December 2021): all taxpayers above SAR 3 million turnover must generate e-invoices in the specified XML format with QR codes, but do not need to submit to ZATCA in real time. Phase 2 (integration phase, from January 2023 in waves): taxpayers must connect their ERP to ZATCA's Fatoorah API for real-time clearance. Each wave covers businesses above a specified turnover threshold; the mandate is being progressively expanded to all VAT-registered businesses.
- What is a simplified tax invoice versus a standard tax invoice under ZATCA?
- A standard tax invoice (B2B) must contain full buyer details (TRN, address) and must pass through ZATCA clearance in Phase 2. A simplified tax invoice (B2C, for transactions under SAR 1,000 and to unregistered buyers) does not require buyer TRN and uses a reporting model rather than clearance: the seller generates the invoice with a QR code and reports to ZATCA within 24 hours.