Skip to content

Devices, certificates and branches

ZATCA does not register a company to issue e-invoices. It registers a device, and it is the device that signs.

That one fact explains most of the setup: why you cannot invoice before connecting to ZATCA, why a certificate expiring stops invoicing, and why a second shop needs its own registration rather than a setting.

The three things and how they nest

flowchart TD
    O["Organisation<br/><small>your VAT registration</small>"] --> B1["Branch<br/><small>a location with an address</small>"]
    O --> B2["Branch<br/><small>another location</small>"]
    B1 --> D1["Device<br/><small>one invoice type</small>"]
    B1 --> D2["Device<br/><small>the other type</small>"]
    B2 --> D3["Device"]
    D1 --> C1["Certificate<br/><small>issued by ZATCA, expires</small>"]
    D2 --> C2["Certificate"]
    D3 --> C3["Certificate"]
  • An organisation is your business and its VAT registration.
  • A branch is a location. Its address is printed on invoices issued from it.
  • A device is a registration with ZATCA, tied to one branch and one invoice type.
  • A certificate is what ZATCA issues to that device. The device signs with it.

Why registration is per device

ZATCA's Phase 2 model assumes invoices are produced by identifiable points of sale or billing systems, each with its own cryptographic identity. The signature on an invoice is supposed to answer "which system produced this", not merely "which company".

Practical consequences:

  • You cannot issue an invoice before a device exists. There is nothing to sign with.
  • A device is bound to one invoice type — standard (B2B) or simplified (B2C). A till that does both needs two registrations.
  • Certificates expire. Renewal is routine maintenance, not an exception.

What CSID means

During registration Clix generates a certificate signing request, sends it to ZATCA with your one-time code from the Fatoora portal, and receives a CSID — the cryptographic identity for that device. Clix stores it and uses it to stamp every invoice from that device.

You never handle the key material. The OTP you paste is the only part that passes through your hands, and it is short-lived by design.

When one branch is enough

Most small businesses invoice from one place and need exactly one branch and one or two devices. Add branches when a location genuinely issues its own invoices with its own address — a second shop, a regional office, a warehouse raising delivery notes.

Adding a branch for an internal team or a cost centre is a misuse: the branch address goes on the invoice.

What breaks, and what does not

Event Effect
Certificate expires That device cannot sign. Existing invoices stay cleared.
Device removed No new invoices from it. Its issued invoices are untouched.
Branch address corrected Applies to invoices issued afterwards only.
Organisation VAT number changed Applies going forward; earlier invoices keep what they carried.

The pattern is consistent: issued documents never change retroactively. A cleared invoice is a tax record, and corrections are made with credit and debit notes, never by editing history.