Complete Guide to Compliance Services Device for Saudi E-Invoicing Phase 2
Last updated: March 30, 2026
The **CSD (Compliance Services Device) certificate** is a mandatory requirement for all taxpayers in Saudi Arabia under ZATCA's Phase 2 e-invoicing. It enables digital signing, cryptographic stamping, and secure API communication with the Fatoora portal. Without a valid CSD certificate, your e-invoices will be rejected.
A CSD (Compliance Services Device) certificate is a digital certificate issued by ZATCA-approved providers. It acts as a unique identity for your business when sending e-invoices to ZATCA. The certificate is used for:
ZATCA requires a CSD certificate to prevent invoice tampering, fraud, and ensure tax compliance. Without a valid CSD certificate, your e-invoices will be rejected by the Fatoora portal. Phase 2 integration cannot proceed without it.
As of 2026, the following providers are authorized to issue CSD certificates for ZATCA e-invoicing:
The cost varies by provider and certificate validity period:
Once you have the CSD certificate, you need to integrate it with your e-invoicing solution:
Understanding the timeline helps you plan your Phase 2 integration:
CSD certificates have an expiry date (typically 1-3 years). The renewal process is simpler:
A: No. Free SSL certificates (like Let's Encrypt) are NOT accepted. You must purchase a CSD certificate from ZATCA-approved providers like Geotrust or Digicert. Free certificates lack the required cryptographic capabilities for digital signing.
A: Typically 5-10 business days after submitting all required documents. Plan well before your Phase 2 integration deadline. Start the process at least 30 days before your integration date.
A: Yes, a single CSD certificate can be used for all invoices from the same legal entity (same TRN). Each branch does not need a separate certificate as long as they share the same TRN.
A: ZATCA will reject your e-invoices. You must renew the certificate before expiry. The renewal process is simpler and faster (3-5 business days) than the initial application. Set reminders 60 days before expiry.
A: Yes, both models require a valid CSD certificate for digital signing and cryptographic stamp generation. There is no exception for either model.
A: SSL certificates secure website connections. CSD certificates are specifically designed for digital signing and cryptographic stamping of e-invoices. You cannot use one for the other.
A: HSM is recommended for large enterprises with high invoice volumes. For small businesses, software-based storage (keystore) is acceptable. Check your provider's requirements.
A: Yes, ZATCA provides a Sandbox environment where you can test integration using a test CSD certificate. This allows you to validate your implementation before purchasing a production certificate.