MTB-QR-09QR code carries no cryptographic stamp signature
Mutabiq checks Saudi ZATCA Phase 2 e-invoice XML before you submit it: pre-validation against published ZATCA requirements, not an approval by the authority. This page explains one rule, MTB-QR-09.
Five checks a month on the Free plan. The file is checked in memory and is never stored.
No published ZATCA clause
No clause in ZATCA's published validation rules decodes the QR code's payload, so there is no clause for this page to quote. Mutabiq reads field 9 of the payload as ZATCA's Security Features Implementation Standards, version 1.2, section 4.1, table 3, lays it out, and reports what it finds there at the Advisory level. A finding under this rule is Mutabiq's own check, not a rule ZATCA runs.
Reported at
Advisory
What Mutabiq reports
One entry for each way this rule can be reported.
Reported as
What kind of value was found — empty, not_15_digits and the like — never the value itself.
QR code carries no cryptographic stamp signature
Reported asmtb_qr_09.tag_absentthe field is absent from the QR code
What is wrong
The QR code decoded from this invoice has no field for the signature of the cryptographic stamp, which is tag 9. Tags 6 to 9 exist only on a signed document, and tag 9 in particular is applied to simplified invoices and their notes, so its absence on an unsigned document is expected. This note is advisory and does not affect the result.
What to check in your ERP
Nothing needs changing if this document was not meant to be signed. If it was, tag 9 carries the signature applied over the cryptographic stamp by the authority's technical certification authority, and it arrives with the certificate your e-invoicing module was onboarded with. Mutabiq does not verify it - it reports only which of these fields the QR carries.
QR code cryptographic stamp signature is empty
Reported asmtb_qr_09.tag_emptythe field is empty in the QR code
What is wrong
The QR code decoded from this invoice carries the cryptographic stamp signature field, tag 9, with no value in it. Tags 6 to 9 exist only on a signed document. This note is advisory and does not affect the result.
What to check in your ERP
The field is being written and the value is not, which normally means the QR is assembled from a fixed template of nine fields while the signing step that fills the last four has not run. Mutabiq does not verify the stamp - it reports only which of these fields the QR carries.
The fields of the QR code's payload
The nine fields ZATCA's Security Features Implementation Standards, version 1.2 lays out, in order, each with the rule that reads it. This page is about field 9.
Field 9Signature of the cryptographic stamp MTB-QR-09
A worked example
A synthetic document from the measured test corpus that trips this rule, shown where it differs from one that passed. Mutabiq's report names the class of the value, never the value itself.