Since 4 December 2021 every VAT-registered business in Saudi Arabia has had to issue electronic invoices with the required fields and QR codes. Since 1 January 2023, ZATCA has rolled out Phase 2 in waves. Phase 2 adds a direct technical integration with ZATCA's Fatoora platform: B2B and B2G invoices are cleared in real time, and simplified B2C invoices are reported within 24 hours.
Each wave is based on the taxpayer's historical VAT-subject revenue. Wave 25, announced 24 July 2026, is the broadest yet. It targets any taxpayer that exceeded SAR 187,500 in VAT-subject revenue during any of 2022, 2023, 2024 or 2025. ZATCA notifies affected taxpayers directly, at least six months before the integration deadline, which is 1 February 2027.
Who is in Wave 25?
The trigger is not your current monthly or annual revenue. It is your historical VAT-subject revenue in any single year from 2022 to 2025. If any of those years was above SAR 187,500, you are in scope. This catches many small cafรฉs, boutiques, freelancers, service providers and trading businesses that were previously below the threshold.
| Wave | Revenue threshold | Relevant years | Integration deadline |
|---|---|---|---|
| Wave 24 | SAR 375,000+ | 2022โ2025 | 30 June 2026 |
| Wave 25 | SAR 187,500+ | 2022โ2025 | 1 February 2027 |
What Phase 2 actually requires
Phase 2 is not just issuing a PDF with a QR code. Your invoicing system must:
- Generate invoices in UBL 2.1 XML adapted for Saudi Arabia
- Create a UUID for each invoice and embed a compliant QR code
- Apply a cryptographic stamp and digital signature
- Clear B2B and B2G invoices with ZATCA in real time before delivery
- Report simplified B2C invoices within 24 hours
- Maintain tamper-proof storage and audit logs for five years
Most of this must happen automatically. Manual entry or after-the-fact uploading is not compliant for standard invoices.
Preparation checklist for SMEs
- Confirm your wave status. Log in to the ZATCA Fatoora portal or wait for the official notification. Do not assume you are exempt because your current revenue is lower.
- Check your current system. Ask your POS, accounting or ERP provider if it is ZATCA Phase 2 certified and supports the current UBL 2.1 XML and QR format.
- Issue a Cryptographic Stamp Identifier (CSID). Register for a CSID and get the production cryptographic materials from the Fatoora portal.
- Run sandbox tests. Send sample invoices through the Fatoora sandbox until all error codes are cleared. Common issues are missing buyer TRNs, wrong tax codes and invalid unit codes.
- Clean your master data. Fix buyer TRNs, item codes, tax categories and unit of measure before go-live. Bad data is the main reason invoices are rejected.
- Train the team. Make sure cashiers, sales staff and accountants understand what an accepted, rejected and cleared invoice looks like.
- Go live before the deadline. Allow a two-week buffer for any last-minute production issues. ZATCA penalties start after the deadline, not at it.
Penalties for non-compliance
ZATCA has made the penalty framework clear. For Phase 2 violations, fines range from SAR 5,000 to SAR 50,000 per violation. Repeated failures to issue or report invoices correctly can lead to higher penalties and operational restrictions. The best defence is to go live early and keep a clean rejection-handling process.
How to make Wave 25 easier
The fastest, lowest-risk route for SMEs is a native ZATCA-certified accounting or POS solution that handles the XML, QR code, CSID, clearing and reporting in one stack. Third-party middleware can work, but it adds a monthly fee, an extra integration point and a higher chance of breakage when ZATCA updates its specification.
For businesses that also operate in the UAE or other GCC markets, the same data discipline helps when it is time to adopt Peppol PINT-AE or other formats. Clean master data, structured invoice templates and an audit trail are the common foundation.
Bottom line
Wave 25 is not a future problem. The 1 February 2027 deadline leaves less than six months from announcement to enforcement. SMEs should confirm their status, choose a certified system, run sandbox tests and clean master data now. The businesses that start early will avoid the penalty exposure and the last-minute integration crunch that usually hits the market just before a ZATCA wave deadline.
Frequently asked questions
What is ZATCA Phase 2 Wave 25?
Wave 25 is the latest group of taxpayers required to integrate with the ZATCA Fatoora platform. It covers businesses with VAT-subject revenue above SAR 187,500 in any year from 2022 to 2025, with an integration deadline of 1 February 2027.
How is Wave 25 different from Wave 24?
Wave 24 used a SAR 375,000 threshold. Wave 25 cuts that in half, which brings tens of thousands of smaller businesses into scope for the first time.
What happens if I miss the 1 February 2027 deadline?
ZATCA can impose fines from SAR 5,000 to SAR 50,000 per violation and may require your system to be compliant before normal operations resume.
How do I know if my business is in Wave 25?
Check the Fatoora portal and your official ZATCA notifications. ZATCA sends notices at least six months before the deadline, but you can also calculate eligibility from your historical VAT-subject revenue.
Do I need a new software system for Wave 25?
If your current POS, accounting or ERP is not ZATCA Phase 2 certified, you will need an upgrade or a new system. Middleware is an option, but a native certified solution is usually simpler for SMEs.