ZATCA E-Invoicing Phase 2: Wave 25, Deadlines and How to Integrate

On 24 July 2026, ZATCA announced Wave 25 of e-invoicing Phase 2, and it pulled in a lot of businesses that had assumed this was a big-company problem. The revenue threshold halved, from SAR 375,000 in Wave 24 to SAR 187,500. If your VAT-able revenue went over SAR 187,500 in any year from 2022 to 2025, your invoicing system has to be connected to ZATCA's Fatoora platform by 1 February 2027.

That's a small café, a boutique, a freelance consultant or a two-person trading company. Many of them are running on a basic POS, a template in Excel or a Phase 1 app that prints a QR code and nothing else. None of those meet Phase 2.

We build POS, inventory and invoicing software for businesses in the GCC and Pakistan, and we've written about the UAE's e-invoicing rollout and FBR digital invoicing already. Saudi Arabia has been doing this the longest, and its system is the most technical of the three. This guide explains it in plain terms: who's in scope, what Phase 2 actually requires, how onboarding works and what it costs you to get it wrong.

What is ZATCA e-invoicing Phase 2?

ZATCA e-invoicing Phase 2, also called the Integration Phase, is the stage where a VAT-registered business's invoicing system connects directly to ZATCA's Fatoora platform. Every invoice is created as a structured XML file with a digital signature, a unique ID and a QR code, and is either cleared by ZATCA before it goes to the customer (B2B) or reported to ZATCA within 24 hours (B2C).

Phase 1, the Generation Phase, started on 4 December 2021. It only asked businesses to issue invoices from an electronic system with a QR code and to stop handwritten or edited invoices. Phase 2 started on 1 January 2023 for the largest companies and has been moving down the revenue ladder in waves since then.

Which ZATCA wave am I in?

ZATCA picks each wave by VAT-able revenue in specific reference years and notifies businesses directly, at least six months before their deadline. These are the most recent waves:

Two things to check. First, it's "any" of the reference years, so one good year in 2023 is enough to put you in, even if 2025 was slow. Second, SAR 187,500 is the voluntary VAT registration threshold, so Wave 25 reaches businesses that registered for VAT voluntarily as well as everyone above the mandatory SAR 375,000 line.

If you haven't received a notification, log in to your ZATCA account and check. Don't wait for an email to arrive before you start, because the technical work takes longer than most people expect.

What's the difference between clearance and reporting?

This is the part of Phase 2 that changes how your business runs day to day.

A standard tax invoice (B2B or B2G) goes through clearance. Your system sends it to Fatoora in real time, ZATCA validates it, adds its own stamp and QR code, and sends it back. Only then can you give it to your customer. If Fatoora rejects it, you don't have a valid invoice yet.

A simplified tax invoice (B2C, the receipt at a shop counter) goes through reporting. Your system signs it, prints it with the QR code and hands it to the customer straight away, then reports it to Fatoora within 24 hours.

So a retailer that only sells to the public mostly deals with reporting. A wholesaler or a services company that bills other businesses deals with clearance on almost every invoice, and needs a system that can wait for ZATCA's response before printing.

What does a Phase 2 invoice need to contain?

Each invoice, credit note and debit note has to be generated as UBL 2.1 XML (or a PDF/A-3 file with the XML embedded) and include:

• A UUID, which is a unique identifier for that invoice

• An invoice counter that increases with each invoice from that device

• A hash of the previous invoice, which chains every invoice to the one before it so nothing can be deleted or slipped in later

• A cryptographic stamp, an ECDSA digital signature made with a certificate ZATCA issues to your system

• A QR code, which in Phase 2 has nine tags: the five from Phase 1 (seller name, VAT number, timestamp, total and VAT amount) plus the XML hash, the signature, the public key and, for simplified invoices, ZATCA's signature of the stamp

You don't build any of this by hand. Your POS or ERP has to produce it automatically for every document, which is why a Phase 1 system that just prints a QR code usually can't be "upgraded" with a plugin. It needs real Phase 2 support.

How does ZATCA onboarding work?

Onboarding is how your system gets the certificates it needs to sign invoices and talk to Fatoora. In outline:

1. Log in to the Fatoora portal and generate a one-time password (OTP) for the device or system you're onboarding.

2. Your e-invoicing software creates a certificate signing request and uses the OTP to get a compliance CSID (Cryptographic Stamp Identifier). This one is temporary.

3. The software sends sample invoices, credit notes and debit notes for the compliance checks.

4. Once those pass, the software requests a production CSID, which it uses for live invoices.

Onboarding is per unit. Every till, branch server or invoicing instance that issues invoices needs its own onboarding and its own certificate. A business with six POS terminals across three branches has six units to onboard, so plan for it.

The OTP expires quickly, so have whoever runs your software ready when you generate it.

What are the penalties for not complying?

ZATCA uses a progressive system: penalties usually start with a warning and rise for repeat violations within 12 months. The amounts reported for common violations are:

Check ZATCA's current penalty table before relying on these numbers, because the exact amount depends on the violation and how many times it has happened.

ZATCA ran a penalty cancellation initiative that gave businesses relief on older fines. It ended for good on 30 June 2026, so new violations don't have that safety net.

As with every e-invoicing mandate we've seen, the commercial cost tends to hurt before the fines do. Large Saudi buyers won't accept a B2B invoice that hasn't been cleared, because it doesn't support their input VAT.

Can you edit or cancel an invoice after it's issued?

No. Once an invoice is issued, you can't change or delete it. That's the whole point of the hash chain. If something was wrong, you issue a credit note or debit note that references the original invoice, and those go through clearance or reporting the same way invoices do.

This catches out businesses used to fixing mistakes by editing the original invoice and reprinting it. Train staff on credit notes before go-live, because deleting or amending an issued invoice is one of the more expensive penalties.

What should you do before 1 February 2027?

If you're in Wave 25, this is the order we'd work in:

1. Confirm you're in scope by checking your revenue for 2022 to 2025 and your ZATCA notification.

2. List every place an invoice is created: POS tills, accounting software, a sales rep's tablet, an online store. Each one is a unit to onboard or replace.

3. Ask your software provider in writing whether the product is ZATCA Phase 2 compliant and listed with ZATCA. If they hedge, assume it isn't.

4. Clean your master data: your VAT number and address, customer VAT numbers for B2B buyers, and product tax categories.

5. Onboard in the sandbox first and test standard invoices, simplified invoices, credit notes, debit notes and invoices with discounts.

6. Plan for internet outages. Simplified invoices can be issued offline and reported within 24 hours, but your system has to queue them properly.

7. Onboard production units, train staff and go live before the deadline, not on it.

ZATCA keeps a list of e-invoicing solution providers on its website. It's a good starting point, but test any system with your own real invoices before you commit.

Should you upgrade your current system or replace it?

It depends what you're running. Larger ERPs (SAP, Oracle, Microsoft Dynamics, Odoo, ERPNext) have Phase 2 modules or connectors, so upgrading usually makes sense. A local POS that was built for Phase 1 may have a Phase 2 version, or may never get one.

Custom-built systems are where we see the most work. They can be made compliant, but someone has to build XML generation, signing, the hash chain, onboarding for each unit, clearance and reporting calls, and error handling. For a small business, a ready-made compliant POS is usually cheaper. For a business with its own processes and a system it relies on, adding a Phase 2 layer to the existing software often costs less than moving everything.

Common mistakes we see

• Assuming a Phase 1 QR code means you're covered for Phase 2.

• Onboarding the main office system and forgetting the branch tills.

• Printing B2B invoices before Fatoora has cleared them.

• No offline queue, so a shop stops selling when the internet drops.

• Editing invoices instead of issuing credit notes.

• Waiting for the ZATCA notification before starting, then running out of time.

Key takeaways

• Wave 25 covers businesses with VAT-able revenue over SAR 187,500 in any year from 2022 to 2025, with a deadline of 1 February 2027.

• B2B invoices must be cleared by ZATCA in real time before you issue them. B2C invoices are reported within 24 hours.

• Every invoice needs UBL 2.1 XML, a UUID, a hash chain, a digital signature and a nine-tag QR code.

• Each device or system that issues invoices has to be onboarded separately with its own CSID.

• Issued invoices can't be edited. Use credit and debit notes.

• Penalties escalate with repeat violations and can reach SAR 50,000, and the penalty cancellation initiative ended on 30 June 2026.

Frequently asked questions

What is ZATCA Wave 25?

It's the 25th group of businesses required to integrate with ZATCA's Fatoora platform under e-invoicing Phase 2. It covers taxpayers whose VAT-able revenue exceeded SAR 187,500 in any of 2022, 2023, 2024 or 2025, and the deadline is 1 February 2027.

What is the difference between ZATCA Phase 1 and Phase 2?

Phase 1 required invoices to be generated electronically with a basic QR code. Phase 2 requires your system to connect to ZATCA, produce signed XML invoices and either get B2B invoices cleared in real time or report B2C invoices within 24 hours.

Do I need to integrate with ZATCA if I only sell to consumers?

Yes, if you're in a Phase 2 wave. Your simplified invoices don't need real-time clearance, but they must be signed, carry the Phase 2 QR code and be reported to ZATCA within 24 hours.

How long does ZATCA Phase 2 integration take?

With a ready-made compliant POS, onboarding can take days. Upgrading an ERP or building Phase 2 into custom software usually takes weeks to a few months, depending on how many units you have and how clean your data is.

What is a CSID in ZATCA?

A Cryptographic Stamp Identifier is the certificate ZATCA issues to each e-invoicing unit so it can sign invoices and communicate with Fatoora. You get a temporary compliance CSID for testing and a production CSID for live invoices.

Can I issue invoices when the internet is down?

For simplified (B2C) invoices, yes. You can issue them offline and report them within 24 hours. Standard (B2B) invoices need clearance, so they have to wait until the connection is back.

Do foreign companies need ZATCA e-invoicing?

If you're registered for VAT in Saudi Arabia and fall into a Phase 2 wave, the rules apply to your Saudi invoices. Confirm your position with a Saudi tax adviser, because non-resident setups vary.

Need your system ready for ZATCA Phase 2?

We build POS, inventory and invoicing software for businesses across the GCC and Pakistan, and we add Phase 2 support to existing systems: XML generation, signing, onboarding for each unit, clearance and reporting. If you're in Wave 25 and not sure your software will make it, send us your setup on WhatsApp and we'll come back with a written scope and a fixed quote.

This is a practical guide, not tax advice. ZATCA updates its rules and penalty tables, so confirm your obligations on zatca.gov.sa or with your tax adviser.

Sources

• E-invoicing, Zakat, Tax and Customs Authority (ZATCA)

• Saudi Arabia announces 25th wave of e-invoicing integration, VATupdate

• ZATCA Wave 25 integration guide, Origami

• ZATCA e-invoicing Phase 2: all 25 waves and deadlines, Amal ERP

• ZATCA non-compliance penalties, InvoiceQ