If your business earned more than SAR 375,000 in VAT-taxable revenue in any single year since 2022, Saudi Arabia's tax authority now expects your invoicing system to be talking directly to its servers — and the deadline already passed on June 30, 2026. Miss that obligation and you are exposed to fines of up to SAR 50,000 per violation category, rejected invoices that freeze your receivables, and exclusion from government procurement. Here is how to tell whether you are in scope, what compliance actually requires, and what to do if you are late.
Wave 24 in 60 Seconds
Saudi Arabia's Zakat, Tax and Customs Authority (ZATCA) has been rolling out the second phase of its Fatoora e-invoicing program in waves since January 2023, starting with the largest taxpayers and working downward. On September 26, 2025, ZATCA announced the criteria for Wave 24: taxpayers whose revenue subject to VAT exceeded SAR 375,000 (roughly USD 100,000) in 2022, 2023, or 2024 must integrate their e-invoicing systems with the Fatoora platform by June 30, 2026.
Three things make this wave different from everything before it:
- It is the lowest threshold ZATCA had ever set. Earlier waves covered businesses with turnover above SAR 750,000 and higher. Wave 24 reaches deep into the SME population — small retailers, cafes, workshops, and service providers.
- One year is enough. You do not need to have exceeded SAR 375,000 in all three reference years. A single year above the line in 2022, 2023, or 2024 pulls you into scope, regardless of what your turnover is today.
- The deadline is behind us. As of this writing, Wave 24 taxpayers should already be integrated. If you are in scope and still issuing invoices the old way, every invoice you send deepens the exposure.
And the net keeps widening: in July 2026 ZATCA announced Wave 25, covering businesses above just SAR 187,500 — the voluntary VAT registration threshold — with an integration deadline of February 1, 2027. Even if Wave 24 missed you, the next wave may not.
Are You in Wave 24? A Three-Question Test
Work through these in order. A "yes" to all three means you were expected to be integrated by June 30, 2026.
1. Are you registered for VAT in Saudi Arabia?
Phase 2 applies to VAT-registered taxpayers issuing tax invoices (B2B) or simplified invoices (B2C). If you are registered — mandatorily or voluntarily — keep going.
2. Did your VAT-taxable revenue exceed SAR 375,000 in 2022, 2023, or 2024?
Pull your VAT returns for those three years and check the taxable turnover figure — not profit, not total bank deposits, but the revenue subject to VAT you declared. If any single year crosses SAR 375,000, you meet the criterion. Note that ZATCA's formal notification is decisive: the authority notifies each wave's taxpayers directly, at least six months before the go-live date. If you received a Wave 24 notice, you are in scope even if your own math feels borderline.
3. Are you issuing every invoice through an integrated, compliant solution?
Phase 1 (mandatory since December 2021) already banned handwritten invoices and required structured electronic invoices with QR codes. Phase 2 goes further: your invoicing software must be onboarded to Fatoora and exchanging data with ZATCA in real time. If your "e-invoicing" is still a PDF emailed to the customer, you have not met Phase 2.
What Phase 2 Actually Requires
Phase 2 is the integration phase, and it is a genuine technical project — not a settings checkbox. The core requirements:
Onboard your invoicing solution to Fatoora. Each invoicing device or software unit (what ZATCA calls an EGS unit) must be registered through the Fatoora portal using a one-time password, after which it receives cryptographic certificates. Only onboarded solutions may issue valid invoices.
Issue invoices as structured XML. Every invoice must be generated in the UBL 2.1 XML format ZATCA specifies, carrying a UUID, a QR code, a cryptographic stamp, and a hash of the previous invoice — a tamper-evident chain linking each invoice to the one before it.
Clear B2B invoices before sharing them. Standard tax invoices follow a clearance model: your system submits the invoice to ZATCA, ZATCA validates and stamps it, and only then do you send it to your customer. Build the round trip into your billing workflow — same-day invoicing now depends on API uptime, yours and theirs.
Report B2C invoices within 24 hours. Simplified invoices for consumers follow a lighter reporting model: issue first, then report to ZATCA within 24 hours. Miss that window repeatedly and the violations stack up.
Archive everything for six years. Invoices and their associated records must be stored and retrievable for six years. If you switch software providers, your archive migrates with you — "our old vendor has it" is not a defense in an audit.
Train the people who press the buttons. Rejected invoices, failed submissions, and technical outages all have prescribed handling. Your staff needs to know what a clearance rejection looks like, how to correct and resubmit, and when a technical failure must itself be reported to ZATCA (failure to report one carries its own SAR 10,000 fine).
The Cost of Standing Still
ZATCA assesses e-invoicing violations under its tax violation fine schedule, and the numbers escalate. Published guidance puts Phase 2 fines in a range from SAR 5,000 up to SAR 50,000 depending on the violation and repetition, with lower-tier violations starting around SAR 1,000 and rising on repeat offenses within a 12-month window. Specific pain points include failing to integrate from your mandated date, issuing invoices outside the compliant solution, missing QR codes or wrong formats, and late reporting of simplified invoices.
But fines are only the visible part. Non-compliant invoices can be rejected outright, which means your customer cannot claim the VAT and your receivable sits unpaid while you fix the paperwork. Repeated non-compliance can shut you out of government and large-corporate procurement, where a valid cleared invoice is table stakes. For a small business running on thin margins, a month of disputed receivables hurts more than any single fine.
There is also a timing trap worth naming: ZATCA's tax amnesty initiative, which waived certain fines and penalties, ran through June 2026 — the same month as the Wave 24 deadline. Businesses that integrated during the amnesty window could clean up past exposure cheaply. That window has now closed, so late comers face the full schedule.
If You Missed the June 30 Deadline: A Recovery Plan
Discovering you are late is unpleasant, but every week of delay adds invoices to the non-compliant pile. Work this plan in order:
- Confirm your wave today. Log in to your Fatoora portal account and check your notifications. Do not rely on memory or on a forwarded email — the portal is the source of truth for which wave you are in and what ZATCA expects of you.
- Freeze non-compliant issuance. Stop issuing invoices outside a compliant flow the moment you confirm scope. Every additional manual or unintegrated invoice is a fresh violation.
- Pick a compliant solution this week. Choose invoicing software or an ERP module that is already certified for ZATCA Phase 2 integration — ask the vendor for proof of successful customer onboardings in your wave bracket, not just a roadmap promise. For micro-businesses, a simple compliant POS or cloud invoicing app is enough; you do not need an enterprise ERP.
- Onboard and test before you go live. Complete the OTP onboarding for each invoicing unit, then run test invoices through clearance and reporting in the simulation environment before switching over. Most painful go-lives trace back to skipping this step.
- Backfill and document. Work with your accountant to determine how to handle invoices issued during the gap, and keep a written record of your remediation timeline. A documented good-faith sprint toward compliance is your best posture if ZATCA queries the late period.
- Talk to your accountant about voluntary disclosure. If the gap is large, professional advice on disclosure beats hoping the gap goes unnoticed — ZATCA's whole Phase 2 architecture exists to give it invoice-level visibility.
Wave 25 Is Already Announced: Prepare Now
On July 24, 2026, ZATCA published the Wave 25 criteria: taxpayers with VAT-taxable revenue above SAR 187,500 in any of 2022 through 2025 must integrate by February 1, 2027. That figure matches the voluntary VAT registration threshold, which means Wave 25 reaches nearly every VAT-registered business in the Kingdom — including small cafes, boutiques, and solo service providers that have never thought of themselves as in-scope for anything.
If your turnover sits between SAR 187,500 and SAR 375,000, you have roughly four months. The good news is that the compliance playbook is now well understood and vendors have productized it; the bad news is that every other business in your bracket is shopping for onboarding help at the same time. Start early, because integrator calendars fill up as each deadline approaches — that pattern has repeated in every wave so far.
Keep Your Transaction Records Audit-Ready
E-invoicing mandates like Fatoora share one underlying message: the tax authority now sees your invoices in real time, so your books must agree with what you reported — every invoice, every hash in the chain, every archived XML file. The businesses that sail through these transitions are the ones whose internal records already reconcile cleanly to their filings.
That is a bookkeeping discipline problem as much as a software problem. Beancount.io provides plain-text accounting that gives you complete transparency and control over your financial data — no black boxes, no vendor lock-in. Get started for free and see why developers and finance professionals are switching to plain-text accounting.
