ZATCA has set the criteria for Wave 25 of the e-invoicing Integration Phase (Phase 2): taxpayers whose revenue subject to VAT exceeded SAR 187,500 in 2022, 2023, 2024 or 2025 must integrate with the FATOORA platform by 1 February 2027. This guide shows how to check whether you are in scope, what Wave 25 requires and what to do before the deadline. Our ZATCA Phase 2 integration service builds the complete integration around your current system.
How do ZATCA waves work?
ZATCA rolls out Phase 2 in waves. For each wave it sets a revenue threshold and the years that count, and notifies the targeted taxpayers of their integration date. ZATCA has said it notifies each wave at least six months in advance.
The thresholds have fallen steadily as Phase 2 has reached smaller businesses. Here are the recent waves, verified on ZATCA’s own announcements, newest first:
| Wave | VAT-subject revenue above | Years considered | Integrate with FATOORA by |
|---|---|---|---|
| Wave 25 | SAR 187,500 | 2022, 2023, 2024 or 2025 | 1 February 2027 |
| Wave 24 | SAR 375,000 | 2022, 2023 or 2024 | 30 June 2026 |
| Wave 21 | SAR 1.25 million | 2022, 2023 or 2024 | 30 November 2025 |
| Wave 20 | SAR 1.5 million | 2022 or 2023 | 31 October 2025 |
Earlier waves, from 1 January 2023, covered larger taxpayers. Wave 25 halves the Wave 24 threshold, so many small businesses and sole establishments that were outside earlier waves are now included.
How do I check whether I am in Wave 25?
Work through these steps for each VAT-registered entity:
- Get your VAT-subject revenue per year. Use the revenue reported in your VAT returns for 2022, 2023, 2024 and 2025.
- Compare each year with SAR 187,500. If any single year is above the threshold, you meet the Wave 25 criterion.
- Check whether you were in an earlier wave. If your revenue exceeded SAR 375,000 in 2022–2024, you were likely targeted in Wave 24 or earlier, with an earlier deadline. If you have not integrated yet, treat it as urgent.
- Watch for ZATCA’s notification. ZATCA notifies targeted taxpayers directly. Make sure the contact details registered with ZATCA are current, so the notice reaches the right person.
- Check every system that issues invoices. Each e-invoice generation solution (EGS), such as an ERP instance or POS terminal, must be onboarded.
What does Wave 25 require you to build?
Being in Wave 25 means your invoicing solution must connect to FATOORA, not just generate invoices electronically. In summary:
| Requirement | What it means |
|---|---|
| UBL 2.1 XML | Every tax invoice, credit note and debit note generated as XML following ZATCA’s data dictionary and rules |
| Cryptographic stamp | Each invoice signed with the key behind your CSID |
| Hash chaining | Each invoice carries the previous invoice hash (PIH), a counter (ICV) and a UUID |
| QR code | TLV-encoded, Base64 QR on every invoice, mandatory on simplified invoices |
| CSID onboarding | Each EGS unit onboarded with an OTP from the FATOORA portal, passing compliance checks |
| Clearance | Standard (B2B/B2G) invoices cleared by ZATCA before they are shared with the buyer |
| Reporting | Simplified (B2C) invoices reported to ZATCA within 24 hours |
The technical detail for each step is in our ZATCA Phase 2 integration guide.
What should a small business do before 1 February 2027?
With the deadline in early 2027, plan backwards from late January and leave a buffer for onboarding problems.
- Confirm scope for each entity using the steps above, and keep a copy of the revenue figures you relied on.
- List your invoicing systems and EGS units: each POS terminal or branch system that generates invoices is a unit to onboard.
- Decide your approach: an ERP or POS vendor module, or a compliance layer next to your current system.
- Clean buyer data: VAT numbers and structured national addresses for B2B customers, because standard invoices are cleared only with complete data.
- Map your invoice types: standard, simplified, credit and debit notes, zero-rated and exempt lines, with exemption reason codes.
- Build and test in the sandbox: generate XML, sign, create QR codes and validate with the ZATCA SDK before calling the APIs.
- Onboard each EGS unit: obtain OTPs from the FATOORA portal, get compliance CSIDs, pass compliance checks, then request production CSIDs.
- Go live with monitoring: a dashboard for cleared, reported and rejected documents, and reminders for CSID renewal.
What if you have several branches or POS terminals?
Every unit that generates invoices is an e-invoice generation solution (EGS) unit in ZATCA’s terms, and each one is onboarded separately with its own CSID, invoice counter and hash chain. For a small retailer with three branches and two tills each, that can mean six onboardings, not one. Two designs are common:
- Per-device onboarding: each POS terminal signs its own invoices. This works offline but means more CSIDs to manage and renew.
- Central generation: terminals send sale data to a central service that generates, signs and reports invoices. Fewer CSIDs, but the terminals depend on the central service being reachable.
Decide this early, because it affects the number of OTPs you request from the FATOORA portal and how you handle network outages. Simplified invoices still have to be reported within 24 hours, so offline terminals need a queue that catches up as soon as the connection returns.
Do you need to change your invoice layout?
Usually, yes. Phase 2 invoices must carry the QR code generated from the signed invoice, and some information must appear in Arabic. If your current templates were built for Phase 1, check:
- that the QR code is the Phase 2 version (with hash, signature and public key data), not a Phase 1 QR;
- that seller details appear in Arabic where required;
- that credit and debit notes show the reference to the original invoice and the reason;
- that printed and PDF invoices match the XML you sent to ZATCA.
How long does a Wave 25 integration take?
For a single entity with clean data and a few invoice types, the build, sandbox testing and onboarding usually take weeks rather than months. The things that extend a project are predictable: many POS terminals or branches to onboard, missing buyer VAT numbers and addresses, and custom invoice layouts that need Arabic text and QR codes added. Start with the data, because it does not depend on the technical build.
What are the fines if we miss the deadline?
ZATCA applies e-invoicing violations and fines by type and repetition. Its published examples: not issuing e-invoices starts with a fine of SAR 5,000; deleting or amending e-invoices after issue starts at SAR 10,000; some violations, such as a missing QR code on a simplified invoice, start with a warning. ZATCA has not published a separate fixed fine for missing an integration date, so the practical risk is that invoices issued after your date without integration are treated as non-compliant.
How Co-Mate helps
Co-Mate builds the complete ZATCA Phase 2 layer: UBL 2.1 XML, cryptographic stamping, hashing, QR codes, CSID onboarding, and the FATOORA clearance and reporting APIs, around the ERP, Tally or POS you already run. We are an integration engineering company, not a ZATCA-approved provider. Start with the free e-invoicing readiness check or see our ZATCA Phase 2 integration service.