Wave 25 is where Saudi e-invoicing stops being a large-company matter.

SAR 187,500 is the same figure ZATCA publishes as its optional VAT registration threshold, so the wave reaches close to every business that is registered for VAT at all.

If your VAT-subject revenue crossed that line in any of 2022, 2023, 2024 or 2025, you are in it, and your invoicing system has to be talking to Fatoora before 1 February 2027.

We build and integrate ERP systems from Pune, and we already deliver in the Kingdom for Triolift (Saudi Arabia).

What follows is the regulation as ZATCA publishes it, then the part nobody sends you a circular about: the work inside your own systems.

The Two Phases, and Which One You Are In

Phase 1 has applied since 4 December 2021.

Phase 2 started on 1 January 2023 and is being rolled out wave by wave.

Both are live at the same time. Phase 1 never switched off. Phase 2 adds a connection to ZATCA on top of it.

Phase 1 — Generation Phase

In force from: 4 December 2021
Core requirement: Generate and store invoices through a compliant electronic solution
Handwritten or word processor invoices: Not allowed
Connection to ZATCA: None required
Invoice content: QR code and required fields
Applies to: Taxpayers subject to the E-Invoicing Regulation

Phase 2 — Integration Phase

In force from: 1 January 2023, by wave
Core requirement: Integrate the electronic invoicing solution with ZATCA's Fatoora platform
Handwritten or word processor invoices: Not allowed
Connection to ZATCA: Required
Invoice content: Additional fields and a specified format
Applies to: Taxpayers as ZATCA calls them up in waves

If someone told you in 2022 that you were ZATCA compliant, that almost certainly meant Phase 1.

It says nothing about Phase 2.

How ZATCA Decides Who Is in a Wave

ZATCA selects each wave by revenue subject to VAT above a stated SAR figure in named prior calendar years, then notifies the selected taxpayers directly.

The authority has stated it will inform each following wave directly at least six months before its integration date.

Each wave carries its own published threshold, and Wave 25 sits below the level at which VAT registration is compulsory.

There are two practical consequences.

First: You do not opt in or apply. You get told.

Second: The qualifying years are historical, so a business that has since shrunk can still be in the wave on the strength of one good year in 2022.

Where Things Stand: Wave 25

Here are the Wave 25 criteria as published by ZATCA:

Revenue threshold, subject to VAT: Above SAR 187,500

Qualifying years: 2022, 2023, 2024 or 2025

Integration deadline: No later than 1 February 2027

How you are told: ZATCA notifies selected taxpayers directly, at least six months before the integration date.

For scale, ZATCA sets mandatory VAT registration at annual revenue above SAR 375,000, and makes registration optional for revenue above SAR 187,500 and below SAR 375,000.

Wave 25 is pitched exactly at that optional registration figure, so it reaches a long way below the line at which VAT registration is compulsory at all.

As at the date of this article, ZATCA has published criteria up to Wave 25 and nothing beyond it, and its media centre carries no Wave 26 announcement.

Plan against 1 February 2027 and treat any later wave as a separate exercise when it is announced.

What the ZATCA Resolution Actually Requires of Your System

Most of what circulates about Phase 2 is second hand.

The binding text is ZATCA's resolution on controls, requirements, technical specifications and procedural rules, last updated 19 May 2023.

Read against that document, Phase 2 asks for the following.

Format

Invoices and their notes must be generated in XML, or in PDF/A-3 with the XML embedded.

Since 1 January 2023, the XML is the mandated form for generation and transmission, with PDF/A-3 kept as the optional human-readable copy for the customer.

Identity and Stamping

Every invoice carries a UUID, which Annex 1 describes as a 128-bit number generated so that no one else is likely to produce the same one.

Clause Second, section 3 defines the cryptographic stamp as an electronic stamp created via cryptographic algorithms to establish authenticity of origin and integrity of content.

QR Codes

Simplified tax invoices have carried a QR code since 4 December 2021 containing:

Seller name
VAT registration number
Timestamp
Invoice total including VAT
VAT total

From 1 January 2023, that QR code also carries a hash of the XML invoice and an ECDSA signature over that hash.

Anti-Tampering

The solution must hash each invoice and embed that hash in the next one, protecting the sequence against deletion or replacement.

It must hold a tamper-resistant counter that cannot be reset or reformatted and must reveal any tampering attempt.

Annex 1 bans altering or deleting issued invoices, editing or deleting logs, resetting the counter, and changing the issue timestamp.

Clearance or Reporting — They Are Not the Same Thing

Standard tax invoices go to ZATCA for clearance.

The authority checks them against the resolution and applies its cryptographic stamp only to those that pass.

Simplified tax invoices are generated with the stamp already on them and reported to ZATCA within a period that must not exceed 24 hours from generation.

That distinction decides your architecture.

Clearance sits in front of the customer receiving the document. Reporting sits behind it.

Sell both B2B and retail and you are building both paths.

What This Means for the ERP

Integration is not a plugin you switch on.

There are five pieces of work, roughly in this order.

1. Invoice Data Completeness

ZATCA's XML implementation standard expects fields that many ERPs never captured because nobody downstream ever needed them.

That can include:

Buyer VAT number
Address components
Line-level tax categories
Exemption reasons

Find the gaps before anyone writes code.

2. Master Data Cleanup

Duplicate customers.

Blank tax registration numbers.

Three spellings of the same address.

This is dull work, it takes longer than the integration itself, and it is the most common reason a Phase 2 project slips.

No piece of ZATCA e-invoicing software removes it.

3. The Integration Layer

The integration layer needs to handle:

Building the XML
Applying the stamp
Calling ZATCA
Handling the response
Storing what comes back

4. Testing Against ZATCA

Onboarding an invoicing unit on the Fatoora portal means generating one-hour OTP codes, entering them in your solution, receiving a cryptographic stamp identifier, and passing ZATCA's compliance checks for reporting and clearance.

Those identifiers are renewed too, so put renewal in the operations runbook now.

5. A Fallback for When the Connection Fails

ZATCA endpoints go down and so does your internet.

Decide today what your counter staff do at 11am on a Thursday when clearance does not come back, and who reconciles afterwards.

Vendors rarely raise this. Auditors do.

We do this work as part of ERP and CRM builds. For the shape of a scope, start with our ERP and CRM services page.

Extend What You Run, or Replace It

Most businesses in Wave 25 do not need a new ERP.

They need an integration layer over the ERP they already run.

A replacement is worth considering only when the underlying system genuinely cannot produce the data:

No line-level tax detail
No way to add fields
No supported API
A vendor who stopped shipping updates years ago

That situation is real and we have met it.

It is not the common one.

The common one is a working ERP with an incomplete data model and no outbound integration.

That is an extension project: a service reads invoice data, builds compliant XML, talks to ZATCA and writes the result back.

Cheaper and far less disruptive than a migration you never planned.

Working Backwards from 1 February 2027

Here is a practical timeline.

By the End of September 2026

Confirm whether you are in Wave 25.

Check for the ZATCA notification.

Name one internal owner.

By the End of October 2026

Complete the invoice data and master data audit.

List the gaps.

Make the build-or-extend decision.

By the End of November 2026

Build the integration layer against the current XML implementation standard.

By the End of December 2026

Complete Fatoora onboarding.

Pass compliance checks.

Write the fallback process.

By the End of January 2027

Run a live pilot on real invoices.

Train staff.

Rehearse the fallback process at least once.

1 February 2027

Integration deadline.

Starting in Q4 2026 is already tight, because the October audit is the step everyone underestimates.

Note also that ZATCA's fines and penalties exemption initiative runs only to 31 December 2026, excludes tax evasion penalties and fines under Article 45 of the VAT Law, and expires before this deadline.

It is no safety net here.

What to Ask a Vendor Selling ZATCA E-Invoicing Software

Plenty of firms now sell ZATCA e-invoicing software.

Six questions separate the ones who have shipped from the ones who have read a blog.

1. Show me an invoicing unit you onboarded on the Fatoora portal and the compliance checks it passed.

2. Do you handle both clearance for tax invoices and 24-hour reporting for simplified invoices, or only one of them?

3. Which version of the XML implementation standard did you build against, and how will you handle the next one?

4. What happens to a sale when ZATCA does not respond? Walk me through the fallback.

5. Who does the master data cleanup, you or us, and is it inside your quote?

6. After go-live, who renews the cryptographic stamp identifiers?

If a vendor answers question 4 by telling you it will not happen, you have your answer.

Accucia's View

Our position costs us money, so we will put it plainly.

If you are in Wave 25 and your ERP works, do not let anyone sell you a replacement to solve a compliance deadline.

Buy the integration layer.

That is a smaller invoice for us than a migration, and it is the right answer for most of the businesses that call us about this.

Second, if you already run a product from ZATCA's published list of solution providers and it genuinely handles clearance, reporting and your fallback, keep it.

We will say so and walk away from the work.

What we will not do is certify anyone else's software as compliant.

On us, without the padding.

Accucia was founded in 2018, which is eight years, with 730+ projects, 500+ clients worldwide and 25+ industry verticals.

We deliver in Saudi Arabia for Triolift, out of Pune.

We do not have a Gulf office, address or trade licence and we will not pretend otherwise.

On assurance: we do not hold ISO 27001. Implementation is underway with an auditor appointed and certification targeted for Q1 2027, January to March, and ISO 9001 is in progress.

We are not CERT-In empanelled.

Where an empanelled audit is required, the client commissions the auditor, and we build to the auditor's requirements and implement every finding.

To scope this against your actual ERP, our Saudi Arabia ERP page covers how we work in the Kingdom, our Gulf hub covers the wider region, and you can talk to us about a scoping session.

Frequently Asked Questions

What Is ZATCA Phase 2?

Phase 2, the Integration Phase, requires your electronic invoicing solution to connect directly to ZATCA's Fatoora platform rather than simply generating and storing invoices.

It began on 1 January 2023 and is being applied wave by wave.

Phase 1, in force since 4 December 2021, continues to apply alongside it.

Who Is Included in Wave 25?

Any taxpayer whose revenue subject to VAT exceeded SAR 187,500 during 2022, 2023, 2024 or 2025.

Only one of those years needs to qualify.

ZATCA notifies selected taxpayers directly, so check for a notification, but do not wait for one before starting your assessment.

What Is the Wave 25 Deadline?

ZATCA has set integration with the Fatoora platform for Wave 25 taxpayers at no later than 1 February 2027.

That is the date your solution must be connected and working, not the date you start the project.

Treat late December 2026 as your internal target instead.

How Do We Actually Connect Our System to Fatoora?

Onboarding happens on ZATCA's Fatoora portal.

You generate an OTP for each invoicing unit, valid for one hour, enter it in your solution, and receive a cryptographic stamp identifier.

Your solution then has to pass ZATCA's compliance checks for both reporting and clearance before it goes live.

Will ZATCA Tell Me If I Am in a Wave?

ZATCA notifies targeted taxpayers directly and has stated it gives at least six months' notice before a wave's integration date.

Do not treat silence as exemption.

Check your registered contact details on the ZATCA portal, and compare your own VAT-subject revenue against the published threshold yourself.

Is There a Wave 26?

As at the date of this article, ZATCA has published criteria up to Wave 25 and nothing beyond it, and its media centre carries no Wave 26 announcement.

No later dates or figures exist yet.

Plan against 1 February 2027 and check ZATCA's media centre before assuming anything further.

What Invoice Format Does ZATCA Require?

ZATCA's implementation resolution requires electronic invoices and their associated notes to be generated in XML, or in PDF/A-3 with the XML embedded.

Since 1 January 2023, the XML is the mandated form for generation and transmission, with PDF/A-3 kept as an optional human-readable copy for the customer.

What Is the Difference Between Clearance and Reporting?

Standard tax invoices are sent to ZATCA for clearance, where the authority checks them against the resolution and applies its cryptographic stamp only to invoices that pass.

Simplified tax invoices are generated with the stamp already applied and reported to ZATCA within a period not exceeding 24 hours from generation.

Do I Need a New ERP to Comply?

Usually not.

Most businesses need an integration layer over the ERP they already run, plus work on invoice data completeness and master data.

Replacement is worth considering only when the system cannot produce line-level tax data, cannot take new fields, or has no supported way to integrate.

How Long Does a Phase 2 Integration Take?

It depends far more on your data than your code.

The integration layer itself is usually the shorter part.

Master data cleanup, field gap analysis, Fatoora onboarding, compliance checks and a live pilot are what set the calendar.

Working backwards from 1 February 2027, four clear months is a sensible minimum.

Does the ZATCA Fines Exemption Initiative Cover a Missed Deadline?

The initiative covers late registration, late payment, late filing and VAT return correction fines, and the Minister of Finance extended it to 31 December 2026.

ZATCA excludes tax evasion penalties and fines under Article 45 of the VAT Law.

It also ends before the Wave 25 deadline.

Can Our Invoice Data Stay Inside Saudi Arabia?

Yes.

We deploy in-region on request, on AWS, Azure or Google Cloud Platform with the region chosen to meet your requirement, with infrastructure billed to you at cost.

We can also deploy to your own on-premise servers.

Decide this before build starts, because it shapes the architecture.