If your annual revenue exceeds SAR 750,000 and you operate a VAT-registered business in Saudi Arabia, you have until March 31, 2026 to connect your invoicing system directly to ZATCA's Fatoora portal. That is Wave 23.
Three months later, Wave 24 covers every VAT-registered business above SAR 375,000. After that, there are no more waves. Phase 2 is fully deployed across all VAT-registered businesses in the Kingdom.
This is not a paperwork update. Phase 2 changes how every B2B invoice you issue actually works. Your customer cannot receive it until ZATCA has validated and cryptographically stamped it first.
This guide covers exactly who is affected, what the technical requirements are, what non-compliance costs, and the government subsidy that most businesses in this revenue range have never heard of.
Who Needs to Comply with ZATCA Phase 2?
Every VAT-registered business in Saudi Arabia will eventually be required to comply. Phase 2 rolls out by revenue threshold, not by business type or sector.
Phase 1 (the generation phase) launched December 4, 2021, and applied immediately to all VAT-registered businesses. If you are VAT-registered, you were already required to generate e-invoices in the correct format: QR code embedded, PDF/A-3 with attached XML, stored locally.
Phase 2 is a different category of requirement. Generating and storing invoices locally is no longer enough. The mandate requires a live API connection between your invoicing software and ZATCA's Fatoora platform. For B2B invoices, that connection is real-time. For B2C, you have a 24-hour reporting window.
ZATCA issues official notifications to businesses before their wave deadline. Receiving that notice does not mean you have unlimited time. Integration work takes weeks, and testing and certification adds more time on top. Businesses that started in the final month of earlier waves consistently ran into problems.
Wave 23 and Wave 24: The Exact Deadlines
The following table shows the recent wave sequence so you can see where 23 and 24 sit in the full rollout.
| Wave | Annual Revenue Threshold | Deadline |
|---|---|---|
| Wave 17 | Above SAR 3,000,000 | May 2025 |
| Wave 18 | Above SAR 2,500,000 | June 2025 |
| Wave 19 | Above SAR 2,000,000 | July 2025 |
| Wave 20 | Above SAR 1,750,000 | August 2025 |
| Wave 21 | Above SAR 1,500,000 | September 2025 |
| Wave 22 | Above SAR 1,250,000 | November 2025 |
| Wave 23 | Above SAR 750,000 | March 31, 2026 |
| Wave 24 (Final) | Above SAR 375,000 | June 30, 2026 |
To find which wave applies to you: compare your 2022, 2023, or 2024 annual revenue to the thresholds above. If revenue exceeded SAR 750,000 in any of those three years, you fall under Wave 23. Revenue between SAR 375,000 and SAR 750,000 (highest in any of 2022–2024) puts you in Wave 24.
Wave 24 is the last wave. After June 30, 2026, there is no remaining group waiting for Phase 2 compliance.
What Changed Between Phase 1 and Phase 2?
The difference is not incremental. Phase 1 was about local compliance. Phase 2 is about real-time integration with a government platform.
| Aspect | Phase 1 | Phase 2 |
|---|---|---|
| Invoice storage | Local only | Real-time integration with ZATCA Fatoora |
| B2B invoices | Generate and store | Must be cleared by ZATCA before sending to customer |
| B2C invoices | Generate and store | Must be reported to ZATCA within 24 hours |
| Technical requirements | QR code + PDF/A-3 with embedded XML | API integration + cryptographic stamp + UUID chain + PIH |
| ZATCA interaction | None required at invoice time | Real-time for B2B; 24-hour window for B2C |
| Who is affected | All VAT-registered businesses | Rolling waves by revenue; Wave 24 covers everyone |
The key shift: under Phase 1, you generated and stored invoices on your own systems. Under Phase 2, a B2B invoice does not legally exist until ZATCA has seen it, validated it, and returned it with a cryptographic stamp. The sequence is mandatory: generate, submit to ZATCA, receive the cleared invoice, then send to your customer.
Businesses that assumed Phase 2 meant "just add an API call to our existing system" often underestimated the scope. It requires full format compliance with UBL 2.1 extended by ZATCA specifications, a Cryptographic Stamp ID (CSID) issued during onboarding, and proper UUID chain management across every invoice you issue.
How the Fatoora Integration Actually Works
Breaking down the technical flow into plain steps for a standard B2B invoice:
Step 1: Your system generates the invoice in UBL 2.1 XML format with ZATCA's required extensions and fields.
Step 2: Your system sends the XML to ZATCA's Fatoora API along with your CSID (Cryptographic Stamp Identifier), which you receive during the onboarding and certification process.
Step 3: ZATCA validates the invoice: format, tax calculations, required fields, and the cryptographic chain linking it to the previous invoice.
Step 4: ZATCA returns the cleared invoice with an embedded cryptographic stamp, a clearance timestamp, and the ZATCA UUID.
Step 5: You can now send the cleared invoice to your customer.
For B2C invoices, the flow is simpler: generate locally, embed the QR code, issue to your customer, then upload to ZATCA within 24 hours via the Reporting API.
The PIH Chain: Why One Failed Invoice Can Cascade Into Many
Every invoice you issue contains a PIH (Previous Invoice Hash), a cryptographic value that links it to the invoice that came before it. Your invoices form a continuous, unbreakable chain.
If an invoice fails validation mid-process, or if your system loses connectivity during submission and regenerates the invoice with a new UUID without properly handling the chain state, every subsequent invoice becomes invalid. The failure propagates forward automatically.
This is not a theoretical edge case. It caused real operational disruption for businesses in earlier waves that used invoicing systems without proper error handling for network interruptions.
What this means in practice: your integration needs clear retry logic for failed submissions, a local queue that manages connectivity interruptions without breaking the UUID chain, and immediate alerting when a chain break is detected. Discovering the problem hours later when dozens of invoices are already invalid is far more painful than building the error handling upfront.
Before going live, ZATCA requires you to pass their Sandbox testing environment and obtain a Conformance Certificate. Budget time for this step: depending on your current system's architecture, the full path from development start to live integration typically takes 4 to 12 weeks.
Penalties for Non-Compliance
ZATCA's penalty structure for Phase 2 violations escalates with each repeated offense.
| Violation | Penalty |
|---|---|
| First offense | Official warning |
| Second offense | SAR 1,000 |
| Third offense | SAR 5,000 |
| Fourth offense | SAR 10,000 |
| Fifth offense and beyond | SAR 40,000 |
| Failure to issue or archive invoices | SAR 5,000 to SAR 50,000 |
| Incorrect invoice amendments | SAR 10,000 to SAR 50,000 |
ZATCA Fines Exemption Initiative (through June 30, 2026): ZATCA announced on January 2, 2026 that it extended financial penalty waivers through June 2026. This is relevant if you miss the Wave 23 deadline on March 31 — the financial penalty is deferred, not enforced immediately.
The technical compliance requirement is not waived. B2B invoices still need to be cleared by ZATCA before you can legally send them to customers. An uncleared invoice is technically invalid regardless of the grace period. The consequence isn't the fine — it's that your customers can't receive your invoices.
The financial penalties are the most visible consequence. There are three additional consequences that tend to be more damaging over time:
Disallowed VAT deductions. B2B invoices that are not properly cleared through ZATCA may be rejected as valid input tax evidence. For businesses with significant procurement volumes, the disallowed VAT can far exceed the direct penalty amount.
Audit exposure. Non-compliance creates a risk flag on your tax file. Subsequent periods become more likely to face expanded scrutiny, which consumes management time and creates legal costs regardless of outcome.
Payment and procurement friction. Government procurement systems and some financial institutions cross-reference VAT compliance status when processing approvals and payments. Non-compliance creates delays that compound over time.
Who Is Exempt From ZATCA E-Invoicing?
Three categories fall outside Phase 2's scope:
Businesses below the VAT registration threshold
If your annual revenue is below SAR 375,000, you are not required to register for VAT under Saudi law. Without VAT registration, there is no Phase 2 obligation. If you voluntarily registered for VAT (even with revenue below that threshold), you are subject to the full mandate.
Foreign companies with no Saudi legal presence
A foreign company selling into Saudi Arabia without a registered legal entity, branch office, or resident agent in the Kingdom is not subject to ZATCA Phase 2. The moment a foreign company establishes a commercial registration in Saudi Arabia, it becomes subject to the full compliance requirement.
Government entities
Government bodies operate under separate financial frameworks. Phase 2 compliance for government entities follows different timelines established by the Ministry of Finance, not the standard wave schedule.
A common misunderstanding: some business owners assume they qualify for an exemption because their revenue is close to the lower threshold. If you are already VAT-registered, your revenue level does not create an exemption. Size does not matter once you are in the VAT system.
The ZATCA Subsidy Most Businesses in Wave 23 Don't Know About
ZATCA operates a financial support program for eligible SMEs. The revenue range it covers overlaps heavily with Wave 23's affected businesses.
ZATCA E-Invoicing Solution Subsidy Program
Eligible businesses receive 100% reimbursement on the cost of an approved e-invoicing solution:
- Revenue eligibility: SAR 2,000,000 to SAR 15,000,000 per year
- Subsidy amount: 100% cashback on the approved solution cost
- Requirement: The solution must appear on ZATCA's official list of approved providers
For businesses in this revenue band, a fully compliant Phase 2 integration can cost nothing after reimbursement, provided you choose an approved solution and follow the claims process.
To claim the subsidy:
- Confirm your annual revenue falls between SAR 2M and SAR 15M
- Choose a solution from ZATCA's published list of approved e-invoicing providers (available at zatca.gov.sa)
- Keep your purchase invoice and signed contract
- Submit the reimbursement application through the ZATCA portal
This subsidy is not widely advertised. Many business owners in exactly the right revenue range pay full price for their Phase 2 solution because they did not know to check eligibility first. Check before you buy.
What to Do Right Now
Step 1: Confirm which wave applies to you
Look at your 2022, 2023, or 2024 annual revenue — whichever year was highest. Revenue above SAR 750,000 in any of those years puts you in Wave 23 (March 31, 2026 deadline). Revenue between SAR 375,000 and SAR 750,000 puts you in Wave 24 (June 30, 2026 deadline).
Step 2: Assess your current invoicing system
Does your accounting or ERP software support ZATCA Phase 2 clearance and reporting APIs? If you do not know the answer, it probably does not. Contact your software provider and ask specifically about ZATCA Phase 2 API support, CSID onboarding, and Conformance Certificate compatibility.
Step 3: Account for the full implementation timeline
ZATCA Sandbox testing, Conformance Certificate issuance, development and integration work, and live testing with real invoices all take time. From a standing start, expect 4 to 8 weeks minimum for a system already built for API integration. Longer if your current accounting software needs significant modification or replacement.
For Wave 23, starting after the first week of February 2026 makes a comfortable March 31 deadline unlikely.
Step 4: Check subsidy eligibility before purchasing anything
If your revenue falls between SAR 2M and SAR 15M, verify that your chosen solution is on ZATCA's approved list before signing a contract. The reimbursement process is straightforward once the correct solution is selected.
For businesses that want the full automation picture, including what AI agents can handle across the Phase 2 compliance workflow from invoice generation and clearance through to archiving and error recovery, read our ZATCA Phase 2 automation guide.
If you want Awn AI's ZATCA agent to handle the integration: XML generation, clearance API calls, stamp processing, archiving, and chain integrity management. Visit getawn.ai to see how the full workflow runs.
The Short Version
Wave 23 deadline: March 31, 2026. Applies to VAT-registered businesses with annual revenue above SAR 750,000.
Wave 24 deadline: June 30, 2026. The final wave. Applies to all remaining VAT-registered businesses with revenue above SAR 375,000.
Phase 2 is not a paperwork update. It requires your invoicing system to talk directly to ZATCA in real time. B2B invoices must be cleared by ZATCA before your customers can receive them. The cryptographic invoice chain means integration quality matters. A broken integration creates cascading invoice failures, not isolated errors.
The businesses that ran into trouble in earlier waves had one thing in common: they started too late.
Don't wait until the deadline. Start automating your ZATCA compliance today with an intelligent agent that natively connects to your POS and accounting tools.
Last updated: February 2026. Deadline and penalty data sourced from official ZATCA publications at zatca.gov.sa.
