ZATCA Wave 25: who must connect to Fatoora by 1 February 2027

ZATCA announced Wave 25 on 24 July 2026. It is the widest wave so far. Waves 22 to 24 moved the threshold from SAR 1 million down to SAR 375,000. Wave 25 halves it again, to the same figure as the voluntary VAT registration threshold. For many small shops, clinics, service firms and online sellers, this is the first time ZATCA asks them to connect, not just to print a QR code.

If you are reading this in November or December 2026, you have roughly ten weeks. That is enough time, as long as you start now.

Who is in ZATCA Wave 25?

ZATCA's announcement sets one test: your revenue subject to VAT exceeded SAR 187,500 in any one of the years 2022, 2023, 2024 or 2025. One year above the line is enough. If an earlier wave already selected you, your earlier date applies.

• The figure. SAR 187,500 is the same figure as the voluntary VAT registration threshold in ZATCA's SME guidelines. The two tests are not identical (the wave looks at VAT-subject revenue in a calendar year), so check your own figures rather than assuming.
• The notice. ZATCA says it will notify every taxpayer targeted in Wave 25, and it informs each wave at least six months before its integration date. Do not wait for the letter to start: the deadline is already public.
• Software vendors and app builders. If your product issues invoices for Saudi customers in this revenue band, each of them needs a Phase 2 connection by the same date. Many will ask you for it first.

How Wave 25 fits the Phase 2 rollout

Phase 1 (the generation phase) has applied since 4 December 2021: invoices issued electronically, with a QR code on simplified invoices. Phase 2, the integration phase, connects your invoicing to Fatoora and has been rolled out in waves, each with a lower threshold.

Wave 25 is also the first wave to count 2025 revenue. A business that crossed SAR 187,500 for the first time in 2025 is included.

What Fatoora integration actually means

A Phase 1 invoice with a QR code is not enough for Phase 2. Your system, or the service it connects through, has to talk to Fatoora for every invoice:

• Onboard each invoicing unit. In the Fatoora portal (you sign in with your ERAD credentials) you generate an OTP for each e-invoicing unit: a POS, a branch system, an ERP, an app. The OTP is valid for one hour and is entered on that unit.
• Get the production certificate (CSID). Each unit receives its own certificate and uses it to sign invoices. Certificates must be renewed when they expire.
• Send every invoice in ZATCA's format. Tax invoices (business to business) follow the clearance model: ZATCA validates and stamps them before you share them with your buyer. Simplified invoices (business to consumer) follow the reporting model: you issue them at once and report them to ZATCA within 24 hours.
• Deal with rejections. ZATCA returns error and warning codes. Someone has to read them, fix the cause in the source system and resubmit.

This is why "our system already prints a QR code" is the most common false sense of safety we see. For a closer look at the technical side, read our guide on keeping your business ready for ZATCA e-invoicing.

An eight-week plan to meet the e-invoicing Phase 2 deadline

Work backwards from 1 February 2027 and aim to be live by mid-January. That leaves room for a public holiday, a slow supplier or a stubborn rejection code.

1. Week 1: confirm and list. Check your VAT-subject revenue for 2022 to 2025. List every place that issues an invoice: the POS at each branch, the accounting system, the online store, the app, the spreadsheet someone still uses for one customer.
2. Weeks 1 to 2: choose your route. Ask your current software vendor whether it is Phase 2 ready and by when. If it is not, decide between switching to a Phase 2-ready ERP or connecting your current system through an integration provider. Our checklist for choosing an e-invoicing provider in Saudi Arabia covers the questions to ask.
3. Weeks 2 to 4: prepare access and data. Make sure the right person can sign in to the Fatoora portal with your ERAD credentials. Have your VAT number, Commercial Registration number, legal name and national address ready, and clean up customer VAT numbers for your business customers.
4. Weeks 3 to 6: connect and test. Connect each invoicing unit and run test invoices, including credit notes and a simplified invoice, until they pass ZATCA's checks without errors.
5. Weeks 6 to 8: onboard for production and go live. Generate the OTPs and switch each unit to production (an OTP lasts one hour, so do it with the unit in front of you). Then watch rejections daily for the first two weeks.

ZATCA e-invoicing penalties and record-keeping

ZATCA's published penalty guide (January 2022) covers e-invoice violations such as not issuing or not saving invoices electronically, leaving out the QR code, deleting or changing an invoice after it is issued, and not telling ZATCA about a malfunction that stops you issuing invoices. The guide starts with a notice, then fines of SAR 1,000, 5,000, 10,000 and 40,000 for repeated violations. A repeat more than 12 months later starts again with a notice.

Records must be kept for at least six years from the end of the tax period they relate to, under the VAT Implementing Regulations. In practice that means your e-invoices, in the format ZATCA requires, need a home that will still be there in 2033.

Common mistakes that delay Wave 25 businesses

• Waiting for ZATCA's notice before starting. The criteria and the date are already published.
• Treating the Phase 1 QR code as enough. Phase 2 means a live connection to Fatoora for every invoice.
• Forgetting a second invoicing system. A branch POS, an online store or an app that issues invoices needs its own onboarding.
• Leaving onboarding to the last week. Each unit needs its own OTP and certificate, and test rejections take time to fix.
• No owner for rejections. Simplified invoices must reach ZATCA within 24 hours, so someone has to check the queue every day.

How HAL VAT CARE gets you live before the deadline

You do not have to replace your system to comply. HAL VAT CARE connects any ERP, POS, billing system or app to Fatoora through one API, or through an Excel upload if your system cannot call an API. It signs, clears and reports every invoice, handles your certificates, and shows every rejection with the reason in Arabic and English. Most businesses are live in about two weeks. HAL is listed by ZATCA as a Phase 2 provider (as "HAL ERP"), and VAT CARE is hosted in Saudi Arabia.

When SISI, a UK student-information system that invoices for a school in Jeddah, struggled to integrate with another provider's API, it moved to VAT CARE and went live in under a week.

If you are weighing providers, see how the options compare in e-invoicing providers in Saudi Arabia compared.

Frequently asked questions

What is ZATCA Wave 25?

Wave 25 is the latest group of taxpayers ZATCA has selected for Phase 2 (integration) of e-invoicing. It covers every taxpayer whose revenue subject to VAT exceeded SAR 187,500 in 2022, 2023, 2024 or 2025, unless an earlier wave already selected them.

What is the deadline for ZATCA Wave 25?

Wave 25 taxpayers must connect their e-invoicing solution to ZATCA's Fatoora platform by 1 February 2027. ZATCA announced the wave on 24 July 2026 and notifies each targeted taxpayer.

My revenue was above SAR 187,500 in only one year. Am I in Wave 25?

Yes. ZATCA's criterion is revenue subject to VAT above SAR 187,500 during 2022, 2023, 2024 or 2025, so one year above the threshold is enough.

Is a Phase 1 invoice with a QR code enough for Wave 25?

No. Phase 2 requires your system to connect to Fatoora: tax invoices are cleared by ZATCA before you share them, and simplified invoices are reported within 24 hours. Each invoicing unit is onboarded with its own OTP and certificate.

What happens if we miss the Wave 25 deadline?

ZATCA's penalty guide (January 2022) treats e-invoicing violations with a notice first, then fines of SAR 1,000, 5,000, 10,000 and 40,000 for repeats. Missing the date also means invoicing outside the rules until you are connected.

Can we keep our current POS or ERP for Wave 25?

Yes. An integration layer such as HAL VAT CARE connects your existing system to Fatoora by API or Excel upload, so you keep the software your team already uses. Most businesses are live in about two weeks.