ZATCA Wave 24: Who Must Comply by June 30, 2026, and Exactly What You Need to Do



What is the new ZATCA Wave 24 announcement, and who must comply?

On September 26, 2025, Saudi Arabia's Zakat, Tax and Customs Authority (ZATCA) announced the selection criteria for Wave 24 under Phase 2 of the mandatory e-invoicing rollout. For the first time, the annual revenue threshold has dropped significantly to SAR 375,000.

If your business registered a taxable revenue exceeding this threshold in either 2022, 2023, or 2024, you are legally required to integrate your accounting workflows directly with ZATCA’s central Fatoora platform. The compliance window is already active, and businesses must be fully integrated before the hard enforcement deadline on June 30, 2026.

By the end, you will have the operational clarity to:

• Understand the new SAR 375,000 threshold and verify if your business is legally required to comply based on your 2022, 2023, or 2024 tax records.
• Navigate the critical shift to real-time clearance and understand why legacy workflows or flat PDF files are fully obsolete under Phase 2 rules.
• Audit your current ERP system architecture to ensure it dynamically handles mandatory metrics like UUIDs, previous invoice hashes, and cryptographic signatures.
• Meet the hard June 30, 2026, enforcement deadline without risking frozen receivables, commercial procurement exclusions, or administrative fines.
• How Wafeq simplifies technical complexity by handling data parsing, API handshakes, and automated validation gates natively in minutes.

Demystifying the ZATCA Phase 2 Wave 24 System

Saudi Arabia's phased rollout of mandatory e-invoicing under the Integration Phase requires businesses to connect their systems with the national Fatoora platform, with ZATCA setting revenue-based thresholds and staggered deadlines to ensure gradual compliance. Wave 24 is the most expansive wave to date, and understanding its architecture requires examining each of its core operational variables in isolation.

Revenue Threshold and Scope Expansion: Wave 24 lowers the revenue threshold significantly — for the first time, the mandate reaches businesses with taxable revenues exceeding SAR 375,000 in 2022, 2023, or 2024. This is not an annual figure evaluated in a single year — if your business crossed SAR 375,000 in taxable revenues in any one of those three calendar years, you are within scope regardless of your current revenue level.

Phase 2 vs. Phase 1 — A Structural Distinction: Phase 1 required businesses to generate invoices electronically and store them in a structured format. Phase 2 is architecturally different in a fundamental way: invoices must be submitted to and cleared by ZATCA's Fatoora platform in real time before they can be legally delivered to the buyer. This is not an upgrade to Phase 1 — it is a different compliance paradigm that requires a completely different technical infrastructure.

The Fatoora Platform as the Legal Gateway: Under Phase 2, the Fatoora platform is not a reporting destination. It is the legal gateway through which invoices acquire their valid status. A B2B invoice that has not been cleared by Fatoora does not legally exist as a tax invoice, regardless of what your internal ERP records show. This means any system failure, API misconfiguration, or schema error between your ERP and Fatoora directly translates into a legally uncollectable receivable.

Notification Timing and the Waiting Risk: ZATCA provides at least six months' notice before integration deadlines. However, receiving a notification letter is not the start of the compliance process — it is a confirmation that the deadline is active. Businesses that wait until May or June 2026 risk missing the window entirely, as certification and onboarding processes with ZATCA can take weeks, and many certified solution providers are operating at capacity as the deadline approaches.

The Penalty Waiver Misconception: ZATCA extended its "Initiative to Cancel Fines and Exempt Taxpayers from Penalties" until June 30, 2026. This grace period gives eligible businesses time to correct past non-compliance without financial penalty — but ZATCA has been very clear: the penalty waiver is not permission to delay your compliance project. It is a window to fix past mistakes, not an excuse to postpone action.

The Operational Danger of Delayed Integration

The compliance window for Wave 24 runs from April 1 to June 30 — a 91-day window that sounds generous until the implementation steps are mapped against it. ZATCA's onboarding process for the Cryptographic Stamp Identifier (CSID) — the device-level certificate that signs every invoice — requires application submission, GTA processing time, and technical testing. That process alone can consume two to four weeks. Add ERP configuration, schema testing, UAT cycles, and pilot run validation, and the realistic implementation timeline for an unprepared business is 10 to 14 weeks minimum.

Businesses starting their compliance process in May 2026 are not running behind schedule — they are mathematically outside the window for a clean first-attempt implementation before June 30. The only realistic outcome at that stage is an emergency implementation under time pressure, with elevated risk of schema errors, API misconfiguration, and incomplete testing that leads to rejected invoices in production from day one.

Cross-Dependencies That Break Legacy Architectures

The tax point rule under ZATCA's framework means that the invoice clearance clock starts at the earlier of: delivery of goods or completion of services, invoice issuance, or payment receipt. Businesses running month-end batch billing cycles cannot simply add an API call to their existing workflow — the billing trigger logic in the ERP must be restructured to fire at the transaction event, not the accounting period close. This is an architectural modification to the ERP's AR module, not a configuration change.

Technical Architecture and System Integration Criteria

Why Manual and PDF-Based Workflows Are Fully Obsolete

• A PDF invoice is a presentation-layer document — it cannot be interrogated by ZATCA's validation engine as structured data.
• A digitally signed PDF does not pass through the Fatoora clearance API, does not receive a cryptographic stamp, and has no legal invoice status under Phase 2.
• Manual invoice entry into a portal is not scalable and does not satisfy the real-time clearance requirement for high-volume B2B transaction environments.
• Phase 1-only EGS solutions that generate structured XML but lack the API connectivity and cryptographic stamping capability required for Phase 2 clearance are equally non-compliant.

The Standard Phase 2 Compliance Loop

1. Step 1 — ERP Transaction Trigger: Sales order confirmed or service delivery completed; invoice generation fires at the tax point event, not at the month-end batch.
2. Step 2 — Structured XML Generation: The EGS (E-Invoice Generation Solution) produces a UBL 2.1-compatible XML document, populating all mandatory fields from master data and transaction records dynamically — no manual data entry at this stage.
3. Step 3 — Cryptographic Signing: The XML document is signed using the business's device-bound CSID certificate issued during ZATCA's onboarding process. The signature is embedded in the document's UBL extension block.
4. Step 4 — Fatoora Clearance API Submission (B2B): The signed XML is submitted to ZATCA's Fatoora clearance API via authenticated REST call. ZATCA validates schema structure, mandatory field completeness, mathematical consistency, and cryptographic signature integrity.
5. Step 5 — ZATCA Clearance Stamp Return: ZATCA returns the cleared document with a cryptographic clearance stamp embedded. Only at this point does the invoice acquire legal status. The stamped document is delivered to the buyer.
6. Step 6 — B2C Simplified Invoice Reporting: B2C simplified invoice reporting must occur within 24 hours of the transaction. The EGS signs the simplified invoice locally, generates the mandatory 6-field TLV QR code, and reports the document to Fatoora within the 24-hour window. Insights KSA.

Core Mandatory Data Fields Every EGS Must Generate Dynamically

• Supplier VAT Registration Number (TRN) — validated against ZATCA's registry at onboarding.
• Buyer TRN — must be a verified, current field in the ERP customer master data for all B2B transactions.
• UUID (128-bit, RFC 4122 standard) — generated at document creation, immutable through the invoice lifecycle.
• Previous Invoice Hash (PIH) — SHA-256 hash of the immediately preceding document in the EGS's sequential chain, stored persistently and retrieved at each new invoice generation.
• Invoice timestamp in ISO 8601 format — synchronized to a validated time source, not an application server clock.
• Line-item tax matrix — taxable amount, tax category code, and tax amount per line, with document-level aggregation using deferred rounding at the subtotal level.
• InvoiceTypeCode — differentiating standard tax invoices (383000/388000), simplified invoices (381100), credit notes (381000), and debit notes.
• QR code for simplified invoices — Base64 TLV-encoded six mandatory fields: seller name, seller VAT number, timestamp, total with VAT, VAT total, and XML hash.

Learn more about: Zatca Phase 2 Integration: 5 Steps to Avoid Onboarding Errors.

Streamlining the Transition: How Wafeq Insulates Your Operations

Wafeq is engineered from its infrastructure layer for Saudi Arabia's Phase 2 compliance landscape — every element of the Fatoora integration loop is a native capability, not an add-on module retrofitted to a generic accounting platform.

Real-Time Data Parsing: When a transaction is recorded in Wafeq, the system generates a compliant UBL 2.1 XML document at the point of transaction commitment — not as part of a scheduled batch export. Supplier TRN, buyer TRN, UUID, PIH, and all line-item tax fields are populated programmatically from verified master data. The document is structurally valid before it enters the Fatoora submission pipeline, eliminating the rejection loops that delay receivables collection.

Enterprise-Grade Connections: Wafeq exposes high-availability REST API endpoints purpose-built for integration with SAP EDI output conditions, Oracle AutoInvoice interfaces, Oracle Fusion RESTful web services, and custom ERP outbound messaging frameworks. The clearance loop operates synchronously — Wafeq returns ZATCA's clearance stamp to the ERP before invoice posting is completed — with asynchronous fallback handling for network interruption scenarios that guarantees zero invoice loss on timeout.

Error Minimization and Guardrails: Wafeq enforces straight-through processing (STP) across the entire invoice compliance pipeline. Pre-submission validation checks schema conformity, mathematical consistency, and field completeness before the document reaches Fatoora — turning ZATCA's validation engine from a rejection gate into a confirmation step. The PIH chain is maintained automatically, eliminating the most common cause of cryptographic chain failures: manual resets after system errors or database restores.

CSID Onboarding Support: Wafeq's implementation team guides businesses through ZATCA's full CSID onboarding process — from the compliance API handshake through production certificate issuance — reducing the onboarding timeline and eliminating the most common technical failure point for businesses attempting self-managed Phase 2 integration.

Audit-Grade Archiving: Every invoice processed through Wafeq is archived in its original XML format with a complete timestamped audit log covering document generation, cryptographic signing, Fatoora submission, ZATCA response, and clearance stamp receipt. ZATCA audit requests are responded to with clean, structured, chronologically ordered export sets — not reconstructions from disconnected sources.

Risk Evaluation: Rejection Modes and Operational Pitfalls

Legal Invoice Non-Existence on Clearance Failure

Under Phase 2's clearance model, a B2B invoice that fails Fatoora validation is not a delayed invoice — it is a legally non-existent invoice. The corresponding receivable cannot be collected, the buyer cannot claim input VAT, and the transaction has no legal tax documentation until a corrected document completes the clearance loop. In high-volume B2B environments, a systemic clearance failure — caused by a PIH mismatch, schema error, or API misconfiguration — can render an entire day's invoicing legally void.

Input VAT Denial for Buyers

Any B2B buyer who accepts a document from a supplier that has not cleared the Fatoora platform takes on a direct tax risk: that purchase has no valid supporting documentation for an input VAT claim. As awareness of Phase 2 requirements increases across Saudi Arabia's commercial supply chain, buyers are increasingly requiring proof of Phase 2 compliance from suppliers as a condition of contract and payment. Non-compliant suppliers are being excluded from procurement processes at the pre-qualification stage — before any commercial discussion takes place.

Penalty Exposure After June 30, 2026

Once the penalty waiver window closes on June 30, 2026, ZATCA's standard penalty framework activates in full. Penalties under the E-Invoicing Regulations include fines for failure to issue compliant invoices, failure to integrate with Fatoora within the mandated window, and failure to maintain invoices in the prescribed format for the required retention period. Consistent compliance failures also trigger automatic high-risk classification in ZATCA's audit selection algorithms — escalating audit frequency and scrutiny intensity for multiple fiscal years beyond the original violation.

Capacity Constraints at Certified Providers

Many certified solution providers are operating at capacity as the deadline approaches. Businesses attempting to engage ZATCA-certified implementation partners in May or June 2026 will face extended lead times, premium pricing for expedited delivery, and reduced implementation quality due to compressed testing cycles. The market for Phase 2 implementation support is not elastic — it cannot absorb a last-minute surge in demand without material degradation in service quality and timeline reliability.

Read Also: How to handle credit notes in KSA e-invoicing?

Wave 24 is the broadest expansion of Saudi Arabia's e-invoicing mandate to date, and its June 30, 2026, deadline is already inside the implementation window. The businesses that are integrating now are protecting their receivables, preserving their VAT input claims, and securing their position in procurement supply chains that increasingly screen for Phase 2 compliance at the pre-qualification stage. The businesses waiting for a formal notification letter or a deadline extension signal are accumulating implementation risk that compounds daily.

Early Phase 2 compliance is not a cost — it is a cash flow protection instrument, a procurement eligibility prerequisite, and a market access requirement that cannot be deferred.

Wave 24's deadline is June 30, 2026 — and the implementation clock is running. Don't wait for a final warning or an operational bottleneck to force your hand. Talk to a Wafeq expert today to audit your current system readiness and secure a seamless, certified transition before the compliance window closes.

FAQs about Who Must Comply by June 30, 2026

Does Wave 24 apply to my business if I only exceeded SAR 375,000 in revenue in one of the three qualifying years?

Yes, exceeding SAR 375,000 in taxable VAT revenues in any single calendar year — 2022, 2023, or 2024 — is sufficient to place your business within the Wave 24 scope.

Is the ZATCA penalty waiver extension until June 30, 2026, a signal that the Phase 2 deadline will also be extended?

No, the penalty waiver covers past filing and payment non-compliance only and has no bearing on the Wave 24 Phase 2 integration deadline, which remains hard-enforced on June 30, 2026.

Can a Phase 1-compliant EGS solution that generates XML invoices be used as-is for Wave 24 Phase 2 compliance?

No, Phase 1 solutions that lack real-time Fatoora clearance API connectivity, CSID cryptographic stamping capability, and PIH chain management are non-compliant with Phase 2 requirements, regardless of their XML generation capability.

What is the single most urgent action a Wave 24 business should take today?

Immediately audit whether your current EGS solution is ZATCA Phase 2-certified, and if not, initiate the selection and CSID onboarding process with a certified provider before available implementation capacity is exhausted.