Retail & commerce · Saudi Arabia · Tax compliance

ZATCA Wave 24 — the SAR 375k Fatoora threshold Saudi SMEs can't dodge.

For the bakkala owner in Riyadh whose annual turnover sits just above the VAT-registration line, the women's-tailoring atelier in Jeddah whose books are still kept in a desktop spreadsheet, the small electronics retailer in Dammam whose invoicing software was last updated before Phase 2 existed — Wave 24 is the announcement that the SAR 375,000 threshold (the VAT-registration line itself) becomes the Phase 2 Fatoora line on 30 June 2026. Wave 23, at SAR 750,000, closes 31 March 2026. Phase 2 is not "send a PDF": it is direct API integration with ZATCA's Fatoora portal, real-time clearance for B2B, 24-hour reporting for B2C, UBL 2.1 XML, UUIDs, digital signatures and QR codes — against a penalty stack that runs SAR 5,000–50,000 per real-time-reporting violation and an additional SAR 10,000 per invoice for a missing QR code, with repeat-breach multipliers within 12 months.

01The pain

The EY tax-alert — published by a Big-Four advisory whose Saudi practice fields the same Phase 2 questions every quarter — records the institutional shape of the pain in plain regulatory language. ZATCA announced Wave 23 of the Phase 2 e-invoicing integration on 26 September 2025: every VAT-registered Saudi business whose taxable turnover exceeded SAR 750,000 in any of the three calendar years 2022, 2023 or 2024 must integrate its e-invoicing system with the Fatoora platform by 31 March 2026. The same announcement laid out Wave 24 — the threshold drop to SAR 375,000, with a 30 June 2026 integration deadline — pulling firms whose turnover sits at the VAT-registration line itself into the Phase 2 regime for the first time. Saudi operators report and trade press records that Phase 2 is structurally heavier than the Phase 1 "generation" stage: every B2B invoice must be cleared by ZATCA in real time before it is legally valid, every B2C invoice must be reported within 24 hours, the XML must conform to UBL 2.1, each invoice carries a UUID and a digital signature, and a QR code embedding the cryptographic stamp must travel with the document.¹

The ClearTax briefing — published by an e-invoicing software vendor whose entire Saudi operator audience is VAT-registered firms working through the Phase 2 onboarding — captures the lived shape of the SME pain. Trade press records that for the long tail of operators pulled in by Wave 24, the integration is not a configuration step but an engineering project: most SMEs have no in-house IT team capable of standing up an API integration with the Fatoora portal, no developer who has worked with UBL 2.1 XML, and no operations process for renewing the cryptographic certificates ZATCA issues per device. Legacy accounting software either needs a Phase-2 middleware layer bolted on or a full replacement, both of which carry a cost SME operators publicly say is hard to justify against thin margins. The same coverage records the recurring schema-churn pain: the Fatoora technical specification has gone through repeated revisions through 2025, and a vendor whose integration was certified against an earlier release can find itself out of compliance after the next ZATCA technical update — leaving the operator stuck between a software vendor's upgrade path and a 30 June 2026 deadline that does not move.²

A regime operators describe by the day-to-day shape of its mechanics: SAR 750,000 → 31 March 2026 (Wave 23); SAR 375,000 → 30 June 2026 (Wave 24, announced 26 Sept 2025); real-time B2B clearance + 24-hour B2C reporting through Fatoora API; UBL 2.1 XML + UUID + digital signature + QR code per invoice; SAR 5,000–50,000 per real-time-reporting violation; SAR 10,000 per invoice for a missing QR; repeat-breach multipliers within 12 months; Initiative to Cancel Fines expires 30 June 2026.^1,2

The EliteMindz write-up — a Saudi-active integration consultancy whose blog tracks the rolling Wave deadlines — records the operational stack the penalty regime sits on top of. Trade press notes the SAR 5,000–50,000 fine band attaches per real-time-reporting violation, and the SAR 10,000-per-invoice fine for a missing QR code attaches per document — so a single afternoon of failed Fatoora calls during a Wave-24 onboarding can compound into a five- or six-figure liability before the operator notices. The repeat-breach multiplier kicks in within a 12-month window: a second occurrence of the same violation runs at a higher rate than the first, a third higher still, and the same write-up records that the multipliers persist regardless of whether the operator has since remediated the underlying integration. The deadline asymmetry is the core operator complaint — Wave 24's onboarding cohort is the cohort with the least technical capacity, the oldest accounting software, and the fewest options to absorb a vendor switching cost, but the 30 June 2026 deadline is identical for every firm pulled in.³

The SilentInfotech briefing — a Saudi-active software-services firm whose practice fields integration questions from VAT-registered SMEs week to week — captures the composite picture. ZATCA has publicly told VAT-registered firms that the Initiative to Cancel Fines runs only to 30 June 2026; after that date, every Phase-2 invoice that misses the real-time clearance window is a live, unmitigated fine. Around that hard date sits a stack of structural problems Wave-24 operators describe in their own words: the Fatoora portal's certificate lifecycle requires periodic renewal that a non-technical owner-operator cannot complete without a vendor's help; the cryptographic stamping path means an outage at the operator's end (a connectivity failure, an expired certificate, a schema-version mismatch) blocks every B2B invoice from becoming legally valid until it is resolved; the 24-hour B2C reporting window is generous on paper but unforgiving in practice for a small retailer whose till-system was never designed to forward UBL 2.1 documents anywhere; and the SME's only realistic path is to outsource the entire Phase-2 surface to a ZATCA-approved vendor — at a recurring monthly cost on a thin retail margin. For the bakkala owner in Riyadh whose 2024 turnover crossed SAR 375,000 for the first time, Wave 24 is not a one-off integration but a permanent change in the operating cost of being VAT-registered in Saudi Arabia.⁴

For the bakkala owner in Riyadh whose 2024 turnover crossed SAR 375,000 for the first time, Wave 24 is not a one-off integration but a permanent change in the operating cost of being VAT-registered in Saudi Arabia. — Saudi Arabia · Retail forum threads

02Who solves this today

Saudi-active vendors that publicly self-market to the ZATCA / Fatoora / Phase 2 e-invoicing niche on their own homepage — software providers whose front pages name Phase 2 readiness as the operator promise. Each entry verified live and self-marketed in the niche on the date of writing. The ZATCA Fatoora portal is the regulator's own platform and is cited in section 01 as the source of the regime, not as a third-party vendor. The list is intentionally narrow.

ClearTax SA

Saudi e-invoicing software platform whose homepage names the regime in plain terms — "Embrace comprehensive ZATCA compliance" as the lead positioning, "E-invoicing Software" as the headline product, and "ZATCA Phase II Integration" as the operator promise — with the Fatoora portal referenced in the rolling regulatory-update feed: "integrate their e-invoicing solutions with the Fatoora portal". The route a Wave-23 or Wave-24 operator takes when they want a Phase-2 surface that already absorbs the Fatoora API, UBL 2.1 schema and certificate lifecycle as the vendor's own problem.

cleartax.com/sa

Wafeq

Saudi-and-MENA cloud accounting platform whose homepage carries Fatoora branding above the fold and answers the operator's question on the front page — "Ready for ZATCA phase 2. Learn more" as the lead call-to-action — and names the operator promise in plain terms: "Wafeq automatically generates compliant e-invoices with QR code to your customers following ZATCA requirements in KSA", with the page title positioned as "Wafeq – ZATCA-Compliant Invoicing Software". The route a VAT-registered SME takes when they want a cloud-native invoicing surface that publishes Phase 2 readiness as a yes/no answer rather than a roadmap item.

wafeq.com

Listed providers publicly market to the Saudi Arabia ZATCA / Fatoora / Phase 2 e-invoicing niche on their own homepages. Inclusion is not endorsement. Adjacent Saudi-active vendors were considered and excluded where their public homepage did not explicitly name the ZATCA / Fatoora / Phase 2 e-invoicing niche at the date of writing — ZynoBooks's group homepage references a platform migration without naming ZATCA, Fatoora or Phase 2; Sovos's KSA-specific landing page was not reachable at the date of writing; Out2sol's homepage references general Middle-East IT services without naming the e-invoicing niche; and SafariStar's homepage carries a single-blog-post reference to "ZATCA Wave 24 Integration" without surfacing Phase 2 e-invoicing as a product offering — they were therefore dropped per the named-niche-on-homepage rule. The ZATCA Fatoora portal (zatca.gov.sa / fatoora.zatca.gov.sa) is the regulator's own platform and is cited above in section 01 as the source of the regime and the publisher of the platform itself, not as a third-party solution provider. EY, ClearTax, EliteMindz and SilentInfotech are also cited in section 01 as advisory and trade-press sources; vendors can be both source and solution as long as the cited roles are clearly separate.

Listed companies — manage your entry. If you are one of the providers above and anything here is wrong, missing, or out of date — or you'd rather not be listed — let us know. Removal is processed within 24 hours; corrections within 7 business days. We do not contact listed companies first; we publish what your own public marketing claims and respond when you reach out. Email contact@aikraft.com.