ZATCA Wave 25: SAR 187,500 Turnover Businesses Must Integrate by Feb 2027

ZATCA Wave 25: The New Integration Frontier

Saudi Arabia's Zakat, Tax and Customs Authority (ZATCA) has set the stage for its most expansive e-invoicing phase yet. Wave 25, announced on July 24, 2026, targets taxpayers whose taxable turnover exceeded SAR 187,500 in 2022, 2023, or 2024. These businesses must integrate their systems with the Fatoora platform no later than February 1, 2027. This threshold represents the lowest yet in the e-invoicing rollout, effectively bringing almost every VAT-registered business in the Kingdom under the mandate's purview. For developers building solutions, this means engaging with a more complex integration than previous waves.

The transition from Phase 1 to Phase 2 of e-invoicing is not a trivial update. While Phase 1 primarily involved adding a QR code with five specific fields to existing invoices, Phase 2 demands a far more profound system overhaul. This involves not just generating compliant e-invoices but also managing their lifecycle, including submission, validation, and archiving, all within ZATCA's stringent framework. Developers must understand that Phase 2 requires a deep dive into cryptographic processes, data validation, and secure communication protocols.

Understanding Phase 2 Integration Requirements

Integrating for Wave 25 involves several critical steps, starting with the onboarding process. This requires generating a unique key pair and building a Certificate Signing Request (CSR) with a ZATCA-specific extension. This CSR is then submitted to ZATCA for validation. Upon approval, ZATCA issues a digital certificate, which is essential for signing e-invoices. This digital signature ensures the authenticity and integrity of the invoice data.

The core of Phase 2 is the generation and submission of e-invoices. These invoices must adhere to a specific XML or PDF format, containing a comprehensive set of data fields mandated by ZATCA, including buyer and seller details, item descriptions, quantities, prices, taxes, and a unique invoice identifier. Crucially, each e-invoice must be digitally signed using the private key obtained during the onboarding process. This signed invoice is then submitted to ZATCA's Fatoora platform for validation.

ZATCA's platform validates the submitted e-invoice against a set of predefined rules and checks for cryptographic integrity. If the invoice is valid, ZATCA returns a UUID (Universally Unique Identifier) and a QR code that includes specific data, including the cryptographic stamp. This validated invoice, along with the UUID and QR code, must then be presented to the customer. For credit or debit notes, a similar process applies, with the requirement to reference the original invoice's UUID.

Technical Deep Dive: Cryptography and Data Standards

The cryptographic backbone of Phase 2 is paramount. Businesses must implement Public Key Infrastructure (PKI) to generate and manage their key pairs. The private key must be stored securely, as its compromise would allow malicious actors to generate fraudulent invoices. ZATCA specifies the use of specific cryptographic algorithms and key lengths to ensure robust security. Developers need to ensure their systems can generate these keys, create CSRs in the correct format, and apply digital signatures using the approved algorithms.

Data standardization is another significant hurdle. ZATCA has defined a comprehensive data dictionary and schema for e-invoices. This includes mandatory fields, conditional fields, and specific data types. For example, tax codes, currency formats, and date formats must strictly adhere to ZATCA's specifications. Any deviation can lead to invoice rejection. Developers must meticulously map their internal data structures to ZATCA's required format, ensuring all necessary fields are populated accurately and consistently.

The communication protocol for submitting invoices to ZATCA's API is also critical. This typically involves secure web services (SOAP or REST) using TLS/SSL encryption. Developers need to understand the API endpoints, request and response structures, and error handling mechanisms provided by ZATCA. The platform returns validation status, UUIDs, and any error codes, which must be processed and reflected in the business's accounting system.

Archiving e-invoices is a regulatory requirement that extends beyond the initial submission. Businesses must store both the original and the validated e-invoices, along with their cryptographic stamps, for a specified period (typically five years). This archive must be accessible for audits and compliance checks. Developers need to ensure their systems can manage this long-term storage securely and efficiently, maintaining the integrity of the archived data.

What Developers Need to Build or Adapt

For developers integrating systems for Wave 25, several key capabilities are necessary:

• Onboarding Module: A secure process for generating key pairs, creating CSRs, and managing digital certificates issued by ZATCA.
• E-invoice Generation Engine: Ability to construct e-invoices in the specified XML or PDF formats, populating all mandatory and conditional fields accurately based on business data.
• Digital Signing Component: Integration with cryptographic libraries to digitally sign generated e-invoices using the private key.
• API Integration Layer: Robust code to communicate with ZATCA's Fatoora platform, submitting invoices, handling responses (UUIDs, validation status, errors), and retrieving QR codes.
• Data Mapping and Transformation: Tools or logic to transform internal data formats into ZATCA's standardized schema.
• Archiving Solution: Mechanisms for storing validated e-invoices and associated data for regulatory compliance.
• Error Handling and Reporting: Comprehensive logic to manage rejections, provide clear error messages to users, and facilitate corrections.

The surprise here is not the complexity itself, but the sheer scale of businesses now impacted. Previous waves targeted larger enterprises with dedicated IT departments. Wave 25 brings smaller businesses, many of whom might not have dedicated IT staff, into the fold. This means solutions need to be more user-friendly and perhaps offer managed services or simpler integration paths. The low turnover threshold means developers will encounter a wider spectrum of business operations and data management maturity.

Timeline and Compliance Considerations

With the February 1, 2027 deadline approaching, businesses and their developers have approximately two and a half years to implement the necessary changes. However, given the complexity of Phase 2 integration, starting early is crucial. ZATCA has provided technical guidelines and specifications, but interpreting and implementing them requires significant development effort. Businesses should engage with their solution providers or development teams immediately to assess their current systems and plan the integration roadmap.

Failure to comply can result in penalties, including fines and potential business disruption. Beyond regulatory compliance, adopting e-invoicing can offer benefits such as improved efficiency, reduced errors, faster payment cycles, and better data analytics. For developers, this represents a significant market opportunity to provide compliant solutions and services to a vast number of businesses.

The integration for Wave 25 is a substantial undertaking. It requires a deep understanding of ZATCA's technical specifications, cryptographic principles, and data standards. Developers must be prepared to build or significantly adapt existing systems to meet these requirements. The goal is not just to add a QR code, but to create a fully integrated, secure, and compliant e-invoicing workflow that meets ZATCA's rigorous standards.