ZATCA Phase 2 Wave 24: SAR 375,000 Fatoora Integration Guide

Your SME clients sitting just above the SAR 375,000 annual revenue mark are now firmly inside ZATCA's Phase 2 (Fatoorah) net — and the integration clock for Wave 24 stops on 30 June 2026 (4 Muharram 1448H). If you are still waiting for a ZATCA notification letter before starting technical scoping, you are already late: the Fatoora onboarding process, ERP configuration, and compliance testing alone typically consume eight to twelve weeks. This guide gives you the step-by-step accountant's checklist to get Wave 24 clients across the line.

What Wave 24 Actually Means: The SAR 375,000 Threshold Explained

ZATCA rolls out Phase 2 integration in waves, each targeting a lower revenue band. Wave 24 covers taxpayers whose annual revenues subject to VAT exceeded SAR 375,000 in either the 2022 or 2023 tax year. This is the threshold ZATCA has communicated for the June 2026 cohort, according to the official ZATCA e-invoicing portal.

Practically, this sweeps in a large segment of SMEs that previously sat below earlier wave thresholds (which started at SAR 3 billion for Wave 1 in January 2023 and have been progressively declining). If your client issued VAT-taxable supplies — goods, services, or both — and crossed SAR 375,000 in either reference year, they are wajib (obligated) under Wave 24.

Key dates to lock in now:

• Notification period: ZATCA typically issues formal notification letters six months before the go-live date. Watch for these arriving around December 2025 / Jumada Al-Awwal 1447H.
• Integration go-live deadline: 30 June 2026 / 4 Muharram 1448H
• Post-go-live: All B2B and B2G tax invoices must be cleared through the Fatoora platform before being delivered to the buyer. B2C simplified invoices require reporting within 24 hours.

---

Phase 2 Technical Requirements: What Has to Change

Phase 2 is not a stamp on a PDF — it is a real-time API integration. Before the checklist, make sure you and your client understand exactly what the standard mandates under ZATCA's E-Invoicing Implementing Regulations (Article 53 and Annex 1 of the Technical Specifications).

Requirement	Phase 1 (Fatoorah)	Phase 2 (Integration)
Invoice format	Any digital format	XML (UBL 2.1) or PDF/A-3 with embedded XML
QR code	Required	Required (enhanced — includes cryptographic fields)
Cryptographic stamp	Not required	Mandatory on every invoice
Real-time clearance (B2B/B2G)	Not required	Mandatory — ZATCA clears before delivery to buyer
Reporting (B2C simplified)	Not required	Within 24 hours of issuance
ERP/solution certification	Not required	Compliant ERP or e-invoicing solution required

The cryptographic stamp (hash chain + digital signature) is the most technically demanding element. Each invoice must contain: the invoice hash, the previous invoice hash (chain integrity), a UUID, and ZATCA's QR code fields as defined in Annex 2 of the technical specifications.

---

Step-by-Step Fatoora Integration Checklist for Wave 24

Work through these in order. Skipping the ERP assessment and jumping straight to CSID onboarding is the single most common mistake we see at the SME level.

Step 1 — Revenue & Eligibility Confirmation (Do This Week)

• Pull the client's VAT returns for fiscal years 2022 and 2023.
• Confirm taxable revenue exceeded SAR 375,000 in either year.
• Register the go-live date (30 June 2026) in your engagement tracker and set a 90-day internal deadline for go-live readiness.

Step 2 — ERP / Solution Readiness Assessment

• Identify whether the client's current accounting software is on ZATCA's list of Mu'tamad (accredited) e-invoicing solutions. Check the ZATCA accredited solutions list.
• If the solution is not accredited, shortlist two or three alternatives immediately — procurement, configuration, and user training take four to eight weeks minimum.
• For clients on legacy desktop accounting software (common in this revenue band), a middleware/connector approach may be viable — but the connector itself must be from an accredited vendor.

Step 3 — ZATCA Portal Access & VAT Group Check

• Confirm the client has active access to the Fatoora portal using their ZATCA account credentials.
• If the client is part of a VAT group, each entity issues its own invoices; confirm which Tax Identification Number (TIN) maps to which invoicing entity.
• Verify the client's VAT registration details (legal name in Arabic, CR number, TIN) exactly match what will appear in invoice XML — mismatches are a leading cause of clearance rejections.

Step 4 — Cryptographic Stamp Device (CSID) Onboarding

This is the technical handshake between the client's system and ZATCA's Fatoora platform.

1. The accredited e-invoicing solution generates a Certificate Signing Request (CSR) in the ZATCA-specified format.
2. The CSR is submitted to ZATCA's Fatoora portal; ZATCA issues a Compliance CSID (CCSID).
3. Run the mandatory compliance checks — ZATCA's API provides a set of test invoices that must pass before a Production CSID (PCSID) is issued.
4. Switch to the PCSID for live invoice submission. Do not go live on a CCSID — invoices submitted on a compliance credential are not legally cleared.

Document each step with timestamps; ZATCA auditors may request evidence of the onboarding sequence.

Step 5 — Invoice Template & XML Mapping

• Map every mandatory field in the client's existing invoice template to the UBL 2.1 XML schema required by ZATCA (reference: Annex 1, E-Invoicing Technical Specifications).
• Mandatory fields include: supplier TIN, buyer TIN (B2B), invoice date in both Gregorian and Hijri (الهجري), line-item VAT amounts, total VAT at 15%, and the UUID.
• Run at least 20 test invoices through the Fatoora sandbox API before touching the production environment.

Step 6 — Go-Live & First 30 Days Monitoring

• Schedule go-live at least 30 days before the 30 June 2026 deadline to allow a buffer for integration failures.
• Monitor clearance responses daily in the first two weeks — a rejected invoice requires a corrected replacement within the same business day for operational continuity.
• Set up automated alerts for API error codes, particularly 400 Bad Request (XML schema violations) and 401 Unauthorized (CSID expiry).

---

Common Errors That Will Get Your Client Rejected on Day One

These are the issues most frequently causing clearance failures at the SME level, based on publicly documented ZATCA implementation guidance:

• Arabic legal name mismatch: The supplier name in the XML must exactly match the ZATCA-registered Arabic name — including ة vs ه and ال definite articles.
• Wrong invoice type code: B2B tax invoices use type code 388; simplified B2C invoices use 388 with a KSA-2 extension. Misclassification routes the invoice to the wrong clearance/reporting path.
• Previous invoice hash error: If the chain integrity check fails (because a prior invoice was voided incorrectly), every subsequent invoice in the sequence fails. Establish a clear credit note and void procedure before go-live.
• QR code non-compliance: The Phase 2 QR code must encode additional TLV fields beyond Phase 1. If your client's solution simply carried over the Phase 1 QR generator, it will fail Phase 2 compliance checks.

---

What the Penalties Look Like If You Miss the Deadline

ZATCA's penalty framework under the E-Invoicing Regulations Article 14 distinguishes between first-time non-compliance and repeat violations. For taxpayers who fail to integrate by their wave deadline, ZATCA may issue fines ranging from SAR 5,000 to SAR 50,000 per violation. More consequentially, ZATCA has the authority to flag a taxpayer's VAT account, which can create downstream complications for VAT refund claims and Zakat filings. The commercial risk is larger: a B2B buyer cannot claim input VAT on an invoice that was not properly cleared through Fatoora, meaning your client's non-compliance becomes their customer's problem too.

---

Your Pre-June 2026 Action Plan at a Glance

If you are managing multiple Wave 24 clients simultaneously, prioritise by two factors: complexity of their current ERP setup, and volume of monthly invoices (high-volume clients face larger blast radius from any integration failure).

To pressure-test your own knowledge of ZATCA Phase 2 technical requirements — and identify gaps before client conversations — work through the SuperAccountant skills diagnostic. It takes under 10 minutes and maps directly to the Phase 2 compliance areas covered here.

The June 2026 deadline will not move. ZATCA has not extended a wave deadline retrospectively since Phase 2 began. Build your client project plan backwards from 30 May 2026 as the internal go-live date, and you will have 30 days of contingency to absorb the inevitable ERP vendor delays.

---

Sharpen your edge with SuperAccountant's next live cohort — small batches, real client workpapers, taught by partners. Details and seats at https://app.superaccountant.in/en/cohort.