ZATCA Phase 2 Wave 24: SME Compliance Action Plan
Wave 24 brings ZATCA's e-invoicing integration mandate to smaller VAT-registered businesses. Here is exactly what your SME clients must do before the deadline.
By the SuperAccountant Editorial Team
Your SME Client Just Received a ZATCA Wave 24 Letter — Now What?
Most small businesses in KSA received their ZATCA Phase 2 integration notification and immediately called their accountant. If you are on the receiving end of that call, this post is your briefing. Wave 24 is not a future consideration — it is an active compliance obligation with a defined countdown window, and the penalty exposure for missing the integration deadline is real. This guide moves straight to operationalising compliance, because your client does not need a history of e-invoicing; they need a working FATOORA-connected system before the deadline lapses.
What Wave 24 Actually Means in the ZATCA Rollout
ZATCA's Phase 2 (Integration Phase) rollout is not a single cut-over event. It is a wave-based programme under which ZATCA notifies taxpayer cohorts in batches, giving each cohort a 6-month integration window from the date of official notification. This is governed by the ZATCA E-Invoicing Implementing Regulation (published on the ZATCA official portal at zatca.gov.sa) and subsequent Board of Directors resolutions that define each wave's taxpayer selection criteria.
Wave 24 targets VAT-registered taxpayers who were not captured in earlier waves — predominantly smaller entities with annual VAT-taxable revenues below the thresholds that triggered earlier waves. The selection criterion for Wave 24, consistent with prior waves, is annual revenue as reported in VAT returns. ZATCA communicates each taxpayer's specific go-live date via its portal and, in many cases, by direct notification letter.
Practical consequence: The 6-month window from notification is not a grace period to start planning. It is the build-test-submit-approve cycle. Businesses that start ERP selection at month four invariably miss the deadline.
The Two Modes Your Client Must Support
Under ZATCA's Phase 2 requirements (ZATCA E-Invoicing Implementing Regulation, Articles 54 and 55), all integration-phase taxpayers must support:
| Invoice Type | Mode Required | ZATCA Action |
|---|---|---|
| Standard Tax Invoice (B2B, B2G) | Clearance — invoice sent to FATOORA before delivery to buyer | ZATCA clears and stamps; cleared invoice is the legal document |
| Simplified Tax Invoice (B2C) | Reporting — invoice sent to FATOORA within 24 hours of issuance | ZATCA acknowledges; buyer receives invoice at point of sale |
The distinction matters enormously for SME clients who do both B2B and B2C. A retail business selling to both end consumers and corporate buyers must support clearance for the B2B invoices and reporting for the B2C invoices. A system configured only for reporting will fail clearance checks and expose the client to penalties under ZATCA's penalty schedule — fines ranging from SAR 1,000 to SAR 50,000 for repeated non-compliance, per the penalties framework published on the official portal.
Mandatory Technical Requirements for Integration
Before your client goes near an ERP vendor, confirm the system they procure or upgrade must meet all of these (ZATCA E-Invoicing Implementing Regulation, Articles 53–58, and the FATOORA Developer Portal technical specifications):
- UUID generation — each invoice must carry a universally unique identifier generated at the point of creation
- Cryptographic stamp — each invoice must be digitally stamped using a cryptographic stamp issued by ZATCA's Certificate Authority
- QR code — mandatory on all invoice types; TLV-encoded, minimum 6 fields for simplified invoices, additional fields for standard invoices
- XML schema compliance — invoices must conform to ZATCA's UBL 2.1-based XML schema; the PDF/A-3 with embedded XML is the compliant archival format
- API connectivity to FATOORA — production credentials obtained only after successful onboarding; sandbox testing precedes production
If a vendor cannot demonstrate they hold a Mu'tamad (approved) solution status on the ZATCA solution-provider list, do not sign a contract. The approved-solution list is published and updated on zatca.gov.sa. Using an unapproved solution does not transfer liability to the vendor — the taxpayer remains fully liable.
The 6-Month Integration Countdown: Week-by-Week Priorities
Here is the operational plan your SME client needs from day one of the notification window:
Weeks 1–3: Assess and select
- Pull the ZATCA notification letter and confirm the exact go-live date
- Audit the current invoicing setup: spreadsheet-based, standalone POS, or ERP
- Shortlist two or three Mu'tamad-approved solutions appropriate for SME scale and industry
- Confirm whether the client issues standard invoices, simplified invoices, or both — this determines API integration complexity
Weeks 4–8: Procure and configure
- Execute vendor contract; insist on a fixed go-live delivery date written into the agreement
- Begin CSID (Cryptographic Stamp Identifier) onboarding via ZATCA's FATOORA portal — this requires the client's VAT registration number, CR number, and authorised signatory credentials
- Run sandbox-environment testing of at least 20 invoice scenarios covering actual transaction types
Weeks 9–16: Test and validate
- Complete compliance checks against ZATCA's published test cases (available on the FATOORA developer portal)
- Submit onboarding request for production credentials
- Conduct parallel running — issue invoices through both old and new systems and reconcile
Weeks 17–22: Soft go-live and monitoring
- Switch to production environment
- Monitor clearance rejection rates — any rejection above 2% warrants immediate technical review
- Train accounts-receivable staff on handling a rejected clearance; the invoice cannot be delivered to the buyer until cleared, so a corrective credit note workflow must be in place
Weeks 23–26: Full compliance confirmation
- Confirm all invoice types are generating correctly in ZATCA's portal history
- Archive CSID certificates and backup private keys — loss of private keys requires re-onboarding
- Document the integration setup for VAT audit readiness
If you are already past week 12 of your client's window, compress the plan — but do not skip sandbox testing. Submitting malformed XML to production results in clearance failures that are logged in ZATCA's system.
Common Pitfalls That Trip Up Small Businesses
1. Treating Phase 2 as a Phase 1 upgrade Phase 1 (Generation Phase, December 2021) required only that invoices be generated electronically. Phase 2 requires real-time API connectivity to ZATCA. A business that upgraded to an e-invoicing tool for Phase 1 compliance is not Phase 2 compliant unless that tool holds Mu'tamad status and has FATOORA API integration built in.
2. Branch-level complexity A retail client with four branches and a central ERP needs to ensure the CSID onboarding covers all branches as separate solution units, or that the central ERP aggregates all branch invoices correctly. ZATCA ties CSIDs to specific devices or systems; one CSID per integration point is the rule.
3. VAT treatment errors surfacing at clearance Clearance validation checks the VAT amount computed in the XML against the invoice line items. If your client applies VAT exemptions or zero-rating — for example, for exported services or qualifying financial services under ZATCA VAT Implementing Regulation Article 30 — those treatments must be correctly coded in the XML tax category fields. Clearance will reject invoices where the declared tax category does not match the computed tax amount.
4. Waiting for the ERP vendor to handle everything The taxpayer signs the FATOORA onboarding. The taxpayer holds the CSID. The taxpayer is responsible for what is submitted. Your role as the accountant is to verify that the data flowing into the e-invoice — the VAT registration number, the buyer's VAT number on B2B invoices, the correct tax category codes — is accurate. That is not something you can delegate entirely to the IT team.
What Accountants Should Do Right Now
If you have SME clients in Wave 24 or expect them to appear in subsequent waves:
- Check their revenue bracket against ZATCA's published wave criteria — confirm exact thresholds on zatca.gov.sa as ZATCA updates these per wave
- Review the chart of accounts for VAT treatment accuracy before integration — fixing tax-code errors post-clearance generates a credit-note trail that complicates VAT return reconciliation
- Build a simple compliance checklist for each client: CSID status, sandbox test completion date, production go-live date, staff training date
- Test your own knowledge of FATOORA integration requirements — if you want a fast benchmark, try the SuperAccountant skills quiz to identify gaps before your client asks a question you cannot answer
The accountants who add value in Wave 24 are not the ones who explain what e-invoicing is. They are the ones who sit in the vendor demo, ask the right technical questions, and catch the VAT-treatment errors before they hit the clearance API.
Sharpen your edge with SuperAccountant's next live cohort — small batches, real client workpapers, taught by partners. Details and seats at https://app.superaccountant.in/en/cohort?utm_source=blog&utm_medium=cta&utm_campaign=accountants.