ZATCA Phase 2 Waves & Deadlines: 2026 Compliance Calendar

ZATCA does not flip the whole country to Phase 2 in one day. It is rolling out across at least 13 waves from 2023 through 2027, each triggered by a revenue threshold and announced ahead of time. The wave you are in determines when you must integrate, the deadline you must hit, and the cost envelope that makes sense for your business. This page is the calendar and the playbook — every wave, every threshold, every cost band, and a 6-month integration timeline you can hand to your accountant. For the high-level picture of what Phase 2 is, see our complete Phase 2 guide; for what the integration actually looks like day-to-day, see the onboarding step-by-step.

How the wave schedule works

The single number that puts you in a wave is your VAT-able revenue in the previous calendar year. If you are VAT-registered in Saudi Arabia and your taxable sales in 2025 were above the threshold for wave N, you are in wave N. The thresholds are public, the waves are pre-announced, and the deadline is the same for everyone in a wave — there is no individual negotiation. The latest schedule is published at the ZATCA Implementation Plan page; what follows is the working version as of August 2026.

A note on the threshold definition: it is total taxable revenue, not profit. A business with SAR 200M in revenue and SAR 5M in profit is in the same wave as a business with SAR 200M in revenue and SAR 50M in profit. The number ZATCA sees is your VAT return line 1 (sales excluding exempt sales).

The wave schedule (2023 – 2027)

Wave	Revenue threshold (SAR)	Phase 2 deadline	Status (Aug 2026)
1	More than 3 billion	1 Jan 2023	Live (production)
2	2.5 – 3 billion	1 Jul 2023	Live (production)
3	1.5 – 2.5 billion	1 Oct 2023	Live (production)
4	1 – 1.5 billion	1 Nov 2023	Live (production)
5	750M – 1 billion	1 Dec 2023	Live (production)
6	500M – 750M	1 Jan 2024	Live (production)
7	400M – 500M	1 Feb 2024	Live (production)
8	300M – 400M	1 Mar 2024	Live (production)
9	200M – 300M	1 Jun 2024	Live (production)
10	150M – 200M	1 Oct 2024	Live (production)
11	100M – 150M	1 Dec 2024	Live (production)
12	70M – 100M	1 Mar 2025	Live (production)
13	50M – 70M	1 Jun 2025	Live (production)
14	40M – 50M	1 Oct 2025	Live (production)
15	25M – 40M	1 Dec 2025	Live (production)
16	15M – 25M	1 Mar 2026	Mostly live
17	7.5M – 15M	1 Jun 2026	Rolling out
18	5M – 7.5M	1 Oct 2026	Upcoming
19	2.5M – 5M	1 Dec 2026	Upcoming
20+	All other VAT-registered	2027 (TBD)	Pending

If you are reading this in late 2026, the wave that matters to you is the one whose threshold brackets your 2025 revenue. If you are sub-SAR 2.5M in revenue, you are exempt from VAT entirely, and therefore exempt from e-invoicing. If you are VAT-registered but below wave 17, you are still required to be Phase 1 compliant and will be added to a Phase 2 wave in 2027.

What "in scope" actually means for a business

When your wave opens, three things change:

1. You must integrate with Fatoorah. Every B2B invoice you issue must be cleared (you POST the invoice, Fatoorah returns a clearance hash). Every B2C invoice you issue must be reported (you POST within 24 hours of issuance).
2. You must sign every invoice cryptographically. No more unauthenticated PDFs. The signing is ECDSA P-256, the chain is hash-based, the full mechanism is in our cryptography guide.
3. You must keep audit-ready storage for 6 years. The XML, the signature, the clearance hash, and the chain. Storage is your responsibility; ZATCA does not store your invoices for you.

You are not required to stop using a Phase 1 generator after Phase 2. Phase 1 is additive: the TLV QR, the bilingual PDF, the 5-year retention — all still apply. Phase 2 is what you do in addition to Phase 1. Our free Phase 1 generator is still useful for the customer-facing PDF even in a Phase 2 world.

Exemptions: who is not in any wave

Five categories of taxpayer are not currently scheduled to join Phase 2:

• Non-VAT-registered businesses. If your revenue is below the VAT registration threshold (SAR 375,000 for goods, SAR 187,500 for services in 2026), you are not in scope. Once you register, you join the wave applicable to your revenue.
• Government entities. Federal and local government bodies are exempt by default. They issue invoices under a separate framework.
• Diplomatic missions and certain NGOs. Specifically listed in the ZATCA exemptions. If you are in this category, you still get a VAT number but your invoicing rules are different.
• Businesses issuing only simplified B2C invoices. For wave 17 and below, ZATCA treats you as a reporting-only taxpayer — you do not need clearance, only reporting. This is the most common exemption SMEs use.
• Businesses in active tax dispute. ZATCA has a published dispute resolution process. If you are in formal dispute, your wave may be paused. This is rare and temporary.

The most misunderstood exemption is the "B2C-only" carve-out. If 100% of your invoices are to consumers (no VAT-registered buyers), you are in scope for reporting but not clearance. You still integrate with Fatoorah, but the integration is reporting-only and the cost is lower.

Cost ranges for the three integration paths

How much Phase 2 actually costs depends on which path you take. As of 2026:

Path	Setup (one-time)	Recurring (monthly)	Best for
Off-the-shelf SaaS	SAR 2,000 – 10,000	SAR 100 – 500	SMEs, sub-SAR 50M revenue
Build on open-source ERP	SAR 15,000 – 60,000 (40-80 dev hrs)	ERP hosting (SAR 0 – 1,000)	Tech-savvy SMEs with dev team
Bank or POS bundle	SAR 0 – 2,000	SAR 0 (bundled) or SAR 50 – 200	Retail, F&B, services via payment processor
Enterprise solution (SAP / Oracle / Dynamics)	SAR 80,000 – 250,000	SAR 2,000 – 10,000 (incl. support)	Large enterprises, multi-entity

The "free" path — a bank or POS provider bundling the integration with payment processing — has been the most common route in 2024-2025 because most Saudi SMEs already use a payment processor (Mada, Apple Pay, STC Pay). The bank pays the SaaS fee in exchange for the merchant relationship, and the merchant gets Phase 2 compliance as a free add-on. The catch: you are locked into the bank's payment processor. If you later want to switch, you re-do the integration.

The build path makes sense at roughly 5,000+ invoices per month. Below that, the SaaS subscription amortizes. Above 50,000 per month, you save enough to hire a dedicated integration engineer.

Sector-specific gotchas

A few sectors have edge cases worth flagging:

Retail (POS-driven). Most Phase 2 retail integrations piggyback on the POS system. If your POS is from a major Saudi vendor (Foodics, iZam, Jeel, etc.), Phase 2 is a software update, not a new integration. Confirm with your POS vendor that their software is Phase 2 certified — the certified-vendor list is on the ZATCA solutions page.

F&B and hospitality. Tips, service charges, and split bills are the tricky cases. Service charge is VAT-able at 15%, but the way it is split between the Fatoorah invoice and the customer's tip is your choice. Most F&B operators include service charge in the line item total and report it as VAT-able revenue. Document your choice and stick to it across invoices.

Real estate and construction. Progress billing and retention are the edge cases. ZATCA requires you to issue an invoice at the point of supply, not at the point of payment. If you have a milestone-based contract, you issue a Phase 2 invoice at each milestone, even if the customer has not paid yet. Retention is handled by issuing a credit note (type 381) when the retention is released.

Import / export. Reverse-charge supplies and customs declarations interact with Phase 2. If you import goods, the customs declaration is the VAT-able event; the supplier invoice and the customs entry are both required. Talk to your customs broker about Phase 2 — most are now Phase 2 capable.

Professional services and consulting. Time-based billing and milestone billing both work with Phase 2. The invoice format is the same; the unit of measure is "hours" or "days" instead of "PCE" (pieces). Make sure your line-item code reflects this.

The 6-month integration timeline (template)

A realistic timeline for a typical SAR 50M-revenue SME that has to integrate from scratch:

Month 6 (T-6): wave notification + scope freeze. ZATCA emails you your wave. Confirm your revenue figure is in the right bracket. If you think the wave assignment is wrong (e.g. you had a one-off sale that bumped you into the next wave), file a dispute through the Fatoorah portal within 30 days. Choose your integration path: SaaS, build, or bank bundle.

Month 5 (T-5): vendor selection + contract. If SaaS: request proposals from 3-5 ZATCA-accredited providers, evaluate, sign. If build: assemble your dev team (in-house or contractor) and scope the project. If bank bundle: ask your bank to confirm Phase 2 readiness and timeline.

Month 4 (T-4): sandbox + CSR. Generate the CSR, request the Compliance CSID, integrate against sandbox. This is the onboarding flow. The UBL XML is in our schema guide; the crypto is in our cryptography guide.

Month 3 (T-3): sandbox hardening + edge cases. Test refund flows, multi-currency, multi-line-item, voiding, and credit notes. Reconcile against your internal ledger. The goal: 100 test invoices in a row without a single Fatoorah error.

Month 2 (T-2): production CSID + cutover. Request the Production CSID. Cut over with the dual-write pattern: production code points at sandbox first, then flip, then run both endpoints in parallel for 7 days. Daily reconciliation. Document the cutover in your change-management log.

Month 1 (T-1): audit + sign-off. Generate audit reports: total invoices issued, total cleared, total reported, total rejected. Reconcile against your tax return. File a "ready for production" note with your CFO. The deadline is the deadline — there is no extension for "we are almost ready".

Day 0 (deadline): go live. Your ERP / POS / generator now issues Phase 2 invoices for all in-scope transactions. The free Phase 1 generator remains useful for non-invoice documents (receipts, estimates, quotations) that are not yet in Phase 2 scope.

Penalties for missing a wave deadline

ZATCA penalties for non-compliance are published in the ZATCA E-Invoicing FAQ. The structure is:

• SAR 5,000 for the first violation (failure to issue a Phase 2 invoice when one is required).
• SAR 10,000 for repeat violations within the same calendar year.
• SAR 50,000+ for systematic non-compliance (issuing more than 50 non-compliant invoices in a 90-day window).
• Up to SAR 100,000 per audit cycle for failing to maintain the 6-year audit trail.

In practice, ZATCA typically gives a 6-month grace period for the first missed wave before issuing fines, and the first fine is usually a warning. But the grace period is informal and not guaranteed. A business that misses the wave by a day is technically in violation; the fine is the leverage ZATCA uses to bring you back into compliance.

A second-order penalty: tax audits. ZATCA has the right to open a VAT audit on any non-compliant business. The audit cost (in time, in accountant fees, in disruption) is typically much larger than the fine itself. The fines are a signal; the audit risk is the real cost.

What to do if you discover you are late

The path back to compliance is the same onboarding flow, but with three caveats:

1. Document the gap. For every invoice you issued during the missed period, you now need to retroactively report it. The Fatoorah portal has a "bulk upload" tool for exactly this. The bulk upload is reversible: if you make a mistake, you can withdraw and re-submit.
2. Be honest with ZATCA. If you self-report, the penalty is usually waived or reduced. If ZATCA finds the gap first, the penalty is the full amount plus potential audit.
3. Run the integration in parallel for 90 days. Going forward, run your new Phase 2 integration and a parallel re-reporting job for 90 days. The parallel run ensures the chain does not break and gives your auditor a clean transition.

Frequently asked questions

My revenue is exactly on a wave threshold. Do I get the lower or higher wave?
ZATCA uses "more than" for the upper bound and "at least" for the lower bound. A business with revenue of exactly SAR 50M is in wave 14 (40M – 50M), not wave 13. If you are exactly on the boundary, ask ZATCA to confirm in writing before your wave opens — the boundary case is the most common source of disputes.

How is the revenue figure calculated for groups / multi-entity businesses?
ZATCA looks at the consolidated VAT group. If your entities are in a VAT group, the group revenue determines the wave. If they are separate VAT registrations, each one is in its own wave. Multi-entity groups often consolidate to a single group VAT registration to simplify compliance — talk to your tax advisor about whether this is right for you.

What if my revenue dropped below the threshold after my wave was assigned?
You stay in your assigned wave. ZATCA does not move businesses down a wave based on subsequent revenue decline. The wave is determined by the year before the wave opens, not by the current year.

I am a non-Saudi business with a Saudi VAT number. When am I in scope?
As soon as you have a Saudi VAT number, the same wave schedule applies. The CSID is issued to the VAT number, not to a Saudi national ID, so there is no nationality-based exemption. Non-Saudi businesses with Saudi VAT registration have been in scope since wave 1.

My ERP vendor says they are "Phase 2 ready" but they are not on the ZATCA approved list. What do I do?
Ask for their CSID. Any vendor that has actually integrated with Fatoorah will have a CSID. The CSID is public and verifiable. If they cannot produce one, the claim is marketing, not compliance. The approved list is the ground truth.

What happens if I issue an invoice in a currency other than SAR?
You can invoice in USD, EUR, GBP, AED, or any other currency ZATCA supports, but the VAT must be in SAR at the SAMA rate of the day. The XML fields DocumentCurrencyCode and TaxCurrencyCode can differ. Fatoorah handles the conversion at the official rate; your ERP does not need to do FX math.

How long does a Phase 2 integration typically take?
SaaS: 2-6 weeks. Build on open-source ERP: 6-12 weeks. Bank bundle: 1-3 weeks. Enterprise ERP (SAP/Oracle): 3-9 months. The variance is dominated by how much of your existing invoice flow is automated and how much of your team can be reassigned to the project.