SAP DRC & Tax Compliance

Saudi Arabia: Clearance, Wave by Wave — Now Reaching Almost Everyone

Saudi Arabia has been bringing taxpayers into real-time e-invoicing in waves since 2023. The 25th wave, due by February 2027, reaches down to the voluntary VAT registration threshold. For large groups the challenge has shifted from connecting to keeping a demanding technical regime running — across every entity and every invoicing system.

Country briefing · September 2026 · CFOs, Tax and Finance leads

Download Full Briefing (PDF, EN)

Dec 2021

Phase 1: invoices generated and stored electronically

2023

Phase 2 begins, starting with the largest taxpayers

SAR 187.5k

Revenue threshold for Wave 25 — the voluntary VAT registration level

1 Feb 2027

Integration deadline for Wave 25

Key takeaway for finance and tax leaders: Wave 25 makes a group’s tail mandatory: small entities, secondary invoicing systems and certificates nobody is watching. The question to ask this month: which of our Saudi entities, and which of their invoicing systems, are in Wave 25, and have we been notified?

Where Things Stand

Two Phases, Twenty-Five Waves

Saudi e-invoicing, FATOORAH, arrived in two phases. The first, in December 2021, required invoices to be generated and stored electronically. The second, from 2023, integrates invoicing systems with the tax authority’s platform: business invoices are cleared before they reach the buyer, and consumer invoices are reported within a day. Taxpayers join the second phase in waves, by revenue.

The Two Phases

Aspect	Phase 1 — Generation	Phase 2 — Integration
From	4 December 2021, for all	1 January 2023, in waves
Requirement	Electronic generation and storage from a compliant system; QR code on simplified invoices	Connection to the authority’s platform; clearance or reporting of every invoice
Format	Electronic, from a compliant solution	Structured XML with cryptographic controls
Authority’s role	Sets the rules	Validates, stamps and records every business invoice

What Makes the Saudi Regime Demanding: Who It Reaches Inside the Business

Function	What FATOORAH asks of them
Billing and AR	Invoices that exist only once cleared; rejections fixed the same day
Retail and POS	Simplified invoices reported within 24 hours; the right type per buyer
IT	Units, certificates, counters and chains managed as production infrastructure
Tax	Wave scope, special invoice types, credit-note timing and penalty exposure

The Question to Ask This Month

“Which of our Saudi entities, and which of their invoicing systems, are in Wave 25, and have we been notified?”

Smaller entities and secondary systems in large groups are the ones most likely to be caught by the lower threshold.

Clearance Is Real Time

A business invoice cannot be shared with the buyer until the authority has cleared it.

The Controls Are Cryptographic

Each invoice carries a unique identifier, a counter and the hash of the previous invoice, so sequence and integrity are enforced technically.

Every Invoicing System Is an Onboarded Unit

Each device or system that issues invoices needs its own certificate, renewed and managed.

Nothing Can Be Deleted

Corrections are made only through credit and debit notes.

The Waves

From Three Billion Riyals to Under Two Hundred Thousand

ZATCA has brought taxpayers into Phase 2 in successive waves, each defined by VAT-able revenue in reference years and each notified at least six months ahead. The thresholds have fallen steadily; the latest has halved again.

The Threshold of Each Wave

Wave	Revenue threshold	Integration
1	Above SAR 3 billion	From 1 January 2023
2	Above SAR 500 million	From 1 July 2023
3 – 19	Progressively lower thresholds	2023 – 2025
20	Above SAR 1.5 million	August – October 2025
21	Above SAR 1.25 million	September – November 2025
22	Above SAR 1 million	October – December 2025
23	Above SAR 750,000	January – March 2026
24	Above SAR 375,000	By 30 June 2026
25	Above SAR 187,500, any of 2022–2025	By 1 February 2027

Thresholds refer to revenue subject to VAT in the specified reference years. Secondary sources label some waves differently; ZATCA’s own notifications and announcements are authoritative.

If an Entity Is in Wave 25

Now

Confirm the notification and the registered contact; list every invoicing unit

Q4 2026

Onboard units through the compliance checks; test clearance and reporting

January 2027

Go live before 1 February; monitor the first weeks daily

Notification Comes to You

ZATCA has said it will inform taxpayers directly, at least six months before their date. Make sure the notification reaches someone — for smaller group entities, the registered contact is often out of date.

It Reaches the Voluntary Registration Level

SAR 187,500 is the threshold at which businesses may register for VAT. Wave 25 therefore covers nearly every registered taxpayer — though ZATCA has not said it is the last wave.

The Look-Back Includes 2025

An entity that crossed the threshold in any reference year is in scope, even if revenue has since fallen.

For Groups, It Catches the Tail

Dormant subsidiaries, project companies and small branches that were never in earlier waves.

Clearance and Reporting

Two Flows, Decided by the Type of Invoice

Phase 2 distinguishes two kinds of invoice. Standard tax invoices, issued to businesses and the government, are cleared by the authority before they are shared. Simplified tax invoices, issued to consumers, are stamped by the seller and reported within twenty-four hours.

The Two Flows

Aspect	Standard (B2B, B2G)	Simplified (B2C)
Model	Clearance before sharing	Reporting after issue
Timing	Real time, before the buyer receives it	Within 24 hours
Stamp and QR	Applied by the authority on clearance	Applied by the seller’s system
What the buyer gets	The cleared XML, optionally within a PDF/A-3	A receipt or invoice with a QR code
If rejected	Not an invoice — correct and resubmit	Correct, and account for the rejection

Special Cases

Case	Treatment
Exports	Zero-rated standard invoices, cleared like any other
Self-billing	Permitted with a written agreement and authority approval; flagged in the invoice
Third-party billing	As for self-billing, with its own flag
Summary invoices	Flagged as such, under their own conditions
Corrections	Credit and debit notes only; issued invoices cannot be edited or deleted

The Operational Consequence of Clearance

Because a standard invoice does not exist until it is cleared, clearance availability is billing availability. An outage, a certificate problem or a validation failure stops invoices reaching customers — and with them, the start of payment terms. Monitoring belongs with AR, not only with IT.

What to Monitor Every Day

Indicator	Why it matters
Standard invoices awaiting clearance	Each one is a customer without an invoice
Clearance rejections	Invoices that do not exist until corrected
Oldest unreported simplified invoice	The 24-hour clock, measured rather than assumed

Getting the Type Right

Whether an invoice is standard or simplified is decided by the buyer, not by the channel. A business customer buying through a retail channel should receive a standard invoice; defaulting every point-of-sale document to simplified is a common, and expensive, shortcut.

Technical Controls

Integrity Enforced by Design

The Saudi specification builds integrity into every invoice. The format is UBL 2.1 XML, digitally signed, and each document carries controls that make gaps, duplicates and alterations technically detectable.

The Controls

Control	What it does	Where it fails
Unique identifier	Identifies each invoice; never reused, even after a rejection	Reused on resubmission
Invoice counter	Counts every document from the unit; never reset or reused	Reset by a system change
Previous-invoice hash	Chains each invoice to the one before, including through rejections	Broken by a parallel process
Cryptographic stamp	Proves origin and integrity	Expired or revoked certificate
QR code	Encodes the key invoice data for verification	Missing from some outputs

Onboarding Every Invoicing Unit

Step 1

Generate a one-time password

In the FATOORAH portal, valid for a short period.

Step 2

Submit a certificate request per unit

Each system or device that issues invoices is a separate unit.

Step 3

Pass the compliance checks

Sample invoices, credit notes and debit notes for every declared invoice type.

Step 4

Receive the production certificate

The unit can now clear and report live invoices.

Keeping It Running

Renewal repeats onboarding and revokes the previous certificate automatically.

Certificates are revoked on deregistration, suspension or a change in VAT group membership — reorganisations can stop invoicing.

New systems need new units. A new billing channel is an onboarding project, not only an IT change.

Events That Trigger Re-Onboarding or Checks

Event	What to do
Certificate approaching expiry	Renew in a planned window, not at the last minute
New billing channel or device	Onboard it as a new unit before first use
VAT group change	Expect revocation; plan re-onboarding with the change
System upgrade or migration	Protect counters and chains across the cut-over

The Chain Is Only as Strong as Its Weakest Unit

Integrity controls work per unit. A secondary invoicing system — a project billing tool, a local POS — that breaks its own chain or loses its counter produces non-compliant invoices even while the main ERP is perfect.

Penalties and Recent Changes

Graduated Fines, an Amnesty Question, and New Rules

The penalty regime is graduated, and the 2025–26 changes mainly affect credit-note timing and wave scope.

Penalties

Situation	Reported treatment
First breach	A notice with a period to correct
Repeated breaches	Escalating fines, rising in steps to tens of thousands of riyals; the count resets after a year without repetition
Deleting or altering an issued invoice	Treated more seriously, with higher fines

Published figures differ between sources; confirm against ZATCA’s current penalty table.

Do Not Rely on the Amnesty for E-Invoicing Fines

ZATCA has extended its fines amnesty to 31 December 2026, conditional on registration, filing and payment of the principal tax. Advisers disagree on whether it covers e-invoicing penalties. Until that is confirmed, plan as if it does not.

Changes During 2025–26

Change	What it means	From
Credit-note timing	Credit notes must be issued within fifteen days after the end of the month of the triggering event	April 2025
Online platforms	Deemed suppliers when selling for non-resident or unregistered suppliers	January 2026
Wave criteria	Reference years extended to 2025; threshold halved to SAR 187,500	Wave 25
Specifications	No new technical specification version since 2023	—

What the Credit-Note Rule Means for AR

Credit notes must now be issued within fifteen days after the end of the month in which the triggering event occurs. Returns, price adjustments and disputes therefore need to reach billing promptly — a credit held for approval into the following month may already be late.

The Regional Picture

Saudi Arabia is no longer alone in the Gulf. The UAE goes live for its largest taxpayers in January 2027 on a Peppol-based model; Oman began a phased rollout in August 2026. The models differ — Saudi clearance through the authority’s platform, the UAE and Oman through accredited providers — but the data demands overlap. For a regional group, one design with country variants is cheaper than three projects.

Three Countries, Three Models

Country	Model	Status
Saudi Arabia	Clearance through the authority’s platform	Live; Wave 25 by February 2027
UAE	Peppol-based, through accredited providers	Largest taxpayers from January 2027
Oman	Five-party exchange through providers	Phased from August 2026

The SAP Side

Real-Time Billing, Managed Like Production Infrastructure

SAP addresses the Saudi requirements through SAP Document and Reporting Compliance, whose electronic-document framework generates the XML, applies or obtains the stamp, and manages clearance and reporting with the authority’s platform. The framework exists on SAP S/4HANA and classic SAP ERP; country content and prerequisites differ by release and should be confirmed with SAP.

What “Good” Means

Area	What “good” means
Invoice type	Standard or simplified decided by the buyer, by rule
Clearance	Built into billing, with the cleared document stored against the SAP document
Reporting	Simplified invoices reported well inside twenty-four hours, with a backlog monitor
Integrity	Counters and hash chains protected against resets, parallel processes and resubmission errors
Units and certificates	Every invoicing unit registered, with certificate expiry tracked and renewal rehearsed
Corrections	Credit notes issued within the monthly deadline

Where Saudi Landscapes Are Usually Weakest

Secondary invoicing systems onboarded late, or not at all
Certificate renewal known to one person
Reporting backlogs after outages
Every POS document defaulted to simplified
Credit notes issued late
VAT-group changes that revoke certificates unexpectedly

Five Questions for Whoever Supports Your System

How many invoicing units do we have, and when does each certificate expire?
What happens to billing if clearance is unavailable for an hour?
How old is the oldest unreported simplified invoice right now?
Could any process reset a counter or break a chain?
Which entities and systems fall into Wave 25?

Outage Planning Is Part of Compliance

Because clearance is a precondition for every business invoice, an agreed procedure for platform or connectivity outages — who decides, what is held, how the backlog is cleared — belongs in the design, not in an incident log.

A Design Sequence

Order	Why in this order
1 · Units	Register every invoicing unit — scope for Wave 25 and certificate risk
2 · Monitoring	Clearance backlog, rejections and reporting age, owned by AR
3 · Integrity	Counters and chains protected through upgrades and reorganisations
4 · Region	UAE and Oman on the same data foundation

Health Check

Twelve Questions, and What a Poor Answer Costs

A short check on where each entity and each invoicing system stands against the Saudi regime.

The Twelve Questions

No.	Question	If the answer is unclear
1	Are all entities and systems in the right wave?	An integration deadline missed by a small entity
2	Is every invoicing unit onboarded?	Invoices issued outside the regime
3	When does each certificate expire?	Billing stops without warning
4	Are standard and simplified decided by buyer?	Business customers given consumer invoices
5	How many clearance rejections last month?	Invoices that never existed legally
6	Are simplified invoices reported within 24 hours?	A reporting breach on every late document
7	Are counters and chains intact on every unit?	Integrity failures across a sequence
8	Are credit notes issued inside the deadline?	A 2025 rule not yet applied
9	Do VAT-group changes trigger certificate checks?	A reorganisation that stops invoicing
10	Is there a plan for clearance outages?	Customers without invoices, terms not started
11	Is the amnesty assumed to cover e-invoicing fines?	A penalty budget based on an unconfirmed view
12	Is the UAE and Oman design aligned?	Three regional projects instead of one

Questions 1, 2 and 3 are the ones to fix first: the first two define scope before February, and the third is the most common cause of an unplanned billing stop.

The First Thirty Days

Week 1

Build the unit register

Weeks 2–3

Measure rejections and reporting age; map certificate dates

Week 4

A dated plan to February

Questions 6 and 7

These are where large, long-live implementations most often drift: reporting age and integrity are rarely measured once the go-live team has moved on.

What We Typically Find

The main ERP well integrated since an early wave
Secondary systems and small entities left behind
Certificates renewed in a scramble
No monitoring of simplified-invoice reporting age

Scoring It Honestly

Three or more unclear answers is common in groups whose main integration went live in an early wave — the programme ended, and the tail was never owned. Wave 25 is the moment that tail becomes mandatory.

How We Help

An SAP Finance and Compliance Practice

For most large groups the Saudi integration is done. What remains is bringing the tail in by February, and running the regime without surprises.

1 · Review

Wave 25 and coverage review

Every entity and invoicing system mapped to its wave, onboarding status and certificate dates — with the gaps dated against February 2027. Output: a complete unit register.

2 · Remediate

Remediation

Remaining units onboarded, invoice-type rules corrected, reporting monitored, integrity protected and credit-note timing fixed. Output: every unit compliant.

3 · Run

Run and the region

Certificate calendar and renewal routine, outage procedures, and the same design extended to the UAE and Oman. Output: one Gulf design.

What Makes This Different

We think in units, not systems. The Saudi regime is enforced per invoicing unit, and so is our review.

We treat certificates as infrastructure. With a calendar, an owner and a rehearsed renewal.

We design for the region. Saudi Arabia, the UAE and Oman share data demands, if not models.

We say what we are not. We are not your tax adviser. We work alongside the people who are.

What a Coverage Review Produces

A unit register: every invoicing system and device, its entity, wave, onboarding status and certificate expiry.

An operational view: rejections, reporting delays and integrity breaks over the last quarter.

A regional alignment: where the Saudi design can serve the UAE and Oman, and where it cannot.

If you are ahead: if every unit is registered, certificates are on a calendar and reporting age is monitored, the remaining work is small — and we will tell you that.

A Sensible First Step

Build the unit register: every entity, every invoicing system, its wave and its certificate date. It takes days, and it answers both the February question and the one that stops billing unexpectedly.

Founder-led

Finance + SAP DRC depth

SAP DRC delivery: France and Germany

Boutique agility

Sources consulted 25 September 2026: ZATCA announcements on waves 24 and 25, the roll-out phases page, the e-invoicing detailed technical guideline and XML implementation standard; EY, KPMG and PwC alerts on waves, VAT regulation amendments and the amnesty; ClearTax, VATupdate and vatcalc; Deloitte and VATupdate on UAE and Oman. SAP behaviour from the SAP Help Portal and partner commentary.

Prepared by 30 Advisory (status at 25 September 2026). Information only — not tax, legal or accounting advice. It summarises publicly available material as at that date. Sources label some waves differently, penalty figures vary between publications, and advisers disagree on whether the amnesty covers e-invoicing fines. Confirm the position for your own entities with ZATCA or a qualified adviser before acting.