ZATCA Wave 25: Who Is Affected & How Clinics, Restaurants, Workshops & SMEs Comply
Wave 25 pulls a new tranche of Saudi businesses into the ZATCA Phase 2 Integration Phase. Here is exactly who is affected, the deadlines that apply, and a practical readiness plan covering clinics, restaurants, car workshops, retail, contracting, and SMEs.
ZATCA releases Phase 2 (Integration Phase) in waves. Each wave defines a group of VAT-registered businesses, based on annual VAT-taxable revenue, that must integrate their invoicing with ZATCA by a fixed date. Wave 25 is one of the later waves, and for many SMEs it is the point at which integration stops being "sometime soon" and becomes "now".
If your business is named in Wave 25, you cannot keep issuing Phase 1-style invoices. You must onboard your devices, generate UBL 2.1 XML, apply a cryptographic stamp, and clear or report every invoice through the ZATCA APIs.
This guide explains who is caught by Wave 25, how the threshold works, what the deadline means in practice, and a concrete readiness plan for the sectors that dominate later waves — clinics, restaurants, car workshops, retail, and general SMEs.
Who this applies to
Clinics & Medical Centers
Dental, dermatology, physiotherapy, and polyclinics — high volumes of simplified and insurance invoices.
Hospitals & Labs
Larger facilities with mixed B2B and B2C billing and complex insurance workflows.
Pharmacies
Retail medicine sales (simplified) plus wholesale supply to clinics (standard).
Restaurants & Cafés
POS-driven simplified invoices at the transaction level and B2B catering invoices.
Cloud Kitchens & Delivery
Aggregator and delivery-platform settlements that must map to compliant invoices.
Car Workshops & Garages
Repair, maintenance, parts, and insurance-claim invoices.
Car Dealerships & Rentals
Vehicle sales, leasing, and rental agreements.
Retail Stores & Supermarkets
High-volume B2C simplified invoices, often chain-wide.
eCommerce & Online Shops
Automated per-order invoicing requiring API integration.
Contracting & Fit-out
Progress billing and milestone invoices with retention.
Real Estate & Property Management
Rent, service charges, and commission invoices.
Professional & Consulting Firms
Legal, accounting, engineering, and marketing agencies.
Salons, Spas & Personal Care
Appointment-based B2C services with simplified invoices.
Gyms & Fitness Studios
Memberships, class packages, and retail sales.
Education & Training Centers
Tuition, course fees, and installment plans.
Hotels & Hospitality
Guest folios, F&B, and event invoices.
Logistics & Last-Mile
Delivery and freight charges billed per shipment.
Wholesale & Trading
B2B supply with standard invoices and credit notes.
How ZATCA waves work
ZATCA does not require every business to integrate at once. Instead, it groups businesses into waves by annual VAT-taxable revenue, highest first. Earlier waves covered the largest enterprises; later waves progressively cover smaller businesses.
Each wave has a defined scope and a go-live date. Once ZATCA announces a wave, the businesses in that tranche must be fully integrated by the stated date. There is no opt-out for being small.
- Waves are sequenced by annual VAT-taxable revenue.
- Each wave has a published compliance deadline.
- Businesses are notified through the Fatoora portal and official channels.
- Later waves bring SMEs, clinics, restaurants, and workshops into scope.
- Missing your wave deadline triggers penalties under the e-invoicing regulations.
Who is affected by Wave 25
Wave 25 targets the next revenue tranche below recent waves. In practice this means VAT-registered businesses that have so far been waiting on the sidelines — the sectors that make up the bulk of the SME economy.
Because the threshold is revenue-based, size is less important than taxable turnover. A single clinic group and a multi-branch restaurant chain can land in the same wave if their annual VAT-taxable revenue falls in the same bracket.
- VAT-registered businesses whose annual taxable revenue falls within the Wave 25 threshold.
- Sectors such as healthcare, F&B, automotive services, retail, contracting, and professional services.
- Businesses with POS terminals, ERP systems, or billing apps that emit invoices.
- Entities with multiple branches, each needing its own onboarding.
The Wave 25 deadline and what it means
The deadline is not "start planning" — it is "be live". By that date your systems must be able to onboard, sign, clear, and report invoices to ZATCA without manual intervention.
For most businesses the real work takes 6 to 12 weeks, so the effective start date is months before the deadline. Businesses that leave it late face rushed testing and a high risk of rejected invoices during the very period they are being audited.
- Go-live means real integration — not just generating a QR code.
- Plan 6–12 weeks for onboarding, integration, testing, and training.
- Allow buffer for sandbox rejections and bug fixes.
- Train finance and POS staff on the new flows before go-live.
Readiness plan: step by step
Treat Wave 25 compliance as a project, not a purchase. The steps below are the same ones high-performing finance and IT teams follow.
- Confirm your wave membership and exact deadline via the Fatoora portal.
- Audit every system that produces an invoice (ERP, POS, e-commerce, billing).
- Decide: integrate existing systems or add a dedicated e-invoicing layer.
- Register each device/EGS and generate a compliant CSR.
- Obtain the Compliance CSID and run sandbox tests across all invoice types.
- Validate QR TLV encoding, hash chaining, and UBL 2.1 XML.
- Request the Production CSID using the OTP from the portal.
- Implement retries, monitoring, and an archive for audit.
- Go live, then monitor rejection and warning rates closely.
Clinics, restaurants and workshops: sector notes
Later waves are dominated by service businesses with high transaction volumes and simple counter staff. Each sector has a specific pressure point worth planning for.
- Clinics: insurance vs. self-pay invoices, patient data privacy, and high daily volumes of simplified invoices.
- Restaurants: POS must emit simplified invoices instantly; delivery aggregators need mapping to ZATCA fields.
- Car workshops: parts + labour lines, insurance claims, and estimate-to-invoice linkage.
- Retail: chain-wide consistency, returns/credit notes, and ZATCA reporting within 24 hours.
- Contracting: progress billing with retention and multi-stage approvals.
- Professional services: recurring billing and retainer invoices reported accurately.
What happens if you miss the Wave 25 deadline
Missing a wave deadline means operating outside the e-invoicing regulations, which carries financial penalties and can escalate if uncorrected. Beyond fines, non-compliance disrupts B2B relationships, since buyers increasingly require cleared invoices.
The financially sensible move is to comply on time. The cost of integration is predictable; the cost of penalties, audits, and blocked payments is not.
- Fines apply for failure to issue or store compliant invoices.
- Penalties escalate for repeated or uncorrected violations.
- Buyers may refuse non-cleared standard invoices, delaying payment.
- Audit exposure increases when records are incomplete.
Frequently asked questions
What is ZATCA Wave 25?+
Wave 25 is a tranche in ZATCA’s Phase 2 (Integration Phase) rollout. It groups a set of VAT-registered businesses by annual VAT-taxable revenue and gives them a fixed deadline to integrate their invoicing systems with ZATCA.
Who is affected by ZATCA Wave 25?+
VAT-registered businesses whose annual VAT-taxable revenue falls within the Wave 25 threshold. In practice this includes many clinics, restaurants, car workshops, retail stores, contractors, and professional-service SMEs.
What is the revenue threshold for Wave 25?+
ZATCA publishes wave thresholds through official notifications and the Fatoora portal. Because thresholds are updated as the program progresses, businesses should confirm their exact bracket and deadline directly in the portal.
When is the ZATCA Wave 25 deadline?+
ZATCA sets a specific go-live date for each wave. By that date your systems must be fully integrated — onboarding, UBL 2.1 XML generation, cryptographic stamping, and clearance or reporting must all be live.
How do I know if I am in Wave 25?+
ZATCA notifies affected businesses through the Fatoora portal and official communication channels. You can also check your VAT-taxable revenue against the published wave threshold and confirm your status in the portal.
How long does it take to comply with Wave 25?+
Plan for 6 to 12 weeks. This covers system audit, CSR and CSID onboarding, sandbox testing across invoice types, integration work, and staff training. Starting early reduces the risk of rejected invoices at go-live.
Do small businesses in Wave 25 have to integrate too?+
Yes. Wave compliance is based on annual VAT-taxable revenue, not company size, and there is no exemption for being small. Once your business is in the wave, you must integrate by the deadline.
What happens if a Wave 25 business misses the deadline?+
Missing the deadline means operating outside the e-invoicing regulations, with financial penalties that can escalate for repeated or uncorrected violations. You may also face disrupted B2B payments and increased audit exposure.
Can clinics, restaurants and workshops use the same solution?+
Yes. A ZATCA integration layer can sit on top of any ERP, POS, or billing system. It ingests invoices, generates UBL 2.1 XML, applies the cryptographic stamp, and transmits to ZATCA — regardless of the underlying industry system.
Do I need to replace my POS or ERP for Wave 25?+
No. The recommended approach is to keep your existing POS or ERP and add an e-invoicing integration layer that handles XML generation, signing, clearance, reporting, and archiving. This is faster and less disruptive than a full replacement.
Topics covered
Related reading
Need help building this?
CODEXTERS designs and builds software across ERP and ERPNext, ZATCA e-invoicing compliance, AI and data platforms, SaaS products, and startup MVPs — for companies of every size.