ZATCA Wave 24: The 30 June 2026 SME Compliance Deadline — What You Must Do Now

If your business received a ZATCA notification placing it in Wave 24, you have until 30 June 2026 to be live on Phase 2 Integration — the full Fatoora clearance and reporting model. As of this post's publication, that is roughly 20 days. This guide covers exactly who is in scope, what Phase 2 Integration adds on top of Phase 1, and what a realistic go-live plan looks like with Odoo.

Who is in scope for ZATCA Wave 24?

Wave 24 covers taxpayers whose annual VAT-exclusive revenues equal or exceed SAR 375,000. ZATCA determines inclusion based on the VAT-return data it holds — businesses do not self-select. If ZATCA notified you, you are in Wave 24. If you have not yet received a notification but your taxable supplies line on your most recent VAT return is at or above SAR 375,000, expect a notification for this or an imminent wave.

You are already Phase 1-compliant — what does Phase 2 add?

Every VAT-registered business in Saudi Arabia has been Phase 1-compliant since December 2021. Phase 1 means you issue e-invoices with a QR code and store them digitally — no real-time connection to ZATCA is required. Phase 2 Integration is a fundamentally different technical layer: your invoicing system must connect to ZATCA's Fatoora portal in real time and receive a cryptographic clearance stamp on every B2B invoice before it reaches the buyer. The table below maps the exact delta.

The five technical requirements for Phase 2 Integration

Phase 2 Integration has five hard technical requirements. All five must be working in production — not sandbox — before 30 June 2026. Odoo's Saudi localisation module (`l10n_sa_edi`) covers every requirement natively; the work for a Wave 24 business is configuration and go-live execution, not custom development.

1. UBL 2.1 XML with Saudi extensions. Every invoice must be structured as a valid UBL 2.1 XML document including ZATCA's Saudi-specific field extensions — seller/buyer TIN, VAT registration number, invoice-type flag, line-level tax codes. Odoo generates this from the standard invoice form, but custom invoice lines with Arabic free-text fields must be pre-validated against the schema to avoid clearance failures on day one.
2. ECDSA cryptographic stamp — CSID. Each invoice must carry a digital signature generated from your ZATCA-issued PKI certificate (CSID). Odoo manages the full CSID lifecycle: CSR generation, Compliance CSID (sandbox), and Production CSID (live signing). For a Wave 24 go-live, the Production CSID must be requested, installed, and tested in production before the deadline.
3. Real-time B2B clearance via Fatoora. B2B invoices must be submitted to ZATCA's Fatoora portal before delivery to the buyer. The portal stamps the invoice and returns the cleared XML; your ERP must store both the cleared XML and ZATCA's clearance response for the 7-year retention requirement. Odoo submits and stores this automatically once the CSID and endpoint are correctly configured.
4. B2C reporting within 24 hours. B2C invoices are issued to the customer first, then reported to Fatoora within 24 hours. The 24-hour window is a hard compliance requirement. Odoo handles this via a background job that must be enabled and actively monitored in production — not a set-and-forget step.
5. Correct B2B vs B2C customer classification. ZATCA applies a different legal model to each type. Mis-classifying a B2B customer as B2C — routing a clearance-model invoice to the reporting endpoint — is the most common Phase 2 violation and generates a rejection chain that accumulates per invoice. This is set at the Odoo partner master record, not at the invoice level.

The Wave 24 go-live sequence with Odoo — and what blocks each step

With 20 days to the deadline, the critical path is tight. The table below is iWesabe's minimum-viable go-live plan for a Wave 24 Odoo deployment — ordered by dependency, because some steps block the next and cannot be parallelised. Working-day estimates assume a dedicated implementation partner; an internal IT team working part-time will need to add buffer.

What happens if you miss the 30 June 2026 deadline?

ZATCA enforces Phase 2 compliance through a tiered penalty schedule that escalates from warning to material financial penalty. Missing the go-live deadline — or going live with a non-compliant configuration — creates an ongoing exposure that accumulates per invoice, not per filing period. Three areas generate the majority of real-world penalties for Wave 24 businesses: issuing a B2B invoice that was not cleared by Fatoora before delivery, failing to report a B2C invoice within the 24-hour window, and filing a VAT return where the totals do not reconcile against the cleared-invoice record.

Wave 24 is not a technology problem — Odoo's Saudi localisation has covered the Phase 2 technical chain since the programme began in 2023. It is a time-pressure problem: roughly 20 days to execute a five-step go-live sequence that takes a dedicated implementation partner 4–5 working days. The businesses that miss the deadline are typically not the ones that lack the right ERP; they are the ones that start the CSID path in the week before the deadline, when the ZATCA sandbox queue and compliance-check cycle consume the remaining time.

iWesabe has run Phase 2 go-lives across multiple ZATCA waves for Saudi businesses in construction, trading, retail, services, and distribution. A Wave 24 readiness call takes 30 minutes: we confirm your l10n_sa_edi configuration, generate the CSR together, and send you the go-live sequence with owner-assigned steps. That call can happen today.

iWesabe Editorial Team

Practitioner insights on Odoo ERP, ZATCA compliance, and Saudi enterprise digital operations — written by iWesabe's consulting, finance, and engineering teams.

About iWesabe