ZATCA wave 25 covers businesses whose VAT-able revenue exceeded SAR 187,500 in any one of 2022, 2023, 2024 or 2025. They must connect their e-invoicing to ZATCA’s Fatoora platform by 1 February 2027. On Odoo, the connection itself is a standard module. The real work is onboarding, cleaning your data and fixing rejections.
The wave that reaches small businesses
ZATCA published the wave 25 criteria on 24 July 2026. The notice is short. Every taxpayer whose revenue subject to VAT exceeded SAR 187,500 during 2022, 2023, 2024 or 2025 is in. ZATCA will notify them to integrate their e-invoicing solutions with Fatoora by 1 February 2027. According to EY, a Governor’s decision setting the same date was published in the Official Gazette that day.
For scale: Phase 2 began on 1 January 2023 with businesses above SAR 3 billion. Wave 24, which closed on 30 June 2026, used a SAR 375,000 threshold. Wave 25 halves it. SAR 187,500 a year is roughly SAR 15,600 a month, so many small traders, workshops, clinics and service firms are in scope for the first time.
The wave 25 test looks back four years
One year over the line is enough. A business that dipped below SAR 187,500 in 2024 but crossed it in 2022 is in. EY points out that this is the first wave to count 2025 revenue, so a company set up in 2025 can be in scope from its first year. Check your VAT returns for all four years before you decide you are out.
Do not wait for ZATCA’s letter
ZATCA says it notifies each targeted taxpayer directly and announces each wave at least six months ahead. Today you have about three months left. Waiting for the letter spends the time you need for testing.
What “integrated” means on the day
Phase 1 asked you to produce electronic invoices with a QR code. Phase 2 makes ZATCA part of issuing them, in two different ways. Our earlier piece on what ZATCA Phase 2 takes on Odoo covers the design questions. Here is the short version.
- Standard tax invoices (B2B). Your system sends the XML to Fatoora for clearance. If it passes, ZATCA adds its cryptographic stamp and a QR code and sends the cleared XML back. The cleared version is what your customer receives.
- Simplified tax invoices (B2C). Your system stamps the invoice, adds a Phase 2 QR code, gives it to the customer, and reports the XML to Fatoora within 24 hours.
- Credit and debit notes follow the same route as the invoice type they belong to.
Each invoicing unit needs a Cryptographic Stamp Identifier (CSID). This is a certificate ZATCA issues during onboarding that links the unit to your VAT registration. In Saudi Arabia you connect to the authority’s own platform. The UAE is different: invoices travel through accredited providers in a five-corner model.
What Odoo already does for you
Odoo has its own ZATCA module, Saudi Arabia – E-invoicing (technical name l10n_sa_edi). It sits in Odoo’s main open-source repository under the LGPL-3 licence. We checked that it is there for versions 15 to 18, and Odoo’s version 19 documentation covers it too, along with a separate module for point of sale. So you do not need to buy a ZATCA connector for Odoo. From Odoo’s documentation and code, the module:
- has three modes: Sandbox (a shared test environment), Simulation (your own pre-production environment) and Production;
- onboards each sales journal separately, using a six-digit one-time password (OTP) from the Fatoora portal that expires after 60 minutes;
- behind the Onboard button, requests a compliance CSID, runs ZATCA’s compliance checks on six test documents (standard and simplified invoices, credit notes and debit notes), then obtains the production CSID;
- sends each confirmed invoice for clearance or reporting and shows ZATCA’s answer in the chatter: green for accepted, yellow for accepted with warnings, red for rejected;
- stores the XML on the invoice, where it cannot be deleted.
Two warnings in the documentation matter. Once you switch to Production and submit an invoice, you cannot switch back. And anything sent to the real Fatoora portal counts, so test in Simulation on a copy of your live database first.
Hosting matters less than people expect. The module is part of standard Odoo. Where hosting matters is the fixes: Odoo Online is limited to configuration and Studio, so if your invoices need custom code to pass, that work needs Odoo.sh or a self-hosted install.
Not sure your Odoo data will pass onboarding?
Tell us your Odoo version, how many companies and sales journals issue invoices, and whether you use point of sale. We will tell you what to fix before you generate a single OTP.
Get Your Odoo CheckedThe onboarding checklist, in the order it breaks
Most Odoo ZATCA projects do not fail on the connection. They fail on a field nobody filled in. Go through this list before you touch the Fatoora portal.
1. Your company record
Odoo’s documentation lists what ZATCA needs: a company name of no more than 63 characters, a full address including district, building number and plot identification, an identification scheme (the commercial registration number is the usual choice), the VAT number, and SAR as the currency. Onboarding reads the VAT number from here, so get it right first.
2. Your customers
Business customers need the same: VAT number, address and an identification scheme. The commonest mistake is typing the 15-digit VAT number into the “other buyer ID” field with the scheme TIN. Since ZATCA’s SDK 3.4.4 in August 2025, a TIN must be exactly 10 digits and start with 3, so that returns warning BR-KSA-F-07. The VAT number belongs in the buyer VAT field. The same release checks other schemes too: a commercial registration number is 10 digits, a national ID starts with 1 and an iqama with 2.
3. Branches and journals
A branch uses the parent company’s VAT number with its own commercial registration number. You can invoice through one onboarded journal or onboard one per branch. Every sales journal that issues invoices must be onboarded, including the one your point of sale uses. If a journal is retired, revoke its CSID in the Fatoora portal.
4. Taxes
A 0% tax needs an exemption reason code on the tax itself. A global discount line must carry the 15% tax. Retention has its own documented setup.
5. Credit and debit notes
Each one needs a ZATCA reason from the approved list. A note that is not raised from the original invoice needs the original invoice number in the Customer Reference field.
Reading the rejections in your first weeks
Expect some. What helps is knowing which kind you are looking at.
certificate-permissions
ZATCA’s message says you may only use the VAT number in the authentication certificate. In plain terms, the VAT number on the invoice does not match the one the journal was onboarded with. It typically happens when a test VAT number (Odoo’s documentation suggests 399999999900003 for Sandbox) or an old VAT number was in place at onboarding. The fix is to re-onboard the journal with a fresh OTP, not to edit the invoice.
Rounding and totals
Rules such as BR-CO-15 and BR-S-09 compare totals and VAT amounts. The guidance in ZATCA’s developer community is to round VAT at document level, not to add up rounded line amounts. In Odoo, compare the tax rounding method in Accounting settings with what the XML shows, especially on long invoices and invoices with discounts.
Warnings that pass today
A 202 response means accepted with warnings. Odoo’s documentation notes that warnings may become rejections later and that frequent warnings may draw ZATCA’s attention. Fix the master data now.
The journal that will not move
Each invoice carries the hash of the one before it in the same journal, so invoices go in order. If a submission times out, the invoice stays pending, and Odoo will not re-onboard the journal until pending invoices are sent. Only rejected invoices can be reset to draft, corrected and retried.
Fines, and why the amnesty will not save you
ZATCA’s e-invoicing fines escalate with repetition. When it published them, ZATCA said not issuing e-invoices starts at SAR 5,000, deleting or amending an e-invoice after issue starts at SAR 10,000, and some violations, such as a missing QR code or buyer VAT number, start with a warning.
The fines-exemption initiative now runs to 31 December 2026, but do not plan around it. It ends a month before your deadline. ZATCA’s announcement says it excludes fines under Article 45 of the VAT Law, and it does not cover returns due after 30 June 2026. Some adviser summaries list e-invoicing fines as covered; ZATCA’s own wording is narrower, so get your adviser’s view in writing.
Where outside help is worth paying for
We do not sell a ZATCA product. Odoo’s module is what talks to ZATCA, and we are not certified by ZATCA. We are a software company that has been building since 2009, with teams in the UAE, the US and India. Where we help is the work around the module: cleaning customer and tax data before onboarding, running a Simulation cycle on a copy of your database, fixing custom invoice layouts or custom modules that break the XML, and working through rejections in the first weeks. That is part of our Odoo support and maintenance work.
If you run standard Odoo with clean data and one sales journal, you may not need anyone: test in Simulation, compare Fatoora’s received-invoice figures with Odoo, and go live. Once your invoices pass, our pages on AI agents in Saudi Arabia and the Odoo AI CRM cover what comes after compliance.
A six-step plan for the next three months
- Pull your VAT-able revenue for 2022 to 2025 and confirm with your tax adviser whether you are in wave 25.
- List every place that issues invoices: each Odoo company, each sales journal, each point of sale, and anything outside Odoo.
- Clean the company, customer, branch and tax records against the checklist above.
- Copy your live database, switch the copy to Simulation, onboard each journal, and run every invoice type you use, including credit notes, discounts and zero-rated sales.
- Fix every warning, not only the rejections.
- Onboard the production journals with fresh OTPs well before 1 February 2027, and decide who owns the daily rejection queue.
Nothing here is tax or legal advice. ZATCA’s resolutions and your tax adviser decide your scope and your dates.