ZATCA Wave 25 for Small Businesses: Connect to Fatoora Before 1 Feb 2027
Vendor module
POS / ERP that already does Phase 2
Build direct
Your team owns UBL, CSID, Fatoora
Esnad API
POST JSON — we handle the link
Wave 25 is built for businesses that are not enterprise IT
Wave 25 brings Phase 2 to taxpayers over SAR 187,500 VAT-subject revenue (any of 2022–2025). Many of those businesses have:
- One or two branches
- A POS, Excel, or accounting package — not a platform team
- A deadline of 1 February 2027
ZATCA still requires the same technical bar as large enterprises: Fatoora integration, UBL XML, CSID, clearance/reporting.
Three ways a small business can integrate
1. Ask your POS / ERP vendor
If your software vendor already ships Phase 2 clearance and reporting (not QR-only), enable it, complete Fatoora OTP, and test in sandbox. Ask in writing: “Do you clear B2B with Fatoora and report B2C within 24 hours?”
2. Build Fatoora APIs yourself
Possible if you have developers. Budget weeks to months for keys, CSR OIDs, PIH, TLV QR, retries, and certificate renewal. Guide: Fatoora API integration.
3. Use a ZATCA middleware API (Esnad)
You keep your POS or billing UI. The backend POSTs JSON; Esnad builds XML, signs, talks to Fatoora, returns UUID + QR, archives production XML, and retries when Fatoora is slow.
Typical Wave 25 setup:
- Request a 14-day sandbox
- Create one EGS (one shop = one unit in most cases)
- Paste a Fatoora OTP (valid ~5 minutes)
- Send a test simplified invoice, then a standard invoice
- Go live with
zatca_live_keys before January 2027
Explore the dashboard demo first — no signup.
What you still do in the Fatoora portal
Middleware does not replace Fatoora login. You still:
- Confirm Wave 25 / 1 February 2027 on your account
- Generate OTP for onboarding and yearly CSID renewal
- Keep VAT, CR, and address aligned with what you send on invoices
Portal walkthrough: Register on Fatoora.
Cost of waiting until January 2027
- Developer or vendor calendars fill up as the date approaches
- First production CSID + compliance invoices take calendar time, not an afternoon
- Penalties start from the deadline, not from “when we found a vendor”
Checklist for a one-location Wave 25 business
- Confirmed in Fatoora that you are Wave 25 (or earlier)
- VAT-subject revenue check for 2022–2025 (eligibility article)
- Integration path chosen (vendor / in-house / Esnad)
- Sandbox invoices clearing and reporting
- Production CSID on the live EGS
- Staff know not to send uncleared B2B invoices
- Live before 1 February 2027
Skip the boilerplate. Use Esnad API.
The fastest way to integrate ZATCA compliance into any system.