The SAR 375,000 threshold — what ZATCA Phase 2 Wave 24 actually asks of Saudi SMEs, and why most of them are being quietly over-sold.

01 / The PositionWave 24 is a small invoice problem dressed up as a transformation project.

The Saudi Wave 24 cohort is the smallest population ZATCA has ever asked to integrate. The threshold is SAR 375,000 in VAT-taxable revenue across any of 2022, 2023, or 2024. A business in this band issues — at most — a few hundred invoices a month. The technical requirement is real. The transformation programme being sold around it is not.

The Phase 2 specification has not changed since it was published. Standard tax invoices clear with ZATCA before they reach the buyer. Simplified tax invoices are reported within 24 hours of issue. Both carry a UUID, a hash chain, a QR code, and a Production CSID issued against the seller's tax registration. That is the engineering. Everything else attached to it — the project plans, the change-management workshops, the quarterly retainers — is implementation overhead the small SME does not need.

The reason the market reads otherwise is that Phase 2 was designed for the Wave 1 enterprise tier first, and the implementation playbooks that work at SAR 3 billion in revenue have been quietly recycled down the wave schedule without rescaling. By the time the methodology reached the SAR 375k cohort, it carried 18 months of consulting margin baked into a six-week problem.

02 / Who Wave 24 CapturesThe population is more specific than the threshold suggests.

The SAR 375,000 figure is a revenue threshold, not an invoice-volume threshold. The businesses inside Wave 24 share a profile:

• Single-location or low-multi-location retail, F&B, or professional services — the typical operator has between 1 and 6 sites
• Revenue concentrated in B2C with a smaller B2B tail — most invoices are simplified, a minority are standard
• An existing accounting stack that is already Phase 1 compliant — Zoho Books, Wafeq, Qoyod, Daftra, Foodics, Salla, Zid, or an ERP module — the Phase 2 question is whether the stack supports it natively or needs a middleware layer
• A finance function of one to three people, often led by an external accountant rather than an in-house controller

That last point matters. The buyer for Wave 24 implementation is rarely a CFO. It is a founder, a managing partner, or an operations director who is being shown the quote by their bookkeeper. The asymmetry between buyer and seller is the whole reason the over-quoting works.

03 / What ZATCA Actually RequiresThe technical scope, decomposed.

There are six things Wave 24 must produce by 30 June 2026. Not seven, not twelve. Six.

1. A Compliance CSID for sandbox testing. Generated against the seller's tax registration through the ZATCA portal. This is free, takes under 30 minutes, and is reversible — sandbox CSIDs can be regenerated without consequence.
2. Three documented sandbox flows. One Standard Tax Invoice, one Simplified Tax Invoice, one credit note referencing a previously cleared invoice. Each must produce a valid UUID, a correct hash chain back to the previous invoice, a scannable QR code, and a successful clearance or reporting response from the ZATCA endpoint.
3. A Production CSID for go-live. Generated only when the sandbox flows are confirmed clean. Production CSIDs are tied to specific invoicing devices or environments, and renewal is on a 12-month or earlier cycle depending on configuration.
4. A parallel run. 10 to 15 invoices issued in production through the new flow, reconciled against the pre-Phase-2 flow, with the daily clearance log reviewed for rejections, retries, and timing breaches.
5. A B2C offline contingency. Simplified tax invoices have a 24-hour reporting window. The contingency must specify what happens if the ZATCA endpoint is unreachable at the moment of sale — typically a queue-and-retry pattern at the POS.
6. A CSID renewal calendar. Most Phase 2 failures in 2025 were not first-time integration failures. They were CSID expiries that rolled over without anyone noticing.

That is the entire technical scope of a Wave 24 engagement. It is six artefacts, all of which are produced by configuring a vendor stack the client almost certainly already owns — not by writing custom code, not by procuring middleware, and not by replacing the ERP.

04 / The Three QuotesWhat the market is charging, and what it represents.

I have seen three quote bands in the market for Wave 24 implementation in Q1 and Q2 2026. They are not equivalent.

Band 3 is where the over-selling lives. The quote is not fraudulent — there is real work proposed inside it. But the work is sized for a client who is not the client in front of you. A SAR 500,000 retail operator does not need a change-management workstream to teach their two-person finance team how to issue an invoice through a button that already exists in Zoho Books.

05 / The Wave 23 Penalty WindowIf you missed 31 March 2026, the conversation has already shifted.

Wave 23 — SAR 750,000 and above — went live on 31 March 2026. Operators who missed that deadline are now in the penalty band, and the conversation about their integration is no longer about cost-of-implementation. It is about cost-of-exposure under the Cancellation of Fines amnesty window.

The amnesty mechanism allows for partial or full waiver of penalties on first-time non-compliance, conditional on remediation within a specified window and a clean filing posture going forward. It is administered case by case. It is not a default.

Two practical points for any operator in the Wave 23 remediation band:

• The amnesty window is finite and the application is technical. It is not enough to integrate Phase 2; the application has to evidence the integration date, the parallel-run record, and a clean clearance log going forward
• The fee for Wave 23 remediation is structurally higher than Wave 24 implementation — typically SAR 25,000 to 35,000 — because the work includes the penalty-exposure assessment and the amnesty-window paperwork, not just the technical onboarding

06 / The Five Pre-Quote DiagnosticsWhat the founder should answer before requesting any quote.

Before any vendor or practitioner is asked to price a Wave 24 engagement, the founder should know the answer to five questions. The answers determine whether the engagement is Band 1, Band 2, or — rarely — outside Wave 24 altogether.

1. What was your VAT-taxable revenue in 2022, 2023, and 2024? The wave classification rule reads to the highest of the three years. If any of the three crossed SAR 1.0 million, you are likely already in a prior wave.
2. What is your current invoicing stack? If the answer is a ZATCA-certified SaaS — Zoho Books, Wafeq, Qoyod, Daftra, Foodics, Salla, Zid — the engagement is configuration, not integration. If the answer is "Excel" or a legacy ERP without a certified Phase 2 module, the engagement is materially different.
3. How many invoicing touchpoints exist? Count POS terminals, e-commerce checkouts, manual back-office invoicing, self-billing arrangements, and credit-note flows. The work scales with touchpoints, not with revenue.
4. Do you issue any foreign-currency invoices, or any invoices to government or VAT-exempt buyers? Both add specific reporting requirements that affect the test-flow scope.
5. Who renews the CSID in March 2027? If no one in the finance function can answer this without checking, the engagement is not done at go-live. The renewal calendar is the deliverable that prevents the second-year failure.

07 / The RefusalWhere Daftar will not work.

This brief is not a sales document for an unbounded service. The practice has a defined Wave 24 engagement — six weeks, fixed scope, fixed fee — and an equally defined set of cases where it should not be the engagement.

• Custom middleware build. If the client's flow genuinely requires a self-billing engine at volume, multi-ERP consolidation, or bespoke integration code, the work is for an integrator — InvoiceQ, ClearTax SA, or ecosio — not for a single practitioner
• ZATCA representation on penalty appeals. A licensed ZATCA representative is required for any penalty proceeding. Daftar is not licensed for this and will not pretend otherwise
• ERP replacement. If the underlying ERP cannot support Phase 2 without being replaced, the engagement is an ERP project, not a Phase 2 project. The right next step is an ERP implementation partner, with Phase 2 as the second engagement after the ERP is stable

08 / The Daftar EngagementWhat the practice does, scoped.

The engagement is sized to the actual problem. The fee is published. The scope is on a one-page engagement letter, with a numbered exclusions list and a change-order mechanism. There is no retainer attached, no upsell to middleware, and no ERP migration in disguise.