ZATCA-Compliant Accounting Software in Saudi Arabia: Full 2026-2027 Checklist

If you're choosing accounting software in Saudi Arabia today, ZATCA e-invoicing (Fatoorah) compliance isn't optional and it isn't a future concern — it's a current buying requirement. Phase 2 is now reaching businesses with revenue above just SAR 187,500, the next deadline is 1 February 2027, and the standard tax amnesty running through the end of 2026 does not cover e-invoicing fines. This guide is the full checklist for what compliant software actually needs to do, so you can evaluate any system — including RUKN — against real requirements rather than a marketing claim.

Everything below was checked against ZATCA's own pages and PDFs on 23 September 2026, refreshed 24 September 2026. Sources are listed at the end.

Key takeaways

• Phase 2 (Integration) is what to look for. It means real-time connection to ZATCA's Fatoora platform, a ZATCA-issued cryptographic stamp, and clearance or reporting on every invoice. Software that only shows a basic QR code is Phase 1, not Phase 2.
• Wave 25 is the current deadline. Businesses with VAT-taxable revenue above SAR 187,500 in 2022-2025 must be integrated by 1 February 2027. If your revenue passed SAR 375,000 or SAR 750,000 in those years, your deadline has already passed.
• E-invoicing fines are excluded from the 2026 tax amnesty. Don't assume you have breathing room — ZATCA has stated this in writing.
• A SAR 2,500 government subsidy exists toward compliant software for businesses under SAR 3 million in revenue.
• There is no official "approved" badge to check for. What you should verify instead is covered in the checklist and vendor questions below — this is the one thing most vendor pages get wrong, and it's worth two minutes to get right before you sign anything.

Already know you need Fatoorah-compliant software and want to skip ahead? Get a RUKN quote and bring your VAT-taxable revenue for the last three years — we'll confirm your wave and walk through the checklist below together.

Table of contents

1. Why this is urgent right now
2. The buying checklist: what compliant software must do
3. Phase 1 vs Phase 2: know which one you're actually buying
4. One thing to check before you sign: there's no official "approved" list
5. 12 questions to put to any vendor, RUKN included
6. How RUKN's Compliance & Controls answers this checklist
7. The 2026-2027 wave schedule, and which wave applies to you
8. Penalties: the real numbers
9. The 2026 tax amnesty does not cover e-invoicing fines
10. Record retention
11. The SAR 2,500 subsidy most small businesses don't know about
12. Native compliance or a connector
13. Frequently asked questions
14. Sources

Why this is urgent right now

If your VAT-taxable revenue has passed SAR 187,500 in any year from 2022 to 2025, you're inside Wave 25, and your legal deadline to be fully integrated with ZATCA's Fatoora platform is 1 February 2027. If your revenue passed SAR 375,000 or SAR 750,000 in those years, your deadline was 30 June 2026 or 31 March 2026 — both already behind you, which means non-compliance today, not next year.

Two things make this more urgent than it might look. First, the 2026 tax amnesty that many businesses are counting on for breathing room explicitly does not apply here — ZATCA has stated in writing that e-invoicing fines are excluded from it. Second, the penalties are not trivial: failing to integrate by your deadline, or issuing an invoice that doesn't meet the requirements, can escalate to fines of up to SAR 50,000.

The practical takeaway: if you're evaluating accounting software right now, e-invoicing compliance shouldn't be a feature you check at the end. It should be the first thing you confirm, because it's the one requirement with a hard legal deadline and a real financial penalty attached.

The buying checklist: what compliant software must do

Use this as your shortlist filter. Any accounting or ERP system you're seriously considering for Saudi Arabia should be able to demonstrate every item here, not describe it — demonstrate it, live, in a demo or trial.

It should generate every invoice as structured data, not a scanned image or a Word or Excel document: XML built on the UBL 2.1-based standard, or PDF/A-3 with that XML embedded. It should make it structurally impossible to edit or delete an issued invoice — corrections happen only through electronic credit or debit notes. It should assign a sequential Invoice Counter Value to every invoice with no gaps, and chain each invoice to the one before it with a Previous Invoice Hash, so your invoice history can't be quietly rewritten.

It should have already completed onboarding with ZATCA: a Certificate Signing Request, a Compliance CSID, passed simulation testing, and a Production CSID actively in use, not "in progress." Every invoice should carry a cryptographic stamp from that CSID. It should generate a compliant QR code — Base64-encoded, Tag-Length-Value structured, carrying the seller's name, VAT number, timestamp, totals, and, for Phase 2 specifically, the cryptographic stamp and hash.

It should submit standard business-to-business and business-to-government invoices for clearance, meaning ZATCA approves them before they reach your buyer, and report consumer invoices within 24 hours. It should restrict and log access properly, with every user individually identifiable and an audit trail that can't be edited after the fact. It should issue genuinely bilingual invoices, with real Arabic support rather than a translated label on an English layout. And it should archive your invoices in a way that keeps them retrievable and unaltered for the full retention period, covered later in this guide.

If a vendor's demo skips straight from "here's our invoice screen" to "and here's the QR code" without ever showing you a CSID or a clearance response, ask to see those two things specifically before you go further.

Phase 1 vs Phase 2: know which one you're actually buying

This distinction is where a lot of buying decisions go wrong, because Phase 1 compliance is easy to demonstrate and gets marketed heavily, while Phase 2 is the part with the real deadline.

Phase 1, the Generation Phase, has applied to every VAT-registered business since December 2021. It just requires a structured electronic invoice instead of a handwritten, Word, Excel, or scanned one, plus a basic QR code on consumer invoices. Almost any modern accounting software clears this bar.

Phase 2, the Integration Phase, is what your wave deadline actually requires: a live connection to ZATCA's Fatoora platform, a ZATCA-issued cryptographic stamp, and one of two invoice flows depending on type. Standard invoices go through clearance — approved by ZATCA before the buyer ever sees them. Simplified consumer invoices go through reporting — issued immediately, reported to ZATCA within 24 hours. Phase 2 also adds the sequential counter and hash-chaining described above, which Phase 1 doesn't require at all.

When a vendor says "we're e-invoicing compliant," ask which phase they mean. A truthful answer distinguishes the two. A vague answer usually means Phase 1 only.

One thing to check before you sign: there's no official "approved" list

Here's a detail worth two minutes of your attention, because it changes what you should actually be checking for. ZATCA's own Solution Providers Directory carries a disclaimer stating the list is "a guiding list (non-legally binding to taxpayers)" and is "not considered as an approval by ZATCA of the e-solutions provided." In other words, being on that list isn't a certification, and being off it doesn't mean a vendor is non-compliant.

This matters at the exact moment you're comparing vendors, because most of them — including some direct competitors we checked while researching this guide — market themselves as "ZATCA-approved" or "officially approved by ZATCA." That phrase describes marketing, not a status you can verify. What you can verify is compliance with ZATCA's actual technical requirements: the E-Invoicing Regulation, the Detailed Guidelines, and the Security Features Implementation Standard. A vendor either meets those or doesn't, regardless of what badge sits on their homepage.

So don't ask "are you ZATCA-approved." Ask the vendor to show you a working Compliance CSID and a successful test submission to ZATCA's simulation portal. That's the real proof — see the full question list next.

12 questions to put to any vendor, RUKN included

Bring this list to every demo. Any vendor confident in its compliance should be able to answer all twelve without hesitation, and should welcome you asking.

Can you show me a live Compliance CSID and a completed simulation test on ZATCA's developer portal? Is clearance for standard invoices handled in real time inside your own product, or does it depend on a separate connector? How do you generate and verify the Previous Invoice Hash chain, and what happens if that chain breaks? What happens in your system when ZATCA rejects an invoice at clearance — can I see the rejection reason and resubmit?

How does the system stop a user from editing or deleting an issued invoice? Which fields does your QR code actually carry? Do you support both the clearance flow for B2B/B2G and the 24-hour reporting flow for B2C natively? Is your Arabic invoice output a genuine bilingual template, or a translated label on an English layout?

How and where are e-invoices archived, and for how long? Can I export them on demand for a ZATCA audit? If I'm on a global platform like Xero or QuickBooks, do you connect through a certified local connector, and who's responsible if a submission fails? And if my wave deadline is inside the next 90 days, what does your onboarding timeline realistically look like?

Want the short version? Ask RUKN these 12 questions directly — we'd rather answer them in a call than have you guess from a features page.

How RUKN's Compliance & Controls answers this checklist

RUKN's Compliance & Controls capability is built to answer the checklist above directly, not as a general "we're compliant" claim. It covers six specific things worth checking one by one against what you just read.

ZATCA e-invoicing (Fatoorah) compliance is the core of it — the capability aimed squarely at the Phase 1 and Phase 2 requirements walked through above. VAT reporting and submission handles the filing side that runs alongside e-invoicing, since a business can technically produce compliant invoices and still fall short on its actual VAT returns if the two aren't connected in the same system. Secure user authentication and data encryption and protection map directly to the "no anonymous use, no silent edits" requirement in the buying checklist — every user identifiable, every action logged. Compliance audit reports give you the paper trail a ZATCA audit, or your own accountant, would ask for. And regulatory update notifications matter more than they sound: ZATCA has revised its technical standards multiple times and rolled out 25 waves so far, and a system that flags changes is worth more than one that quietly falls behind.

This is also why the checklist and the 12 questions above aren't just background reading — they're exactly what we'd expect you to ask us. Bring your VAT-taxable revenue for the last three years, and a RUKN specialist will confirm your wave, walk through the checklist point by point, and show you a live Compliance CSID rather than describe one.

Get a RUKN quote or explore RUKN's Compliance & Controls capability to see it against your own numbers.

RUKN suits small and growing Saudi and Gulf businesses that want VAT, sales, purchasing, inventory, and reporting connected in one system, with e-invoicing compliance built in rather than bolted on. A large enterprise already deep into an existing SAP or Oracle e-invoicing project should weigh that against switching costs first.

The 2026-2027 wave schedule, and which wave applies to you

Phase 2 rolls out in waves defined by a business's VAT-taxable revenue in past years, and ZATCA notifies each wave at least six months before its deadline. The threshold has fallen steadily: Wave 1 covered businesses above SAR 3 billion from 1 January 2023. By Wave 6, it had dropped to SAR 70 million, effective 1 January 2024. Wave 13 reached SAR 7 million by 1 January 2025. Wave 23 brought in businesses above SAR 750,000 in revenue during 2022-2024, deadline 31 March 2026. Wave 24 lowered the bar to SAR 375,000 for the same years, deadline 30 June 2026.

The current wave, Wave 25, was announced on ZATCA's own news page on 24 July 2026. It covers any taxpayer whose VAT-taxable revenue exceeded SAR 187,500 during 2022, 2023, 2024, or 2025, with an integration deadline of 1 February 2027. This is the lowest threshold ZATCA has set so far, and since the standard mandatory VAT registration threshold is SAR 375,000 (with voluntary registration from SAR 187,500), Wave 25 now reaches deep into the small and even micro-business population.

To place yourself: if your revenue exceeded SAR 750,000 in 2022-2024, you're in Wave 23, already past deadline. Above SAR 375,000 in the same years, you're in Wave 24, also past deadline. Above SAR 187,500 in 2022-2025, you're in the current Wave 25, deadline 1 February 2027. Below that across all those years, you're not yet caught by a Phase 2 wave, though Phase 1 has applied since 2021 regardless, and a future wave reaching lower thresholds is a reasonable expectation.

As a concrete illustration: a trading company with SAR 420,000 in 2023 revenue exceeds SAR 375,000, so it fell into Wave 24 with a deadline already passed — meaning it's out of compliance today if it hasn't integrated. A consultancy with SAR 220,000 in 2024 revenue exceeds SAR 187,500, placing it in Wave 25 with a deadline of 1 February 2027 still ahead. A sole trader around SAR 150,000 across 2022-2025 sits below even the Wave 25 threshold, so only Phase 1 applies for now.

Penalties: the real numbers

E-invoicing violations use a progressive penalty ladder: a warning on the first offence, then escalating fines within a rolling 12-month window specific to each violation type. Failing to issue a compliant invoice, or failing to integrate by your wave deadline, can both escalate to fines of up to SAR 50,000. Deleting or modifying an invoice after issuance starts at SAR 10,000 for the first fined occurrence and climbs toward the same ceiling. Lighter issues, like a missing QR code, typically start with a warning. General VAT field-control and record-keeping violations sit on a gentler ladder, from around SAR 1,000 up to roughly SAR 40,000 after repeated offences.

The detail most guides get wrong: each violation type has its own 12-month window, and a violation only escalates if it recurs within that window — it isn't a lifetime count for the business as a whole.

The 2026 tax amnesty does not cover e-invoicing fines

ZATCA's Cancellation of Fines and Exemption of Financial Penalties Initiative runs through 31 December 2026, but its own announcement explicitly excludes fines under Article 45 of the VAT Law — the article that governs e-invoicing violations. ZATCA's own 29 June 2026 announcement states the initiative "strictly excludes penalties related to tax evasion violations, fines imposed under Article 45 of the VAT Law, and fines paid prior to the effective date of this initiative." If you're behind on e-invoicing compliance, this amnesty will not protect you — it covers late registration, late payment, late filing, and return corrections, and even those require paying all outstanding principal tax first.

Record retention

VAT invoices and supporting records generally need to be kept for at least six years from the end of the relevant tax period, extending to eleven years for records connected to real property. Businesses keeping records outside Saudi Arabia must maintain an in-Kingdom terminal through which those records can be accessed on request. Factor this window into how you choose a system's archiving, rather than assuming a vendor's default retention matches it.

The SAR 2,500 subsidy most small businesses don't know about

A government subsidy of SAR 2,500 is available toward a compliant e-invoicing subscription, for small businesses, claimed once per business. To qualify, annual revenue needs to stay at or below SAR 3 million, the business needs a valid commercial registration and a base in Saudi Arabia, and it can't have received this support before. The application runs through the "E-Invoicing Support Request" form inside the ZATCA taxpayer portal. Ask any vendor you're evaluating whether they're set up to receive this subsidy through their invoicing flow — it can meaningfully offset your first year of switching.

Native compliance or a connector

Two honest paths exist. Native Phase 2 compliance means the accounting or ERP system itself handles CSID onboarding, clearance and reporting, hashing, and QR generation as built-in functionality — usually simpler day to day, at the cost of depending entirely on one vendor's roadmap. The alternative is keeping a global platform like Xero or QuickBooks and adding a certified connector that performs the ZATCA-specific steps on top of it, which can make sense if you're locked into that platform for other reasons, but adds a second vendor relationship and typically a separate monthly cost. Neither path is "more approved" than the other — what matters is whether the combination, tested end to end, produces a cleared or reported invoice with a valid CSID stamp every time.

Frequently asked questions

What does "ZATCA e-invoicing (Fatoorah) compliance" actually mean for software? It means the software can generate structured XML invoices, apply a ZATCA-issued cryptographic stamp, chain invoices together with sequential counters and hashes, and — for Phase 2 — connect live to the Fatoora platform for clearance (B2B) or 24-hour reporting (B2C). See the buying checklist above for the full list.

Is there an official list of ZATCA-approved accounting software? No. ZATCA's Solution Providers Directory states plainly that it's a non-binding, indicative list and "not considered as an approval." Software is compliant if it meets ZATCA's technical requirements, whether or not it appears on that list. Verify compliance directly using the 12 questions above instead.

What is ZATCA Wave 25 and when is the deadline? Wave 25, announced 24 July 2026, covers businesses whose VAT-taxable revenue exceeded SAR 187,500 in 2022-2025. Affected businesses must integrate with Fatoora by 1 February 2027.

What happens if I miss my ZATCA integration deadline? It's a fined violation, starting with a warning and escalating to fines up to SAR 50,000, within a rolling 12-month window per violation type.

Does the 2026 tax amnesty cover e-invoicing penalties? No. It runs through 31 December 2026 but explicitly excludes fines under Article 45 of the VAT Law, which governs e-invoicing.

How long must I keep e-invoices and VAT records? At least six years from the end of the relevant tax period, eleven years for real-estate-related records.

Can I use QuickBooks or Xero and still be ZATCA compliant? Only paired with a certified connector performing the ZATCA-specific steps. The base global product alone doesn't meet Phase 2 requirements.

Is there financial help for small businesses adopting compliant software? Yes — a SAR 2,500 subsidy, once per business, for companies with revenue up to SAR 3 million, via the ZATCA taxpayer portal.

What does RUKN's Compliance & Controls capability include? Six things: ZATCA e-invoicing (Fatoorah) compliance, VAT reporting and submission, secure user authentication, data encryption and protection, compliance audit reports, and regulatory update notifications. Get a quote to see the first of these demonstrated live.

Your next step

Calculate your VAT-taxable revenue for 2022 through 2025 and check it against the wave thresholds above. Then take the buying checklist and the 12 questions into your next vendor conversation — RUKN's included. If you're already past your wave deadline, don't wait on the amnesty; it doesn't cover e-invoicing fines, so prioritise integration now.

Get a RUKN quote · Explore RUKN's compliance capabilities

Sources and how we checked

Facts in this guide were checked on 23 September 2026, refreshed 24 September 2026, prioritising ZATCA's own site and PDFs.

Primary sources, all from ZATCA: the Solution Providers Directory and its non-approval disclaimer; the Wave 25 criteria announcement from 24 July 2026; the Wave 24 criteria announcement; the Cancellation of Fines and Exemption of Financial Penalties Initiative announcement confirming the extension to 31 December 2026 and the Article 45 exclusion; the E-Invoicing Detailed Guidelines, Version 2; the E-Invoicing Detailed Technical Guidelines; and the Electronic Invoice Security Features Implementation Standards.

Secondary sources: Rewaa's Help Center on the SAR 2,500 E-Invoicing Support Program; InvoiceDataExtraction's guide to Saudi VAT record retention; Qeemah's comparison; Fatorli's breakdown of the penalty ladder; and Invopop's compliance documentation.

This guide is general information, not legal or tax advice. Confirm your wave, deadlines, and obligations with ZATCA directly or a qualified Saudi tax adviser.