ZATCA Wave 24 reaches its mandatory compliance deadline on June 30, 2026. If your Saudi business has annual VAT-taxable turnover between SAR 375,000 and SAR 750,000, your point-of-sale system must already be generating cryptographically signed, hash-chained, ZATCA Phase 2 compliant invoices for every eligible transaction. Missing this deadline is not simply a software issue—it exposes your business to regulatory penalties, audit findings, and operational disruption.

For many Saudi SMEs, the problem is that their current POS was never designed for Phase 2 compliance. It may print receipts, process payments, and manage inventory, but it cannot generate device-specific cryptographic signatures, maintain invoice hash chains, switch instantly between simplified and standard invoices, or continue producing compliant invoices when the internet goes offline.

This is why many businesses are replacing generic platforms with custom-built compliance-first systems instead of paying for additional modules that still leave operational gaps.

At LogioLegion, we build custom ZATCA-compliant POS platforms for Saudi businesses using React, Next.js, Node.js, and Laravel. If you're also evaluating a broader software modernization project, our guide on custom software development company in Saudi Arabia explains how compliance-first software is being built for Saudi businesses across multiple industries.

This article explains exactly what Wave 24 requires, where most generic POS systems fail, and why a custom ZATCA POS can become the lower-cost option over the next several years.

---

What Is ZATCA Wave 24 and Does It Apply to You?

Wave 24 is the latest rollout of Saudi Arabia's Fatoorah Phase 2 e-invoicing program. Announced by ZATCA in September 2025, it expands mandatory integration requirements to businesses with annual VAT-taxable revenue between SAR 375,000 and SAR 750,000.

If your business falls within that turnover bracket, June 30, 2026 is your compliance deadline.

This wave affects thousands of businesses across Saudi Arabia, including:

• Fashion and apparel stores
• Electronics retailers
• Mobile phone shops
• Pharmacies
• Grocery stores and supermarkets
• Beauty salons
• Optical retailers
• Auto spare parts dealers
• Hardware stores
• Gift and stationery businesses
• Service businesses operating retail counters

For many businesses, this is the first time ZATCA Phase 2 requirements apply.

Unlike earlier implementation waves that targeted much larger enterprises, Wave 24 reaches the majority of Saudi SMEs.

If your current POS only prints receipts or exports sales reports, it is unlikely to satisfy every technical requirement introduced under Phase 2.

For a broader explanation of Saudi Arabia's e-invoicing framework, read our complete guide to ZATCA-compliant app development Saudi Arabia.

---

What ZATCA Phase 2 Actually Requires From a POS

Many SME owners believe Phase 2 simply requires adding a QR code to receipts.

That is only one small part of the requirement.

A compliant POS must satisfy multiple technical obligations every day for every transaction.

CSID (Cryptographic Stamp Identifier) for Every Device

A Cryptographic Stamp Identifier (CSID) is a unique cryptographic identity issued by ZATCA for each physical POS device.

Think of it as the digital identity card for the terminal.

Every invoice generated by that terminal is digitally signed using its own CSID.

Importantly:

• One business with three POS terminals requires three different CSIDs.
• Each device signs only its own invoices.
• Sharing one CSID across multiple terminals is not compliant.

Many generic systems register one business account instead of one device.

That shortcut creates a compliance issue across every connected terminal.

---

The POS Must Generate Two Different Invoice Types

A compliant Saudi POS cannot generate just one invoice format.

It must support two.

Simplified Invoice (B2C)

This is the standard receipt used for walk-in retail customers.

It includes:

• Seller information
• VAT registration number
• Timestamp
• Invoice total
• VAT amount
• TLV-encoded QR code
• Invoice hash
• CSID counter-signature

No buyer details are required.

---

Standard Invoice (B2B)

If a customer purchases on behalf of a company and requests a tax invoice, the cashier must immediately switch to a standard invoice.

This invoice includes:

• Buyer name
• Buyer VAT registration number (TRN)
• Detailed line items
• Standard ZATCA XML
• Clearance through an Accredited Service Provider before becoming valid

The cashier should never need to open another application or accounting package.

The switch must happen directly inside the POS.

Many generic POS systems only support simplified invoices.

The moment a business customer requests a formal tax invoice, staff are forced into a second system—creating audit gaps and slowing checkout.

---

Accredited Service Provider (ASP) Integration

Every compliant POS communicates with ZATCA through an Accredited Service Provider (ASP).

An ASP securely delivers invoices to the government platform.

Depending on invoice type:

• Standard invoices require real-time clearance before completion.
• Simplified invoices are reported within the permitted reporting window.

The POS must also correctly handle situations such as:

• network interruptions,
• duplicate submissions,
• formatting errors,
• rejected invoices,
• and retransmission once corrected.

A system that crashes whenever ASP communication fails creates unnecessary disruption during trading hours.

For a technical explanation of this architecture, see our guide to ZATCA Fatoorah API integration Saudi Arabia.

---

Offline-First Invoice Generation

Retail stores lose internet connectivity.

It happens.

Customers still expect to pay.

ZATCA still expects compliant invoices.

A compliant POS continues operating without internet access.

That means:

• invoices remain cryptographically signed,
• invoice numbers continue sequentially,
• invoice hash chains remain intact,
• invoices are stored securely,
• and transmission resumes automatically once connectivity returns.

The private cryptographic keys remain securely stored on the terminal using encrypted local storage.

This is one of the biggest differences between purpose-built compliance software and generic SaaS platforms.

Many systems advertise ZATCA compatibility but require continuous internet access to produce valid invoices.

When connectivity drops, compliance drops with it.

---

Invoice Hash Chaining

Every invoice includes a cryptographic fingerprint—known as a hash—of the invoice immediately before it.

Together these hashes create an unbroken chain.

If someone edits, deletes, or inserts an invoice later, the chain immediately reveals the tampering.

This mechanism protects businesses and auditors alike.

It creates an immutable transaction history that cannot be silently modified after sales have occurred.

Any POS that allows invoices to disappear without generating the proper correction documents risks breaking this chain.

What ZATCA Phase 2 Actually Requires from a POS

Many Saudi SME owners assume that installing a "ZATCA module" on their existing POS is enough.

Wave 24 compliance is much broader than printing a QR code on a receipt.

A compliant custom ZATCA POS software Saudi Arabia deployment must satisfy multiple technical and operational requirements simultaneously.

For a complete compliance overview, see our guide on ZATCA-compliant app development Saudi Arabia.

Every POS terminal must have its own CSID

A Cryptographic Stamp Identifier (CSID) is the digital identity issued by ZATCA to an individual POS device.

Think of it as the electronic signature assigned to one physical cashier terminal.

Every invoice generated from that terminal is digitally signed using that device's CSID.

This is where many SMEs unknowingly become non-compliant.

A retailer with:

• three checkout counters,
• three Android tablets,
• or three Windows POS terminals,

must register three separate CSIDs.

Many generic platforms instead register a single CSID for the entire business account and reuse it across every device.

That violates ZATCA Phase 2 requirements because the cryptographic identity belongs to the device—not the company.

If auditors inspect transaction logs and discover invoices originating from multiple terminals using one shared CSID, every affected transaction becomes part of the compliance review.

---

Your cashier must be able to issue two completely different invoice types

Most retail sales use a simplified tax invoice.

But Saudi businesses regularly serve corporate customers.

When a business customer provides their VAT registration number and requests an official tax invoice, the POS must immediately switch to a standard invoice workflow.

The difference is significant.

A simplified invoice requires:

• seller details,
• TLV QR code,
• invoice hash,
• cryptographic signature,
• sequential invoice numbering,
• total,
• VAT amount.

A standard invoice requires all of that plus:

• buyer company name,
• buyer TRN,
• complete line-item breakdown,
• XML generation,
• clearance through an Accredited Service Provider (ASP) before the invoice is considered valid.

A cashier should never have to leave the POS and open another accounting system simply because a customer requested a tax invoice.

Unfortunately, that is exactly how many generic systems operate.

---

Every invoice must reach ZATCA through an Accredited Service Provider

An Accredited Service Provider (ASP) acts as the approved communication layer between your POS and ZATCA.

Your POS does not simply print invoices anymore.

It must securely communicate invoice data using encrypted channels.

Depending on the invoice type:

• Simplified invoices follow the reporting model.
• Standard invoices follow the clearance model before becoming legally valid.

The POS also needs to manage situations where the ASP responds with:

• duplicate invoice detection,
• formatting errors,
• invalid XML,
• connectivity failures,
• rejected submissions.

A compliant system queues, retries, logs the rejection reason, and maintains the audit trail without interrupting store operations.

The full technical architecture is covered in our guide on ZATCA Fatoorah API integration Saudi Arabia.

---

Your POS must continue producing compliant invoices without internet

This is arguably the biggest misconception among Saudi SMEs.

Many vendors advertise "cloud POS."

Cloud availability is not the same thing as offline compliance.

Internet outages happen.

Routers fail.

ISPs experience downtime.

Shopping malls lose connectivity.

Retail stores cannot stop trading because the internet disappears.

A compliant ZATCA offline POS continues generating legally valid invoices even when completely disconnected.

To achieve this, the POS must:

• securely store the CSID private key locally,
• maintain invoice numbering,
• continue invoice hash chaining,
• sign every invoice,
• queue submissions,
• automatically transmit them when connectivity returns.

Many SaaS POS platforms simply display:

"Unable to generate invoice. Please reconnect."

Others mark transactions as "pending" and generate invoices later.

Neither approach satisfies ZATCA's compliance expectations because invoices must be generated at the time of sale—not hours later.

---

Every invoice forms part of an unbroken cryptographic chain

Every invoice issued under Phase 2 contains a cryptographic hash referencing the previous invoice.

This creates what is commonly called the hash chain.

The purpose is straightforward.

If someone later deletes, edits, or replaces an invoice, every invoice after it becomes mathematically inconsistent.

Auditors can immediately detect tampering.

That means POS systems cannot simply delete transactions.

Instead, corrections must happen using approved ZATCA workflows.

Maintaining this chain correctly is fundamental to Phase 2 compliance.

---

Refunds require official credit notes—not negative sales

Many legacy POS systems process refunds by entering:

"-250 SAR"

against the original sale.

That is no longer acceptable.

Under Phase 2, refunds require a formal credit note.

Each credit note must:

• reference the original invoice UUID,
• generate its own UUID,
• include its own digital signature,
• preserve the invoice chain,
• transmit to the ASP,
• remain searchable during future audits.

If a customer returns goods purchased two weeks earlier, the cashier should never manually reverse inventory and subtract the sales value.

The POS should automatically generate the compliant credit note while updating inventory and payment reconciliation.

---

Every invoice must remain available for six years

Invoice storage is no longer just a bookkeeping task.

ZATCA requires compliant archival.

Invoices should be retained using PDF/A-3 together with their original XML representation.

Storage must remain accessible throughout the retention period.

Many Saudi businesses choose infrastructure hosted in AWS Middle East (Bahrain) to support PDPL-aligned data residency while maintaining reliable backup and disaster recovery.

If an auditor requests an invoice issued several years earlier, retrieval should take seconds rather than hours of manual searching.

---

Your POS must always be audit ready

A compliant POS is not simply software for selling products.

It becomes part of your tax compliance infrastructure.

A proper audit dashboard should allow staff to retrieve invoices instantly using:

• invoice number,
• UUID,
• date range,
• customer,
• branch,
• payment type,
• product,
• cashier.

Exporting original XML, viewing transmission status, checking ASP acknowledgements, and verifying invoice chains should all happen without involving external consultants.

When businesses discover these requirements for the first time, many realise that their existing POS satisfies only one visible requirement—the QR code on the receipt—while failing several of the underlying compliance controls introduced under ZATCA Phase 2.

The 4 Ways Generic POS Systems Fail ZATCA Compliance in Saudi Arabia

Most Saudi SMEs assume that because their POS vendor advertises "ZATCA-ready," they are fully compliant.

In reality, many systems only satisfy part of the Phase 2 requirements.

The gaps usually appear only during an audit, an internet outage, or when a customer requests a different invoice type.

No Offline Invoice Generation

Imagine your internet connection drops during the evening rush.

Customers are still lining up to pay.

Your POS displays an error saying it cannot communicate with the cloud.

The cashier either delays the sale or completes it without generating a compliant invoice.

Both outcomes create problems.

Under ZATCA Phase 2, invoices must be generated at the time of the transaction.

A compliant ZATCA offline POS continues producing fully signed invoices even without internet connectivity.

The invoice queue synchronises automatically once the connection returns.

Many cloud-first SaaS platforms cannot do this because invoice signing depends on live connectivity.

That creates one of the biggest compliance risks for Saudi retailers.

---

Simplified Invoices Only

This situation happens every day.

A company representative walks into your store to purchase equipment for their business.

Before payment, they ask:

"Can you issue this under our company VAT number?"

The cashier suddenly discovers the POS can only generate simplified retail receipts.

Someone now has to:

• complete the sale,
• open accounting software,
• recreate the invoice,
• email the customer later.

The transaction has now been split across two systems.

That creates gaps in:

• invoice sequencing,
• audit history,
• hash chaining,
• inventory reconciliation.

A proper ZATCA Phase 2 point of sale Saudi Arabia solution generates either invoice type from the same checkout screen without interrupting the transaction.

---

One CSID Shared Across Every Terminal

This issue is invisible to most business owners.

Suppose your supermarket has:

• four checkout counters,
• four POS terminals,
• four cashiers.

Each terminal should possess its own Cryptographic Stamp Identifier (CSID).

Instead, many generic platforms register one CSID against the entire business account and allow every terminal to use it.

The business continues trading normally.

Receipts print.

Payments complete.

Nobody notices anything wrong.

Until an audit.

ZATCA expects every physical device to carry its own cryptographic identity.

Using one shared CSID across multiple terminals creates a compliance issue across every invoice issued from those devices.

---

Refunds Processed as Negative Transactions

Customer refunds happen every day.

Someone returns a defective product.

Another exchanges an item.

A third cancels an order.

Many legacy POS systems simply record:

-SAR 350

against the original sale.

That is no longer compliant.

Every refund must generate a formal ZATCA credit note linked to the UUID of the original invoice.

The refund itself becomes its own legally recognised document.

The system should automatically:

• create the credit note,
• transmit it through the ASP,
• restore inventory,
• reconcile the payment,
• preserve the invoice hash chain.

If your current POS simply subtracts money from today's sales total, it is almost certainly not handling refunds according to Phase 2 requirements.

---

Custom ZATCA POS vs SaaS — The 3-Year Cost Comparison for Saudi SMEs

Compliance is only one part of the buying decision.

The other question every SME owner asks is:

Should we keep paying monthly SaaS fees, or build a system we own?

For a three-branch Saudi business, the numbers become surprisingly close.

Typical SaaS POS Costs (3 Branches)

Cost Item	Annual Cost (SAR)
Base subscriptions	14,400–28,800
ZATCA compliance modules	5,400–14,400
Per-transaction fees	21,900–54,750
Total Year 1	41,700–98,000

Over three years:

SAR 125,000–294,000

These costs continue indefinitely.

As transaction volume grows, per-invoice charges also grow.

Opening another branch usually means buying another licence.

Adding additional terminals often increases monthly costs again.

---

Custom ZATCA POS

A custom-built platform works differently.

Typical investment for a three-branch Saudi SME:

SAR 120,000–200,000

That includes:

• complete ZATCA Phase 2 compliance,
• Arabic-first interface,
• inventory,
• Mada integration,
• reporting,
• branch management,
• invoice engine,
• source code ownership.

There are:

• no recurring licence fees,
• no per-transaction fees,
• no branch licensing charges,
• no vendor lock-in.

You own the software.

Future enhancements become business decisions rather than subscription upgrades.

For organisations planning to operate for many years, the financial picture changes quickly.

Most businesses reach the break-even point within 18–24 months.

From Year 3 onward, many SMEs save SAR 40,000–90,000 every year simply by eliminating recurring platform fees.

If your business also requires custom workflows beyond standard retail operations, our guide on custom software development company in Saudi Arabia explains how Saudi businesses are replacing subscription software with purpose-built operational platforms.

The financial calculation is therefore not simply:

SaaS versus custom.

It becomes:

Continue paying forever for software designed for everyone, or invest once in software designed specifically for your business, your workflows, and Saudi compliance requirements.

The 8 Core Modules of a Custom Saudi ZATCA POS

ZATCA Invoice Engine

The invoice engine is the compliance core of the entire POS platform.

Everything else—payments, inventory, cashier operations, and reporting—depends on it generating legally compliant invoices every single time.

A properly designed custom ZATCA POS software Saudi Arabia solution includes:

• CSID management for every physical POS terminal
• Simplified and standard invoice generation
• Automatic TLV QR code generation
• Invoice hash chaining
• UUID generation
• Offline invoice queue
• Automatic ASP transmission
• PDF/A-3 archival
• Six-year invoice retention
• Instant XML export for audits

Rather than bolting compliance onto an existing POS, the invoice engine should be the foundation that every transaction passes through.

For the complete technical architecture, see our guide on ZATCA Fatoorah API integration Saudi Arabia.

---

Product and Inventory Management

Inventory management should not exist separately from invoicing.

Every product sold must already carry the correct VAT classification before it ever reaches the checkout screen.

A modern Saudi POS should include:

• Arabic and English product catalogue
• Barcode and QR scanning
• Branch-level inventory
• Supplier purchase orders
• Low-stock alerts
• Dead stock reporting
• Product movement history

Most importantly, every SKU should already be tagged as:

• Standard-rated (15%)
• Zero-rated
• VAT exempt

The cashier should never manually decide VAT during checkout.

The invoice engine automatically applies the correct tax treatment based on the product configuration.

---

Mada and Payment Processing

Saudi customers expect multiple payment methods.

A custom POS integrates directly with Mada-certified payment terminals while keeping every payment tied to the original ZATCA invoice.

Typical integrations include:

• Mada terminals
• HyperPay
• Moyasar
• STC Pay
• Cash
• Split payments
• Gift vouchers (where applicable)

The system should automatically reconcile:

• payment method,
• invoice,
• terminal batch,
• settlement,
• and end-of-day closing.

This removes hours of manual reconciliation for accounting staff.

---

Refund and Credit Note Management

Refunds should never be treated as negative sales.

Instead, the system automatically creates a compliant ZATCA credit note linked to the original invoice UUID.

The workflow should include:

• Full refunds
• Partial refunds
• Inventory reinstatement
• ASP submission
• Payment reversal
• Audit trail
• Refund reason codes

From the cashier's perspective, the process remains simple.

Behind the scenes, every compliance requirement is handled automatically.

---

Multi-Branch Management

Growing retailers often discover that generic POS licensing becomes increasingly expensive as each new branch opens.

A custom platform allows unlimited operational flexibility without recurring branch licensing costs.

Typical features include:

• Branch-specific inventory
• Inter-branch stock transfers
• Central owner dashboard
• Consolidated ZATCA reporting
• Daily branch reconciliation
• Real-time sales monitoring
• Branch performance comparison

Owners can monitor every location from a single dashboard while allowing each branch to continue operating independently.

---

Arabic-First Cashier Interface

Many POS systems advertise Arabic support.

That usually means translated menus.

An Arabic-first interface is very different.

Every operational workflow is designed primarily for Arabic-speaking cashiers.

That includes:

• RTL layout
• Arabic product search
• Arabic receipt headers
• Arabic invoice fields
• Arabic customer information
• Bilingual receipts
• Large touchscreen controls for rapid checkout

The result is faster training and fewer cashier errors during busy trading hours.

---

Staff Management and Shift Control

Retail operations depend on people as much as technology.

A custom POS should therefore include staff management alongside sales operations.

Typical functionality includes:

• Cashier PIN login
• Shift allocation
• Till reconciliation
• Daily closing reports
• Sales performance tracking
• Role-based permissions
• Iqama expiry reminders
• GOSI contribution records
• WPS salary file preparation

Businesses extending their POS into workforce management should also review our guide on Saudi HR payroll — Mudad, GOSI, WPS.

---

Reporting and Owner Dashboard

Business owners need more than yesterday's sales total.

They need visibility across every branch and every product category.

Typical reporting includes:

• Daily sales
• Weekly sales
• Monthly sales
• Product performance
• Category performance
• VAT collected
• ZATCA transmission status
• Inventory turnover
• Payment method breakdown
• Branch comparison
• Peak trading hours
• Profitability trends

A mobile dashboard allows owners to monitor business performance without being physically present in the store.

---

Building Your Online Store on the Same Compliance Foundation

Many Saudi SMEs no longer operate only physical stores.

Retailers increasingly combine storefront sales with online ordering.

Instead of maintaining separate compliance systems, the same ZATCA invoice engine can support both channels.

That means:

• one product catalogue,
• one inventory database,
• one customer database,
• one Mada payment layer,
• one ZATCA invoice engine,
• one reporting dashboard.

Whether the customer buys in-store or online, invoices follow exactly the same compliance workflow.

Businesses planning this expansion should also explore e-commerce app development Saudi Arabia, where the same compliance architecture can power online ordering alongside physical retail.

---

What Does a Custom ZATCA POS Cost in Saudi Arabia?

Typical investment depends on branch count, integrations, and operational complexity.

Business Size	Estimated Investment	Timeline
Single-branch retail POS	SAR 80,000–140,000	10–14 weeks
Multi-branch POS (2–5 branches)	SAR 150,000–280,000	14–20 weeks
Enterprise retail platform (5+ branches)	SAR 280,000–500,000	20–28 weeks

One important consideration cannot be ignored.

Businesses beginning development after the June 30, 2026 Wave 24 deadline are already beyond the recommended implementation window.

That does not mean delaying the project further.

The correct approach is to begin immediately, minimise the period of non-compliance, and complete deployment as quickly as possible.

The financial impact of ZATCA penalties can quickly exceed the cost of beginning the project today.

---

Why LogioLegion for ZATCA POS Development in Saudi Arabia?

Building a compliant POS requires much more than retail software experience.

It requires understanding Saudi Arabia's evolving regulatory environment and designing software around those requirements from the first line of code.

LogioLegion builds custom compliance-first platforms using React, Next.js, Node.js, and Laravel for Saudi businesses.

Our architecture focuses on:

• Native ZATCA Phase 2 compliance
• ASP integration
• Offline-capable invoice generation
• Arabic-first interfaces
• Mada payment integration
• AWS Bahrain hosting for PDPL-aligned data storage
• Inventory and multi-branch operations
• Mobile dashboards
• Full source-code ownership
• Fixed-scope project delivery

Our published technical resources—including our guides on ZATCA compliance, Fatoorah API integration, and Saudi software development—demonstrate the same engineering approach used in production systems.

If you're evaluating technology partners for Saudi retail, our article on software regulatory compliance requirements Saudi Arabia provides a broader view of how compliance affects software across multiple industries.

---

Final Thoughts

For businesses included in ZATCA Wave 24, June 30, 2026 is not simply another regulatory milestone.

It marks the point where every eligible sale must be supported by a fully compliant Phase 2 invoicing workflow.

A POS that cannot generate offline invoices, maintain invoice hash chains, issue both simplified and standard invoices, or correctly process refunds creates unnecessary compliance risk.

The cost of building a custom ZATCA-compliant POS is fixed.

The cost of ongoing SaaS subscriptions, compliance add-ons, transaction fees, and potential regulatory issues continues to grow every year.

Building a ZATCA-compliant POS for your Saudi retail business?

Book a free discovery call with LogioLegion. We'll scope the complete CSID, ASP, invoice engine, and compliance architecture for your business, provide a fixed-price proposal within five business days, and recommend the fastest implementation path based on your branch count and operational requirements.

---