E-Invoice Guidelines Malaysia: LHDN Rules & Format

We set the foundation for your compliance with the new e-invoice regime led by the Inland Revenue Board. The phased rollout runs from 1 August 2024 to 1 July 2026 by turnover thresholds. This section explains what an e-invoice is, why real-time validation matters, and how it changes daily billing and tax reporting.

All B2B, B2C and B2G transactions must be validated via MyInvois. Formats are XML or JSON (UBL 2.1) and digital certificates issued by LHDN secure signing. A Unique Identification Number and QR code appear after validation to aid audits and reconciliation.

We cover exemptions for businesses below RM500,000, the 72-hour rejection window, and the RM10,000 rule from 1 January 2026. Expect penalties under the Income Tax Act 1967 for non-compliance. Our aim is to guide your people, process, and technology for smooth implementation and better cash flow control.

Key Takeaways

• Real-time validation via the MyInvois portal is mandatory for most transactions.
• Use XML or JSON (UBL 2.1) and IRBM-issued digital certificates for signing.
• Small businesses under RM500,000 are exempt but should plan for future compliance.
• The system issues a Unique ID and QR code to support audit trails.
• Penalties can include fines or imprisonment under the Income Tax Act 1967.
• Choose portal or API integration based on volume, IT capacity, and cost-to-serve.

Malaysia e-Invoicing at a Glance: LHDN mandate, scope, and who must comply

Once validated through MyInvois, a machine-readable record gains legal status as proof of revenue or expense.

What qualifies as a compliant document: a structured, machine-readable file in XML or JSON that follows UBL 2.1 and is submitted for real-time validation before you share it with the buyer.

Transactions and parties in scope

The mandate covers B2B, B2C and B2G transactions, plus selected non-business payments. Malaysian buyers may self-bill for imports. Malaysian suppliers must issue for exports when applicable.

Validation, UIN and QR code

MyInvois performs validation and returns a Unique Identification Number and an embedded QR code. You must include these when distributing the validated document so buyers can verify authenticity instantly.

“Only a validated document is recognised for tax and audit purposes.”

Implementation timeline and thresholds: When your business must issue e-Invoices

The rollout assigns start dates by turnover bands so you can plan resources and testing.

We map five implementation phases by annual turnover and the six-month relaxation period that helps stabilise operations. Phase assignment uses FY/YA 2022 audited accounts or the YA 2022 tax return. If your year-end changed, revenue is prorated to a 12-month basis.

How to determine your phase

For sole proprietors, aggregate revenue across all owned businesses to find the correct band and start date. MSMEs under RM500,000 remain permanently exempt, but continuity rules require ongoing compliance once you begin issuance.

“Plan internal go-live earlier than the mandated date to allow live testing and role-based training.”

Critical change from 1 Jan 2026: any transaction above RM10,000 requires a separate e-invoice; monthly consolidation cannot be used for those values.

We recommend formal documentation of your phase decision, early internal go-live, and executive reporting cadence to manage readiness and risk.

How e-Invoices are transmitted: MyInvois Portal, API, and Peppol/non-Peppol providers

Businesses can send validated records through a simple portal or connect via API to automate high-volume flows. We outline the transmission routes so you can match technology to volume and capability.

MyInvois Portal: manual entry and bulk upload

The myinvois portal supports manual creation and bulk spreadsheet upload. This route offers a no-cost entry point for MSMEs and pilot teams.

• Manual entry for single transactions and ad hoc needs.
• Bulk upload for low-to-moderate monthly counts with spreadsheet templates.
• Suitable for suppliers with limited IT resources or testing phases.

API integration: direct, Peppol, or non-Peppol providers

API options include direct links to the myinvois system, Peppol service providers, or non-Peppol technology vendors. LHDN supplies an SDK to speed development.

• Use XML JSON payloads and the SDK for validation, error handling, and testing.
• Direct API gives lowest latency; Peppol adds global routing; non-Peppol vendors offer middleware and managed services.
• Best for high-volume, automated reconciliation and continuous submission.

Choosing a model based on volume, cost, and readiness

Decide by expected monthly invoice counts, IT support, and business continuity needs. Start small and migrate as volumes grow.

Recommendation: start via myinvois portal for pilots, secure credentials and tokens, then plan phased integration as volumes and maturity rise. Keep a knowledge base for submission protocols and reconciliation to stabilise day‑2 operations.

End-to-end process and validations: Issuance, sharing, and 72-hour changes

We explain the full lifecycle from creation to validation, sharing, and the 72-hour change window.

B2B flow

Suppliers submit the document via myinvois portal or API. The IRBM performs real-time validation and issues a Unique Identification Number and QR code instantly.

Both supplier and buyer receive notifications. The supplier then shares the validated e-invoice with the QR so the buyer can confirm authenticity and payment data.

B2C flow and consolidation

When a buyer requests an e-invoice at point of sale, the supplier must capture buyer details and issue in real time.

If the buyer does not request one, eligible retail transactions may be consolidated monthly and submitted within seven days after month-end.

Rejection, cancellation and roles

Within 72 hours, a buyer may request rejection for justified errors and a supplier may cancel with reasons logged. Actions must include a clear justification to preserve audit trails.

“Act quickly and record rationale: the 72-hour window is the system’s corrective period.”

Human-readable outputs and exceptions

After validation, you may render a PDF or JPG for customer sharing. Ensure the human-readable file mirrors the validated data to avoid inconsistencies.

• Use credit/debit/refund types for price or quantity disputes.
• Log mismatched identities and reconcile via documented corrective records.
• Set internal SLAs to resolve rejections and cancellations within the 72-hour time limit.

Recommendation: build dashboards to monitor validation success rates, turnaround times, and exception volumes so AR/AP ledgers stay aligned with portal statuses.

Data standards and formats: Fields, digital certificates, and annexures

IRBM simplified the core dataset to reduce friction and speed validation. The core now contains 51 mandatory fields, down from 53. Supplier website and product tariff/service category are no longer required in the core.

Core dataset and Annexure use

The 51 fields cover identification, party details, tax amounts, item lines, and total values. Use Annexure fields for optional or trade-specific details such as tariff code and extended product attributes.

Tariff codes are optional and belong in the Annexure when used for import/export reconciliation with customs. Record them only where they add customs or tax value.

Digital signing and TIN binding

All records must be digitally signed with an IRBM‑issued certificate linked to the taxpayer’s TIN. Certificates last three years and must be renewed before expiry.

Signatures ensure integrity and non-repudiation so validated records remain auditable and tamper-evident.

Currency, validation, and master data

Currency exchange rates must be disclosed. Use prescribed regulatory rates where provided. If none exist, apply your documented internal policy rate and retain supporting evidence.

“Complete, correct fields and consistent data types prevent submission failures.”

• Enforce mandatory field completeness and proper data types before submission.
• Govern master data for suppliers, customers, items, and tax codes to reduce exceptions.
• Map UIN, QR, and invoice number controls in your ERP to avoid duplicates and preserve audit trails.
• Automate checks for missing details and default rules to speed issuance without sacrificing quality.

Recommendation: maintain a data dictionary aligned to IRBM taxonomy and run periodic field audits so your system stays compliant as annexures and catalogs evolve.

Special rules: e invoice guideline for B2C consolidation, exceptions, and periodic bills

Suppliers may aggregate qualifying B2C sales monthly when buyers do not request an individual e-invoice at point of sale.

When to file: consolidated e-invoices must be submitted within seven calendar days after month-end. From 1 January 2026, any transaction above RM10,000 cannot be consolidated and requires separate issuance.

What to include: each consolidated record should contain POS and e-commerce totals, timestamps, seller TIN, grouped line counts, and a clear mapping to original receipts for audit purposes.

Prohibited consolidation activities

• Motor vehicle sales and private aircraft charters
• Flight tickets and specified luxury goods or jewellery
• Construction contracts and wholesale/retail of construction materials
• Betting/gaming payouts and payouts to agents, dealers, or distributors under Section 83A ITA 1967

Periodic statements and validation

For periodic bills (telecom, banking, utilities), suppliers submit XML or JSON e-invoices for validation at each issuance frequency.

After validation, you may share a visually rich statement with the buyer. Keep validation logs and templates in a repository for the statement period and audits.

Controls and customer service: train POS staff and set prompts so you identify when a buyer require an individual copy. Segregate non-consolidatable transactions in your systems to prevent contamination of monthly aggregates.

For post-period requests or corrections, record changes and submit corrective records promptly to avoid duplicate entries. Use the portal audit trail and keep templates, validation logs, and reconciliation files for internal review and external audit.

Cross-border, self-billing, and edge cases: Getting complex scenarios right

When goods or services cross borders, responsibility for issuance and validation shifts based on whether the Malaysian party is buyer or supplier.

Imports: For imports and foreign-sourced services, the Malaysian buyer must create a self-billed e-invoice and submit for validation. Notifications travel to the Malaysian buyer only; foreign suppliers do not need the validated copy for local filing.

Exports: Malaysian suppliers must issue the validated record to foreign buyers and include the identification number and currency details in the annexure.

Agents and Section 83A: Monetary payouts to agents, dealers, and distributors require self-billed e-invoices, replacing older CP58 paperwork.

Reimbursements that reflect supplier expenses in delivering goods should be included in the validated record. Disbursements paid on behalf of the buyer should be excluded to preserve correct tax treatment.

“Tag self-billed flows so AP and treasury reconcile payments to validated records.”

• Accept employee copies as proof for employer refunds where IRBM permits.
• Single‑tier dividends and Bursa-listed distributions are exempt from self-billing; other profit distributions may need self-billed records.

Compliance, readiness, and integration: People, process, and technology

Begin with a simple gap analysis: what data you have, what IRBM requires, and where processes must change.

Assessing data availability, mapping fields, and process redesign

We start by inventorying source systems and master data. Map each field to the IRBM taxonomy and fix gaps before testing.

Focus on data quality, role-based access, and segregation of duties for creation, submission, and cancellations.

MyInvois system connectivity, SDK usage, and middleware options

Use the IRBM SDK to standardize validation logic with the myinvois system and speed development.

Choose direct API, a Peppol/non-Peppol provider, or middleware to decouple your ERP from integration complexity and reduce implementation risk.

Security and continuity

Adopt controls aligned to ISO/IEC 27001 and continuity practices consistent with ISO 22301 to protect availability and integrity.

Change management and training

Train finance, tax, IT, POS and ecommerce teams. Run pilots, parallel runs, and controlled cutovers with SOP templates and readiness checklists.

• Operational KPIs: validation success rate, average turnaround time, exception rate.
• Governance: internal audits, SDK regression tests, and update reviews.

“Plan phased pilots and clear governance to keep compliance on track.”

Penalties, incentives, and ongoing obligations: Staying compliant over time

We expect firms to treat validated billing controls as a core compliance risk. Failing to issue or validate an e-invoice is an offence under Section 120(1)(d) ITA 1967, with fines from RM200 to RM20,000, imprisonment up to six months, or both.

Practical measures and tax support

Tax incentives reduce the cost of adoption. Eligible implementation costs can qualify for a deduction up to RM50,000 per year (2024–2027). Accelerated capital allowance applies to qualifying ICT equipment and software.

Recordkeeping and monitoring

Retain validated records, rejection and cancellation logs, UIN mapping and reconciliation proofs for at least seven years. Monitor turnover thresholds continuously and document phase decisions and consolidation use.

“Tie collections and disbursements to validated records to minimise disputes and audit adjustments.”

• Quantify risk: each failure may attract statutory penalties.
• Track eligible costs for the tax deduction and capital allowance.
• Maintain a compliance calendar for filing periods, policy reviews, and patching cycles.
• Run scenario tests for outages and volume spikes to confirm recovery times.

We recommend management attestations on completeness and periodic reviews so your teams keep pace with evolving guidelines and tax details.

Conclusion

Malaysia’s e-invoicing programme makes real-time validation the foundation for compliant billing. We show how this affects businesses and how to meet validation requirements with clear process steps.

Operationally, both buyer and supplier must follow the timeline, data standards, and the 72-hour change window. These rules reduce disputes and improve audit trails for day-to-day transactions.

We summarise the key details: phased implementation by turnover, portal or API options, 51 mandatory fields, digital certificates tied to TIN, and consolidation limits for retail sales. Use these guidelines to plan resources, training, and system changes.

Next step: establish cross-functional governance, track KPIs, and test end-to-end flows. If you need help assessing readiness or designing integration, we can assist to operationalise compliant, efficient e-invoice issuance at scale.