Electronic invoice in Malaysia

Nationwide real-time e-invoicing mandate through IRBM’s MyInvois system

Select a country

Overview

Malaysia operates a centralised clearance model. Every e-invoice is submitted to MyInvois, the platform of the Inland Revenue Board (Lembaga Hasil Dalam Negeri, LHDN / IRBM), validated in near real time, given a unique identifier and stored by the tax authority. It covers B2B, B2C and B2G alike, and it applies to exports as well as domestic sales.

Two things have changed recently that most published guidance has not caught up with. The permanent exemption threshold was doubled to RM 1 million in December 2025, and the planned final phase for the smallest businesses was cancelled. And in April 2026 the penalty-free relaxation period for Phase 4 was extended by a further twelve months, to 31 December 2027 — while the mandatory start date of 1 January 2026 stayed exactly where it was.

EAS 0230

the National e-Invoicing Framework scheme for Malaysian Peppol participants

RM 10,000

a single transaction at or above this needs its own e-invoice — no consolidation

7 years

retention from the end of the year of assessment, with records kept in Malaysia

Timeline

Rollout is by annual turnover or revenue. All four phases are now live — the remaining movement has been at the small end and in enforcement, not in the schedule.

Already in force

1 August 2024 — Phase 1

Turnover above RM 100 million

The largest taxpayers go first, establishing the MyInvois validation flow.

1 January 2025 — Phase 2

Turnover above RM 25 million up to RM 100 million

The second band joins on the same technical basis.

1 July 2025 — Phase 3

Turnover above RM 5 million up to RM 25 million

Mid-market businesses come in, and the volume of MyInvois traffic rises sharply.

7 December 2025

The exemption threshold doubles to RM 1 million

Following the Cabinet decision of 6 December, IRBM guidelines raise the permanent exemption from RM 500,000 to RM 1 million with effect from 1 January 2026, and the planned further phase for the RM 150,000–500,000 band is cancelled. See Who is in scope.

1 January 2026 — Phase 4

Turnover above RM 1 million up to RM 5 million

The final mandatory band. From this date a single transaction of RM 10,000 or more must carry its own individual e-invoice — consolidation is not available for it.

20 April 2026

Specific Guideline v4.7 extends the Phase 4 relaxation

IRBM publishes version 4.7 of the e-Invoice Specific Guideline and extends the penalty-free interim period for Phase 4 by twelve months.

Still ahead

1 January 2028

Full enforcement for Phase 4

The extended relaxation ends on 31 December 2027, after which every transaction in this band needs its own validated e-invoice and penalties apply. See The relaxation period.

ViDA does not apply to Malaysia. Malaysia is not an EU member state, so the intra-EU digital reporting requirements, the EU cross-border e-invoicing obligation and the 2030 dates do not determine any Malaysian duty. On a Malaysia–EU transaction, MyInvois rules govern the Malaysian side and the relevant member state's rules govern the European side.

Who is in scope

The obligation follows annual turnover or revenue, and there is no separate schedule for the public sector — a supplier's duty is set by its own band, not by who it sells to.

Above RM 1 millionIn scope, on the phase applicable to the band

Below RM 1 millionExempt, following the December 2025 increase from RM 500,000. The planned phase for the RM 150,000–500,000 band was cancelled

Domestic B2BNo separate date — the general turnover schedule applies

B2GEssentially the same process as B2B. Some government, municipal and statutory bodies have limited exemptions for particular fees, levies, fines and pre-dated transactions — but their suppliers generally follow their own schedule

B2CIn scope, with individual or consolidated e-invoices. See B2C and consolidation

ExportsIn scope. A Malaysian supplier issues an e-invoice into MyInvois even though the foreign buyer has no MyInvois account

One qualification on the exemption worth checking against a specific client. Being below RM 1 million is not automatically the end of the analysis where the business belongs to a larger group — reporting suggests subsidiaries and related companies of RM 1 million-plus entities are treated differently. Confirm group status against the current IRBM guideline rather than reading the turnover figure alone.

The relaxation period

Every phase has come with a six-month interim period in which relaxed rules apply and penalties are not imposed for initial non-compliance. For Phase 4, that six months would have ended on 30 June 2026 — and in April 2026 IRBM extended it by a further twelve months.

Mandatory start1 January 2026 — unchanged. The obligation to implement was not postponed

Relaxation runs until31 December 2027, per the e-Invoice Specific Guideline version 4.7 published on 20 April 2026

What it allowsContinued use of consolidated e-invoices with general descriptions, and no penalties for initial non-compliance

Full enforcementFrom 1 January 2028, every transaction requires its own validated e-invoice

The RM 10,000 rule is not relaxed. Any single transaction of RM 10,000 or above requires its own individual e-invoice immediately, throughout the relaxation period. The threshold applies to the value of a single transaction — not the cumulative total of smaller sales to the same buyer, and not monthly revenue from a customer. It is the one thing in Phase 4 that is being enforced now.

The distinction that matters for planning: relaxation is about how you comply and whether you are penalised, not about whether you are in scope. A Phase 4 business that has done nothing since January 2026 is not compliant — it is unpenalised, which is a different and temporary condition.

The model

This is genuine clearance, not reporting. The document must pass tax validation as part of being issued.

The supplier creates a structured e-invoice

It is transmitted to IRBM through the MyInvois Portal or the API

The tax authority validates it — typically within seconds over the API

A unique identifier is assigned and the record is stored in the IRBM database

The validated document, or its visual representation, goes to the buyer

Near real-time, with exceptions

MyInvois provides near real-time validation and storage across B2B, B2C and B2G. But not every transaction has to be transmitted immediately after supply: monthly consolidation, specific deadlines for imports and foreign income, and particular B2C rules all exist. The honest classification is near-real-time clearance with exceptions and periodic scenarios — not universal instantaneous clearance.

The API is worth knowing about beyond submission. It also returns validation results, allows search across documents sent and received, and retrieves the original XML or JSON, the validation outcome and IRBM's own metadata. That makes it usable as a reconciliation source, not merely as a pipe.

Formats and PDF

Malaysia does not use EN 16931 as its legally binding semantic model. MyInvois has its own mandatory fields, LHDN classification codes, local identifiers, tax categories and business rules. Europeans arriving with an EN 16931 mindset should expect mapping work rather than a profile swap.

Submission formatsXML or JSON, structured on UBL 2.1 plus the local MyInvois requirements

UN/CEFACT CIINot a primary mandatory MyInvois syntax. A CII invoice must be converted into a format MyInvois accepts

Over PeppolMalaysia PINT — the local Peppol International Invoice specialisation, adapted to Malaysian rules including SST

PDFNot a valid source format for MyInvois validation

Where the PDF sits

A PDF has three legitimate roles here and no others: as the visual representation of a validated e-invoice, as a human-readable copy, and as the foreign supplier's commercial invoice on which a Malaysian buyer bases a self-billed e-invoice. Where a taxpayer is already obliged to issue an e-invoice, a PDF or ordinary commercial invoice does not substitute for it.

B2C and consolidation

Retail is inside the mandate, which surprises businesses used to consumer sales sitting outside e-invoicing regimes. Two routes exist:

Individual on request

A consumer who asks for an e-invoice gets one, validated through MyInvois in the normal way.

Consolidated

Sales where no individual e-invoice was requested are gathered into a consolidated e-invoice, where consolidation is permitted.

The buyer can still be handed an ordinary receipt or visual document. What changes is on the seller's side: the sale must reach MyInvois either individually or through a permitted consolidation. The receipt at the till is not the compliance step.

And the RM 10,000 rule cuts straight through this. A single retail sale at or above RM 10,000 cannot be swept into the consolidated batch — it needs its own validated e-invoice. For a business whose consolidation process is a monthly job, that is a real change in operating rhythm.

Self-billing on imports

A foreign supplier is not required to register with MyInvois merely because it invoices a Malaysian customer. Instead the Malaysian buyer generally issues a self-billed e-invoice — which means the compliance burden lands on the importer, and on a clock the importer may not be watching.

Imported goodsThe self-billed e-invoice must be issued by the end of the second month following the month of customs clearance

Imported servicesBy the end of the month following the month of payment or of receiving the foreign supplier's invoice — whichever comes first

Basis documentThe foreign supplier's ordinary commercial invoice, which may perfectly well be a PDF

Two failure modes carry risk in opposite directions: not issuing a required self-billed e-invoice, and issuing one in a situation where self-billing is not permitted. Both are exposures — the rule is not "when in doubt, self-bill".

Cross-border

ExportThe Malaysian supplier must create an e-invoice in MyInvois even though the foreign buyer is not registered in Malaysia and does not use the platform

ImportThe foreign supplier issues its usual commercial invoice; the Malaysian buyer creates the self-billed e-invoice

Over PeppolUsable internationally, but document types must be compatible and conversion may be needed between Malaysia PINT, Peppol BIS Billing, another national PINT localisation or an EN 16931 CIUS

The point to be unambiguous about: delivering through Peppol does not remove the MyInvois validation step. Commercial delivery and tax clearance are two separate obligations in Malaysia, and satisfying one says nothing about the other.

Peppol and MDEC

Peppol is not the mandatory compliance channel — the official routes for the tax obligation are the MyInvois Portal and the MyInvois API. Peppol is nonetheless key national infrastructure for automated B2B exchange, interoperability, international exchange, ERP integration and delivery of the e-invoice to the recipient.

Governance splits between two bodies, and confusing them wastes time: MDEC — the Malaysia Digital Economy Corporation — is the Peppol Authority and runs the Peppol ecosystem; LHDN owns tax reporting and compliance.

So the Malaysian architecture is best described as centralised tax clearance through MyInvois plus a decentralised Peppol four-corner network for commercial delivery. Those layers are governed separately, accredited separately, and fail separately.

Identifiers

Malaysia has its own registered scheme in the Peppol electronic address code list: 0230 — National e-Invoicing Framework, Malaysia.

Depending on the participant category, the organisational identifier behind it may be tied to the TIN, the business registration number, the company registration number, a government body identifier, or another permitted national identifier. That variability is worth handling explicitly at onboarding — a single assumed identifier type will not cover the range of Malaysian counterparties you meet.

Requirements for providers

Malaysia is one of the jurisdictions where a national accreditation genuinely exists. A provider intending to offer Peppol Access Point services in Malaysia must obtain MDEC Peppol Service Provider Accreditation. Certification by another Peppol Authority is not sufficient to hold yourself out as a Malaysia-accredited Peppol Service Provider.

Who may applyA company incorporated in Malaysia or in another country — foreign providers are eligible

Paid-up capitalMinimum RM 50,000 or the equivalent

Track recordThe company or its parent must have been operating for at least one year

StandingNot in liquidation, no relevant criminal proceedings, not blacklisted

MembershipOpenPeppol AISBL membership, plus conformity with the Malaysia Peppol Authority specifications

Security minimumsMulti-factor authentication, encryption at rest, encryption in transit and regular security monitoring. ISO/IEC 27001 can evidence maturity but is not stated as an absolute condition

Existing home authorityA foreign Access Point may apply to MDEC, supply a copy of its Service Provider Agreement with its other Peppol Authority, and keep that home authority — while still completing Malaysian accreditation

Notably, the published criteria contain no general requirement for a Malaysian subsidiary, a local shareholder, a physical office, a local director, a fiscal representative or a national official electronic mailbox. The barrier is accreditation, not establishment.

There is also a lighter option. Rather than becoming an Access Point in its own right, a company can operate as a Peppol-Ready Solution Provider and connect through an accredited Access Point — which is often the sensible route for a provider whose Malaysian volume does not yet justify accreditation.

Penalties

Failing to issue an e-invoice, or issuing one that does not meet the requirements, can be an offence under Section 120(1)(d) of the Income Tax Act 1967.

FineNot less than RM 200 and not more than RM 20,000

ImprisonmentUp to six months

Or bothThe sanction may be applied per transaction

Where the risk actually accumulates

—Not issuing a required self-billed e-invoice on an import

—Not issuing a consolidated e-invoice within the prescribed period

—Creating a self-billed document where self-billing is not permitted

—Not meeting LHDN's content requirements for the document

On documentary effect: during transition and for exempt persons, other documents can still be accepted as proof of expense. Once the obligation has begun, however, the validated e-invoice is the principal document for substantiating income, expenditure and self-billed import transactions — and an ordinary PDF or commercial invoice does not replace it.

Archiving

Records must be retained for seven years from the end of the relevant year of assessment, under sections 82 and 82A of the Income Tax Act 1967. The e-invoicing obligation itself sits in section 82C.

Records relating to a business in Malaysia should be kept and retained in Malaysia, at the place where the business is carried on

Retain the original structured format — the XML or JSON — and keep the human-readable rendition alongside it rather than instead of it

Records may be manual or electronic, but electronic records must be readily convertible into a readable format

MyInvois retains and timestamps validated e-invoices, and for those transactions the electronic version becomes the primary record. That is convenient, not a substitute for your own archive — the seven-year duty under sections 82 and 82A remains the taxpayer's, and a platform copy you cannot export on demand is not a compliance strategy.

How we help

Malaysia is two systems, not one. A European provider entering it needs to be explicit about which layer it covers:

Mapping from EN 16931 and Peppol BIS Billing into the MyInvois structure — fields, LHDN classification codes and tax categories

Conversion between Malaysia PINT, Peppol BIS Billing and other national PINT localisations for cross-border traffic

Addressing on 0230, with the identifier type resolved per participant rather than assumed

A clear split between commercial delivery and MyInvois validation, so nobody assumes Peppol delivery discharged the tax obligation

The RM 10,000 rule enforced in the invoicing flow, so high-value sales never enter a consolidation batch

Self-billing deadlines on imports tracked from customs clearance and payment or invoice receipt, not from a monthly close

Retention of the original XML or JSON with its validation result, alongside a readable rendition

Connection by API, SFTP and CSV, with ERP and IDoc source data

Frequently asked questions

Who is exempt from e-invoicing in Malaysia?

Businesses with annual turnover below RM 1 million. The threshold was doubled from RM 500,000 following the Cabinet decision of 6 December 2025 and IRBM guidelines published on 7 December, with effect from 1 January 2026, and the planned further phase for the RM 150,000–500,000 band was cancelled. Check group status separately: reporting indicates subsidiaries and related companies of RM 1 million-plus entities are treated differently, so the turnover figure alone is not the whole answer.

Was the Phase 4 deadline postponed?

No — and this distinction matters. The mandatory implementation date for businesses with turnover between RM 1 million and RM 5 million remains 1 January 2026. What was extended, in the e-Invoice Specific Guideline version 4.7 published on 20 April 2026, is the penalty-free relaxation period, now running to 31 December 2027 with full enforcement from 1 January 2028. Being unpenalised is not the same as being compliant.

What is the RM 10,000 rule?

From 1 January 2026, any single transaction of RM 10,000 or above must have its own individual, validated e-invoice — it cannot be included in a consolidated e-invoice. The threshold applies to the value of one transaction, not to the cumulative total of smaller sales to the same buyer and not to monthly revenue from a customer. It is enforced throughout the relaxation period, so it is the one Phase 4 requirement biting today.

Does Malaysia use EN 16931?

Not as a legally binding semantic model. MyInvois has its own mandatory fields, LHDN classification codes, local identifiers, tax categories and business rules. Submissions are XML or JSON structured on UBL 2.1 plus local MyInvois requirements. UN/CEFACT CII is not a primary mandatory syntax and must be converted. Over Peppol, the relevant specification is Malaysia PINT, a local specialisation adapted to Malaysian rules including SST.

Does sending through Peppol satisfy the mandate?

No. Peppol handles commercial delivery; the tax obligation is discharged through the MyInvois Portal or API, where the document is validated and assigned a unique identifier. Delivery over Peppol does not remove the MyInvois validation step. The two layers are also governed separately — MDEC runs the Peppol ecosystem, LHDN owns tax compliance.

Do I need MDEC accreditation to serve Malaysian clients?

To provide Peppol Access Point services in Malaysia, yes — certification by another Peppol Authority is not enough on its own. A foreign company may apply, supply a copy of its Service Provider Agreement with its home Peppol Authority and keep that authority, while completing Malaysian accreditation. Criteria include RM 50,000 minimum paid-up capital, at least a year of operation by the company or its parent, good standing, OpenPeppol AISBL membership, conformity with the Malaysia Peppol Authority specifications, and security minimums covering MFA, encryption at rest and in transit and regular monitoring. Alternatively, operate as a Peppol-Ready Solution Provider through an accredited Access Point.

Do I need a Malaysian company or office?

The published MDEC criteria contain no general requirement for a Malaysian subsidiary, a local shareholder, a physical office, a local director, a fiscal representative or a national official electronic mailbox. A company incorporated in Malaysia or in another country may apply. The hurdle in Malaysia is accreditation, not establishment.

What happens when a foreign supplier invoices a Malaysian company?

The foreign supplier need not register with MyInvois. It issues its ordinary commercial invoice, and the Malaysian buyer issues a self-billed e-invoice into MyInvois. For imported goods that must be done by the end of the second month following the month of customs clearance; for imported services, by the end of the month following payment or receipt of the foreign supplier's invoice, whichever is earlier. Issuing a self-billed document where self-billing is not permitted is itself a risk.

Does ViDA affect Malaysian businesses?

No. Malaysia is not an EU member state, so the intra-EU digital reporting requirements, the EU cross-border e-invoicing obligation and the ViDA dates create no Malaysian duty. On a Malaysia–EU transaction, MyInvois rules govern the Malaysian side, the relevant member state's rules govern the European side, and Peppol may serve as the interoperable channel between them where technically supported.

How long must records be kept, and where?

Seven years from the end of the relevant year of assessment, under sections 82 and 82A of the Income Tax Act 1967. Records relating to a business in Malaysia should be kept and retained in Malaysia at the place where the business is carried on. Retain the original XML or JSON rather than only the rendition, and ensure electronic records are readily convertible into a readable format. MyInvois retains and timestamps validated e-invoices, but that does not transfer the taxpayer's own retention duty.

What are the penalties?

Failure to issue an e-invoice, or issuing one that does not meet the requirements, can be an offence under Section 120(1)(d) of the Income Tax Act 1967: a fine of not less than RM 200 and not more than RM 20,000, imprisonment of up to six months, or both — and the sanction may be applied per transaction. Risk also arises from missing self-billed e-invoices, late consolidated e-invoices, self-billing where it is not permitted, and failing LHDN's content requirements.

Summary

Malaysia runs one of Asia's clearer clearance regimes: structured e-invoices validated in near real time by MyInvois, given a unique identifier, and stored by the tax authority — across B2B, B2C, B2G, exports and, through self-billing, imports. All mandatory phases are live, and the exemption now sits at RM 1 million rather than RM 500,000.

The two facts most likely to be out of date in whatever else you read: the exemption was doubled in December 2025, and the Phase 4 penalty-free window was extended in April 2026 to 31 December 2027 — without moving the 1 January 2026 start date.

For a European provider, Malaysia is the country where the usual assumptions break twice. EN 16931 is not the semantic model, and Peppol delivery is not tax compliance. Get those two straight and the rest is mapping work.

Resources

IRBM — e-Invoice The tax authority's own hub: guidelines, the Specific Guideline versions, SDK and phase information MyInvois Portal The submission and validation platform itself, for manual creation and batch upload MyInvois SDK The technical documentation: API reference, UBL and JSON structures, code lists and validation rules MDEC — Malaysia Digital Economy Corporation The Malaysian Peppol Authority: service provider accreditation, local specifications and the accredited provider list Peppol Electronic Address Scheme code list Where 0230, the National e-Invoicing Framework scheme for Malaysia, is registered OpenPeppol — Peppol Authorities Confirms MDEC's role and the governance framework a foreign Access Point works within Peppol Directory Check whether a Malaysian participant is reachable on the network and under which identifier

Need support with e-invoicing compliance?

As a certified Peppol Access Point we provide solutions for sending and receiving electronic invoices securely across Europe — including format conversion, validation and integration with national systems.

Start your free trial