Most e-Invoice discussion has been about getting ready. A different question now applies to organisations already in scope: how compliance is examined after implementation, what the officer is entitled to look at, and what happens when something is found. HASiL has published a framework that answers all three, and it repays reading before rather than after a letter arrives.
A compliance review is not a tax audit
HASiL issued the Rangka Kerja Semakan Pematuhan e-Invois — the e-Invoice compliance review framework — with effect from 15 December 2025. It is published in Malay only.
The framework addresses compliance with the provisions governing e-Invoice implementation: section 82C of the Income Tax Act 1967, section 34B of the Petroleum (Income Tax) Act 1967 and section 22DA of the Labuan Business Activity Tax Act 1990. The e-Invoice guideline and specific guideline in force at the time apply for the purposes of the review.
One structural point is worth noting. HASiL's general audit framework describes two review methods, a general review and a comprehensive one. For e-Invoice compliance reviews, only the comprehensive method applies. That means an interview about how the business actually operates, conducted at the taxpayer's premises or another agreed location — not a desk-based request for documents.
How a case is selected, and what notice you get
Cases are selected through computer system analysis and against established risk-assessment criteria, and from various sources of information received. The framework states plainly that the criteria and the types of source may change from time to time, which is a reasonable signal not to plan around a fixed profile.
Where a visit is to be made, the framework provides for a notification letter issued at least fourteen calendar days before the visit date. That letter states the visit date, the list of records to be prepared, the years of assessment or record period involved, the name of the officer, and the expected duration. A taxpayer who has a reasonable and unavoidable difficulty with the date may apply to postpone it, and may verify the visit's authenticity with the relevant State Director of Operations or Special Branch Division before it takes place.
Two practical consequences follow. Fourteen days is enough time to assemble records only if you already know where they are. And where documents relating to Malaysian transactions are held overseas by a related company, the framework places responsibility on the taxpayer to bring them to its own premises before the visit — a step that takes considerably longer than fourteen days if nobody has thought about it.
What the officer is entitled to examine
The scope is wider than the e-Invoice records themselves. The framework contemplates review of the business's financial records, transaction ledgers, payment vouchers and bank statements, the e-Invoice transactions including debit notes, credit notes and refund notes, and other related documents. Where records are kept electronically, the officer may access the system, server or device and download the accounting data.
Where a taxpayer has not kept complete records, the review may extend to non-business records such as personal bank statements and lists of assets owned, and the officer will determine whether the obligation has been met using whatever method or approach is judged most appropriate in the circumstances. The framework also refers taxpayers to HASiL's public rulings on sufficient record keeping — Public Ruling No. 4/2000 for companies and co-operatives, No. 5/2000 for individuals and partnerships, and No. 6/2000 for other persons.
A review may cover up to two years of assessment. Prosecution, however, may be taken up to twelve years from the year in which the offence was committed, under subsection 121(1) of the Income Tax Act 1967. Those are different periods and should not be conflated.
Consolidated e-Invoice does not remove the receipt obligation
This is the operational trap most likely to catch a business that believed it had simplified its process, and the framework is explicit about it.
Ordinarily, issuing an e-Invoice under section 82C displaces the separate obligation in paragraph 82(1)(b) to issue a serially numbered printed receipt: subsection 82(2A) provides that exemption. But the framework records that a taxpayer using consolidated e-Invoices under subsection 82C(7) is still required to issue a receipt for each amount received in respect of goods sold or services performed, as provided under subsection 82(2B).
Consolidation addresses the submission to HASiL. It does not discharge the obligation to give the customer a receipt at the point of payment. A business that adopted consolidated submission and stopped issuing receipts at the same time has created an exposure while believing it removed one — and the receipt records are among the documents the review examines.
The penalties attach to each transaction
The framework sets out the offence provisions and states that penalties apply for each transaction that fails to comply. That is the feature which turns a process defect into a material number.
- Failure to issue an e-Invoice with the prescribed particulars under subsection 82C(1), failure to issue a self-billed invoice under subsection 82C(6), and failure to furnish the consolidated transaction invoice under subsection 82C(7) are each an offence under paragraph 120(1)(d), carrying a fine of not less than RM200 and not more than RM20,000, or imprisonment not exceeding six months, or both.
- Failure to issue the receipt required by paragraph 82(1)(b), or to keep a copy of each receipt issued, is an offence under paragraph 119A(b), carrying a fine of not less than RM300 and not more than RM10,000, or imprisonment not exceeding one year, or both. That paragraph applies to businesses above the gross income thresholds stated in it, which should be read in the current text of the Act.
Equivalent provisions apply under the Petroleum (Income Tax) Act and the Labuan Business Activity Tax Act. The point for a finance function is not the maximum figure but the multiplier: a systematic error repeated across a year of transactions is not one offence.
Findings, objection, and the ninety-day clock
A findings letter is issued in one of three categories: compliant, non-compliant, or exempted. Where a taxpayer is found not to have complied, the findings letter is accompanied by an e-Invoice failure statement and a compound application letter.
A taxpayer who disagrees may object formally within eighteen calendar days of the date of the findings letter, submitting additional information and evidence in support. If no objection is received within that period, the taxpayer is treated as agreeing with the findings, and the case is referred onward for further action. Eighteen days is short, it runs from the date of the letter rather than from receipt, and it is not a period that survives an unattended inbox.
On the other side, the framework sets an expectation on HASiL: a compliance review case is to be settled within ninety days from the date the review commenced, except where further confirmation is required from other parties. A settled case is not reopened for the same year of assessment and the same issue, though a further review is possible if other issues or new information arise.
Where a compound is offered, payment must be made within the stated period. The framework records that if no compound payment is received within that period, prosecution action may proceed. That is the practical reason correspondence on e-Invoice matters needs a named owner and a monitored deadline rather than general circulation.
Voluntary disclosure closes the gap before a review starts
The framework provides for voluntary disclosure in writing, by letter or electronic means, at any time after the period set for implementing e-Invoice and before compliance review action begins. Where a return has already been filed, the disclosure is expected to be accompanied by the return, the audited accounts or income statement, complete information on the issues with the supporting ledgers and documents, and the e-Invoices, self-billed invoices, consolidated invoices, credit notes, debit notes and refund notes that were not reported.
This route is available to a business without engaging anyone, and it is worth saying plainly: a taxpayer has the right to appoint a registered tax agent under subsection 153(3) of the Act if it considers that necessary, but representation is a right rather than a requirement. What the framework does require is completeness — it states that failure to submit the documents and information without reasonable cause is treated as failing the conditions, and the disclosure will not be accepted. A partial disclosure is worse than a considered one.
Whether e-Invoice applies to you at all is a separate question
Whether and from when the requirement applies to a particular business, and whether any exemption or transitional treatment is available, depends on that taxpayer's own facts and on the guidance currently in force. Those points are deliberately not restated here: the timeline has been revised more than once, and a superseded date on a website is worse than no date. Confirm the position against the HASiL implementation timeline and the current guidelines rather than from a summary.
What to have in place before a letter arrives
- A named owner for HASiL e-Invoice correspondence, with a monitored deadline discipline that can absorb an eighteen-day objection window.
- A reconciliation from submitted and validated documents to the accounting records and to the return position, with differences explainable.
- Retention of rejections and corrections, not only of documents that succeeded.
- A point-of-payment receipt process confirmed independently of the submission process, particularly where consolidated submission is used.
- Deliberate testing of the exceptions — credit notes, refunds, cancellations, foreign currency, self-billed and disbursements — rather than of the standard sales invoice.
- Records held overseas identified now, so that they can be brought to Malaysia within a fourteen-day notice period.
Most of that is internal work, and a business with disciplined records and a clear owner may need no external involvement at all. Where a position is material or contested, see our tax advisory and compliance services.
This article is general information about the framework described. It is not tax advice for any organisation, and it does not determine whether e-Invoice requirements apply to any business, transaction or document, or how any finding should be answered. Requirements, guidelines and timelines are revised periodically; confirm the current position against HASiL's own published material and obtain advice on the specific facts where the matter is material.