- LHDN’s e-Invoice Compliance Review Framework names computer analytics as one of four case-selection bases, alongside risk criteria, complaints and intelligence. (Rangka Kerja Semakan Pematuhan e-Invois, 15 December 2025, Section 5)
- HASiL Chief Executive Officer Datuk Dr Abu Tariq Jamaluddin said Malaysia’s tax administration is “increasingly driven by technology, data analytics and artificial intelligence (AI) to improve service delivery efficiency and enhance taxpayer compliance” [BusinessToday, 4 August 2026].
- LHDN identified more than 500,000 potential cases showing high financial capability with no matching tax records, recovering RM1.4 billion in unreported income from 17,188 taxpayers who came forward [LHDN statement via Free Malaysia Today, 3 February 2026].
- A “Valid” status from MyInvois is a format and identity validation only. Validation is not confirmation that LHDN accepts the transaction as commercially legitimate.
- Malaysian law requires business records to be kept for only 7 years, but LHDN can prosecute for up to 12 years from the offence. That gap leaves a five-year window in which a fully compliant business may hold no documents to defend itself. (Section 82 and Section 121(1), Income Tax Act 1967)
- Failing to issue an e-Invoice is an offence carrying RM200 to RM20,000 per invoice, imprisonment of up to 6 months, or both. (Section 82C(1), Income Tax Act 1967, read with paragraph 120(1)(d))
A tax audit in Malaysia is a review by LHDN (Lembaga Hasil Dalam Negeri Malaysia, the Inland Revenue Board of Malaysia, also referred to as IRBM or HASiL) to confirm that a taxpayer has reported income and paid tax correctly. Cases are no longer picked mainly by hand. Under the e-Invoice Compliance Review Framework that took effect on 15 December 2025, LHDN names computer analytics as one of four bases on which it selects cases for review, alongside risk criteria, complaints and intelligence.
That matters more in 2026 than in any previous year, because LHDN now holds a structured record of nearly every business transaction in the country. This article explains what HASiL said about automation at the National Tax Conference 2026, which four inputs drive case selection, what your e-Invoice data reveals about you, and how far back LHDN can legally reach.
What HASiL Announced at the National Tax Conference 2026
HASiL confirmed that technology, data analytics and artificial intelligence now drive its tax administration. Speaking at the 26th National Tax Conference (NTC 2026), HASiL Chief Executive Officer Datuk Dr Abu Tariq Jamaluddin said the transformation of Malaysia’s tax administration is “increasingly driven by technology, data analytics and artificial intelligence (AI) to improve service delivery efficiency and enhance taxpayer compliance” [BusinessToday, 4 August 2026].
The conference was jointly organised by LHDN and the Chartered Tax Institute of Malaysia (CTIM) at the Kuala Lumpur Convention Centre in early August 2026, under the theme “Future Taxation: Driving Trust, Transparency and Transformation”. Nearly 2,000 policymakers, tax practitioners, professional bodies and academics attended. Finance Minister II Datuk Seri Amir Hamzah Azizan, who officiated the event, said an effective tax system “is not merely a mechanism for revenue collection but a cornerstone for building public trust, economic stability and national competitiveness”.
The financial context explains the direction. LHDN collected RM203.991 billion in direct tax in 2025, an increase of RM19.186 billion or 10.38 per cent year on year, and the first time collections passed RM200 billion since the agency was corporatised in 1996. That result was announced in April 2026, and e-invoicing was credited with improving transparency and reporting efficiency.
How LHDN Decides Who Gets Audited: The Four Named Inputs
LHDN selects e-Invoice compliance review cases on four documented bases, set out in Section 5 of the e-Invoice Compliance Review Framework. Case selection is risk-based, not random.
| Selection input | What it draws on | Can you influence it? |
|---|---|---|
| Computer analytics | Patterns across submitted e-Invoice data, filed returns and third-party data, matched by system rather than by an officer | Yes, through data accuracy and consistency |
| Risk criteria | Profile-level risk scoring, including sector, margin patterns and declared income against financial capability | Partly, through accurate and explainable reporting |
| Complaints | Reports from the public, including buyers refused a valid e-Invoice | Yes, by issuing e-Invoices correctly on request |
| Intelligence | Third-party and inter-agency information | No |
The practical shift is in the first row. Most tax audit guidance published in Malaysia still describes triggers built for an era when LHDN had to sample: sudden swings in income, repeated losses, unusually high expense claims. Those triggers still apply. What has changed is that LHDN no longer needs to sample to find them.
Enforcement outcomes show the method working, and they are the practical reason e-Invoice data has closed off common tax avoidance routes. LHDN reported identifying more than 500,000 potential cases of taxpayers displaying high financial capability with no matching tax records, using data-driven approaches and the latest technology. Following audit checks and reminders, 17,188 previously non-compliant taxpayers filed returns declaring RM1.4 billion in income and contributing RM290 million in tax [LHDN statement via Free Malaysia Today, 3 February 2026].
A single compliance review operation run from 20 to 24 April 2026 uncovered a further RM3.5 billion in unreported income, with 38,906 taxpayers submitting returns and RM760.7 million collected. By that point 225,604 taxpayers had adopted the system since 1 August 2024, issuing 1.299 billion e-Invoices in total [LHDN statement via Free Malaysia Today, 27 April 2026].
What Your e-Invoice Data Already Reveals
Every validated e-Invoice becomes a permanent, timestamped record held by LHDN and tagged with a Unique Identifier Number (UUID). That changes the nature of exposure: discrepancies that once surfaced only if a business was selected for a manual audit are now detectable across the whole population at once.
Four mismatches are structurally visible:
- Counterparty mismatch. Your customer claims a deduction against an e-Invoice you never issued, or issued with different values. Both sides of the transaction sit in the same dataset.
- Return-to-invoice mismatch. Declared revenue in your tax return does not reconcile to the total value of e-Invoices issued under your Tax Identification Number (TIN).
- Consolidation patterns. Persistent use of consolidated e-Invoices where individual documents were required is visible as a pattern, not just as a single error.
- Late or absent adjustments. Cancellations and amendments are only permitted within 72 hours of validation. After that window, corrections require a credit or debit note, and the trail of what changed is preserved. Our guide on how to amend or cancel an e-Invoice sets out the mechanics.
Buyer identity is a frequent weak point. Where a buyer’s TIN or Business Registration Number is wrong, the invoice may validate but will not reconcile against the buyer’s own records. Verifying counterparty details before submission is a control, not administrative tidiness.
How Far Back LHDN Can Go: Five Different Clocks
LHDN operates under several distinct time limits, and they are commonly conflated into a single “three years” or “five years” answer. They are not the same, and they do not all apply to the same thing.
| Clock | Period | Source |
|---|---|---|
| e-Invoice compliance review scope | Up to 2 assessment years | Compliance Review Framework, Section 4 |
| Normal assessment time bar | 5 years after the year of assessment | Section 91(1), Income Tax Act 1967 |
| Fraud, wilful default or negligence | No time bar | Section 91(3), Income Tax Act 1967 |
| Prosecution window | Up to 12 years from the year of the offence | Section 121(1), Income Tax Act 1967 |
| Record retention floor | 7 years minimum | Section 82, Income Tax Act 1967 |
The five-year retention gap most businesses have not priced in
Most Malaysian businesses keep records for 7 years and treat the obligation as discharged. Keeping records for 7 years does satisfy Section 82 of the Income Tax Act 1967. Keeping records for 7 years does not cover the 12 years during which LHDN may still prosecute under Section 121(1).
The difference between those two numbers is a five-year blind spot. A business that destroys its records at the end of year 7, exactly as the law permits, and then faces prosecution in year 9, has complied with the retention rule and has no documents left to defend itself. The retention floor and the exposure window were never aligned with each other, and most finance teams have never compared them.
Worked example: one missed e-Invoice in 2026 is still actionable in 2038. Consider a single invoice issued in March 2026 that is never submitted to MyInvois. Nobody notices at the time. Here is how the two clocks run against each other:
| When | What happens |
|---|---|
| March 2026 | An invoice is issued but never submitted to MyInvois. The omission goes unnoticed. |
| End of 2033 | The 7-year retention period under Section 82 expires. The 2026 records are lawfully destroyed. |
| 2034 to 2038 | LHDN remains entitled to prosecute the 2026 offence under Section 121(1). The supporting records no longer exist. |
| 2038 | The 12-year prosecution window for a 2026 offence finally closes. |
The business in that example is asked in 2038 to prove what happened in 2026, having destroyed the records in 2033 exactly as the law permitted. Nothing it did was unlawful. It simply retained to the floor instead of to the exposure.
The practical response is to align retention with exposure rather than with the statutory floor, and keep e-Invoice records for 12 years rather than 7. Structured e-Invoice data is small and cheap to store for a further five years. Being unable to evidence a transaction that LHDN remains entitled to prosecute is not cheap at all.
One more point follows from the table. Where fraud, wilful default or negligence is alleged, no time bar applies, which is why the accuracy of historical e-Invoice data matters well beyond the current year.
Tax Audit and e-Invoice Compliance Review Are Not the Same Thing
An e-Invoice compliance review is a targeted examination of whether e-Invoices were issued, reported and stored correctly. A tax audit is a broader examination of whether income was reported and tax paid correctly. The two are governed by different documents and carry different scopes.
| Feature | e-Invoice compliance review | General tax audit |
|---|---|---|
| Governing document | e-Invoice Compliance Review Framework (15 December 2025) | Tax Audit Framework |
| Focus | Issuance, reporting and storage of e-Invoices | Correctness of reported income and tax payable |
| Advance notice | 14 calendar days before a site visit (Section 6.1) | Per the Tax Audit Framework |
| Site visit duration | 1 to 3 days, extendable (Section 6.3) | Varies with scope |
| Objection window | 18 calendar days from the finding letter (Section 6.5) | Per the Tax Audit Framework |
| Resolution deadline | 90 days from commencement (Section 6.6) | Varies with scope |
| Best for understanding | e-Invoice specific exposure | Overall tax position |
During a review, LHDN inspects sales and purchase invoices, receipts, debit and credit notes, refund notes, e-Invoice records, financial ledgers and bank statements. LHDN officers may also access and download data directly from your electronic systems. For the full procedure, including your rights at each stage, see our detailed breakdown of the e-Invoice compliance review framework.
What To Do Now
Preparing for analytics-based selection is a data hygiene exercise, not a legal one. Six actions matter most, and they pair with our broader e-Invoice compliance checklist.
Step 1: Reconcile e-Invoice totals to your ledgers monthly
Compare the total value of e-Invoices issued under your TIN against revenue recorded in your accounts every month. Annual reconciliation is too late to correct within the 72-hour amendment window.
Step 2: Validate counterparty TIN and BRN before submission
Check that each buyer’s Tax Identification Number and Business Registration Number are correct at the point of issuance, so your records reconcile against theirs. Our guide on how to check a TIN via the MyTax portal covers the lookup.
Step 3: Review your consolidation practice
Confirm that transactions requiring individual e-Invoices are not being swept into consolidated submissions. Patterns are more visible than isolated errors.
Step 4: Retain records for 12 years, not 7
Align retention with exposure. Section 82 of the Income Tax Act 1967 sets a 7-year floor, but Section 121(1) leaves a business prosecutable for 12 years, so records destroyed at year 7 cannot defend years 8 through 12. Set the retention policy to 12 years and treat 7 as the legal minimum rather than the plan. Our list of accounting documents Malaysian businesses must keep for tax filing sets out what to hold.
Step 5: Confirm you can produce a complete extract on 14 days’ notice
A compliance review gives 14 calendar days before a site visit. Test now whether your systems can produce a full, retrievable e-Invoice history within that window. Our walkthrough on retrieving older e-Invoice records in MyInvois covers the portal limits.
Step 6: Consider voluntary disclosure before a review begins
Taxpayers may submit a voluntary disclosure in writing to the relevant LHDN director before a compliance review starts, which reduces penalty exposure. A disclosure must include the tax return, audited accounts and all unreported e-Invoices. (Framework, Sections 4 to 7)
Businesses in Phase 4, with annual revenue between RM1 million and RM5 million, had a mandatory implementation date of 1 January 2026, with the relaxation period now running to 31 December 2027 and full enforcement from 1 January 2028, as covered in our breakdown of the Phase 4 extension to 2028. The relaxation period covers penalties. The relaxation does not pause data collection, and records created during it remain reviewable.
How JomeInvoice Helps
Analytics-based selection rewards businesses whose records reconcile and penalises those whose records cannot be produced on demand. That is a systems question before it is a compliance question.
JomeInvoice is Malaysian e-invoicing middleware. It connects the POS, ERP, accounting or eCommerce systems you already run to MyInvois without replacing any of them, and keeps a complete, retrievable submission history in one place rather than scattered across the portal and separate exports. Built-in TIN verification checks counterparty identity before submission, which addresses the mismatch that analytics detects most readily. A real-time dashboard shows what has been submitted, validated, rejected or left outstanding, so month-end reconciliation is a report rather than an investigation.
For businesses running more than one system, or handling volume that makes manual portal entry impractical, the reconciliation and retrieval burden is where exposure accumulates. JomeInvoice is built and supported by a Malaysian team, is MySTI certified, and holds ISO 9001, ISO 20000-1 and ISO 27001 certifications alongside PDPA compliance.
Your data is already filed. Make sure it reconciles.
LHDN does not need to select you before it can see your transactions, because every validated e-Invoice is already in its dataset. The businesses that fare worst under analytics-based selection are not the ones with the most complex affairs, but the ones whose e-Invoice records and tax returns tell slightly different stories and who cannot produce a full history in 14 days.
Would your e-Invoice records survive a compliance review?
See how JomeInvoice keeps a complete, retrievable audit trail across every POS, ERP and eCommerce system you run.
Disclaimer: This article is for general informational purposes only and does not constitute legal or tax advice. LHDN guidelines are subject to updates. Always refer to the latest official LHDN e-Invoice Guidelines at myinvois.hasil.gov.my and consult a qualified tax professional for advice specific to your business.
Frequently Asked Questions
Does LHDN use AI to decide who gets audited?
Partly. LHDN’s e-Invoice Compliance Review Framework names computer analytics as one of four case-selection bases, alongside risk criteria, complaints and intelligence [Framework, Section 5]. HASiL has separately said its tax administration is increasingly driven by data analytics and AI.
How far back can LHDN audit?
Five years after the year of assessment under normal circumstances [Section 91(1), Income Tax Act 1967]. No time bar applies where fraud, wilful default or negligence is involved [Section 91(3)]. An e-Invoice compliance review covers up to 2 assessment years.
How long do I need to keep e-Invoice records in Malaysia?
7 years is the legal minimum [Section 82, Income Tax Act 1967]. Keep them 12 years in practice, because Section 121(1) allows prosecution up to 12 years from the offence, so records destroyed at year 7 leave years 8 to 12 undefended.
Is the 7-year record retention rule enough?
No, not for defending a prosecution. Seven years meets the statutory obligation, but LHDN retains prosecution powers for 12 years, so a business that discards records at year 7 has complied with the law and still holds no evidence.
What is the penalty for failing to issue an e-Invoice in Malaysia?
RM200 to RM20,000 per instance of non-compliance, imprisonment of up to 6 months, or both [Section 82C(1) Income Tax Act 1967, read with paragraph 120(1)(d)].
What is the difference between a tax audit and an e-Invoice compliance review?
An e-Invoice compliance review examines whether e-Invoices were issued, reported and stored correctly under the e-Invoice Compliance Review Framework. A tax audit examines whether income was reported and tax paid correctly, under the Tax Audit Framework.
Can LHDN access my accounting system directly?
Yes. During a compliance review, LHDN officers may access and download data from your electronic systems, in addition to inspecting invoices, ledgers and bank statements *(Framework, Sections 4 to 7)*.
Does a “Valid” status in MyInvois mean LHDN has accepted my invoice?
No. “Valid” confirms the document passed structural and identity validation only. Validation is not an audit clearance and does not confirm that LHDN accepts the transaction as commercially legitimate.
How much notice does LHDN give before a compliance review site visit?
14 calendar days before the site visit *(Framework, Section 6.1)*. The visit itself usually runs 1 to 3 days and is extendable, and the review must be resolved within 90 days of commencing.
Can I correct e-Invoice mistakes before LHDN contacts me?
Yes. Submit a voluntary disclosure in writing to the relevant LHDN director before a compliance review begins, including your tax return, audited accounts and all unreported e-Invoices. Voluntary disclosure reduces penalty exposure *(Framework, Sections 4 to 7)*.
Last updated: 5 August 2026 | Written by Yinn Sheng Ng, Head of Marketing