- The Inland Revenue Board of Malaysia (LHDN) e-Invoice Compliance Review Framework took effect on 15 December 2025 and applies to e-invoice obligations under the Income Tax Act 1967, the Petroleum (Income Tax) Act 1967 and the Labuan Business Activity Tax Act 1990. [Rangka Kerja Semakan Pematuhan e-Invois, Sections 2 and 14]
- A review notice arrives at least 14 calendar days before the site visit, the visit normally lasts one to three days, and the case must be resolved within 90 days of the visit starting. [Framework, Sections 6.1, 6.3 and 6.6]
- A review can cover up to two years of assessment, but prosecution for an e-invoice offence can be brought up to 12 years from the year the offence was committed. [Framework, Section 4; Income Tax Act 1967, s.121(1)]
- Penalties apply for each non-compliant transaction: RM200 to RM20,000, up to six months’ imprisonment, or both. [Framework, Section 10.1; Income Tax Act 1967, Para 120(1)(d)]
- You have 18 calendar days to object to a findings letter in writing. Silence counts as agreement. [Framework, Section 6.5]
- The e-Invoice Special Voluntary Disclosure Programme (SVDP), open from 7 July 2026 to 31 December 2027, waives review, penalties and prosecution on disclosed e-invoices, including for businesses already under or notified of a review, unless fraud, wilful default or negligence is involved. [e-Invoice Specific Guideline v4.8, Section 17]
An e-invoice compliance review from the Inland Revenue Board of Malaysia (Lembaga Hasil Dalam Negeri, LHDN) gives you 14 days’ notice, inspects up to two years of records on site and must close within 90 days, and since July 2026 a review letter is no longer the point of no return. The rules come from LHDN’s e-Invoice Compliance Review Framework, in force since 15 December 2025. This guide walks through every stage, the penalties per non-compliant transaction, and why the e-Invoice Special Voluntary Disclosure Programme (SVDP) still protects businesses that have already received a review letter.
What Is the e-Invoice Compliance Review Framework?
The e-Invoice Compliance Review Framework (Rangka Kerja Semakan Pematuhan e-Invois, or RKe) is LHDN’s published procedure for reviewing whether taxpayers meet their e-invoice obligations. The framework sets out how cases are selected, what officers can inspect, the timelines on both sides, the penalties, and how to object. LHDN published it in Bahasa Malaysia on its official framework page, with the full text available as the Rangka Kerja Semakan Pematuhan e-Invois PDF.
The legal anchor is Section 82C of the Income Tax Act 1967, which requires an e-invoice for every sale of goods or services. Equivalent duties sit in Section 34B of the Petroleum (Income Tax) Act 1967 and Section 22DA of the Labuan Business Activity Tax Act 1990. [Framework, Section 2.3] The review framework is the enforcement end of the wider e-invoice mandate covered in our complete guide to LHDN e-invoicing in Malaysia.
Review vs audit: what is actually different
LHDN calls this a “compliance review”, and the framework files it under LHDN’s audit activities. LHDN’s general audit approach uses two methods, a general review and a comprehensive review. For e-invoices, only the comprehensive review applies, which means officers interview you about how the business operates and inspect records at your premises or another agreed location. [Framework, Section 3.3]
| e-Invoice compliance review | Income tax audit | |
|---|---|---|
| Governing document | e-Invoice Compliance Review Framework (15 Dec 2025) | Income Tax and Employer Audit Framework |
| Methods used | Comprehensive review only (on-site, with interviews) | General review or comprehensive review |
| What is tested | e-Invoice issuance, submission and record-keeping duties | Income tax returns and reported income |
| Typical outcome | Findings letter, e-Invoice failure statement, compound offer | Additional assessment and penalties |
Our article on how LHDN’s income tax audits use data analytics covers the income tax side in detail. The rest of this guide focuses on the e-invoice review alone.
How LHDN Selects Businesses for an e-Invoice Compliance Review
LHDN selects review cases from three sources: computer system analysis, risk assessment criteria it sets internally, and other information such as complaints, intelligence and data from other agencies. The framework states that these criteria and sources can change at any time, and it does not describe selection as random. [Framework, Section 5]
The data LHDN can analyse is already large. Between 1 August 2024 and early February 2026, 184,325 taxpayers submitted 979 million e-invoices, and LHDN identified more than 500,000 potential cases where financial capacity did not match existing tax records. In the same release, LHDN reported that 17,188 taxpayers who had not filed returns came forward and declared RM1.4 billion in back-year income, contributing RM290 million in tax. (Source: LHDN media release, 3 February 2026.)
Your counterparties’ data lets LHDN cross-check yours
Every validated e-invoice creates a record on two sides: the supplier’s sales and the buyer’s purchases. LHDN can therefore test your own submissions against what your counterparties report:
- Your customers’ purchase records show what they bought from you, and under which Tax Identification Number (TIN). Our guide to e-invoice TIN codes explains the formats.
- Payers who must issue self-billed e-invoices to you, such as principals paying agents and dealers, report your income on your behalf.
- Your suppliers’ e-invoices show what you bought, which LHDN can compare with your declared costs and sales.
A gap between validated e-invoice totals and the revenue in your tax return is exactly the kind of mismatch a computer-based analysis can flag. Our explainer on how LHDN uses e-invoice data to detect tax avoidance goes deeper into data matching.
Could your records survive a 14-day review notice?
JomeInvoice keeps every e-invoice, credit note and self-billed record validated and retrievable in one place.
Book a Demo Sign Up Free
How Far Back an e-Invoice Compliance Review Can Go
An e-invoice compliance review can cover up to two years of assessment, and the notification letter states which years. Prosecution has a much longer reach: LHDN can bring action up to 12 years from the year an offence was committed. [Framework, Section 4]
| Clock | Period | Source |
|---|---|---|
| Review coverage | Up to 2 years of assessment | Framework, Section 4 |
| Prosecution window (Income Tax Act) | Up to 12 years from the year of offence | Income Tax Act 1967, s.121(1) |
| Prosecution window (Petroleum Act) | Up to 12 years from the year of offence | Petroleum (Income Tax) Act 1967, s.59(1) |
| Labuan entities | Time limit of the relevant offence | Framework, Section 4 |
The practical reading for finance teams: the review window is short, but anything found inside it can raise questions about earlier years. Record-keeping obligations follow LHDN Public Rulings No. 4/2000, 5/2000 and 6/2000 on adequate records. [Framework, Section 6.4.6] Our guide to the accounting documents Malaysian businesses must keep sets out the retention periods.
What Happens During an e-Invoice Compliance Review, Stage by Stage
A review runs in six stages, from the notification letter to case closure. The timeline below summarises the deadlines, followed by what happens at each stage.
| Stage | Timing | Your deadline or right |
|---|---|---|
| 1. Notification letter | At least 14 calendar days before the visit | Request deferment for reasonable cause |
| 2. Site visit | Normally 1 to 3 days, extendable | Appoint a registered tax agent or interpreter |
| 3. Records inspection | During the visit | Receive a signed list of any originals taken |
| 4. Findings letter | After the visit | Review the e-Invoice failure statement |
| 5. Objection | Within 18 calendar days of the findings letter | Object in writing with evidence |
| 6. Case closure | Within 90 days of the visit starting | Pay the compound or appeal against prosecution |
1. Notification letter
LHDN sends a Compliance Review Visit Notification Letter at least 14 calendar days before the visit. The letter lists the visit date, the records to prepare, the years of assessment or record period covered, the officers’ names and how long the visit will take. [Framework, Section 6.1]
You can ask to defer the visit for a reasonable cause. You can also confirm the visit is genuine with the State Operations Director of the e-Invoice and Employer Audit Section, or the Director of the Special Branch Division. If related companies keep your business records overseas, you must bring those records to the premises before the visit. [Framework, Section 6.1]
2. On-site visit
Officers introduce themselves, show an authority card, and explain the purpose, scope and period of the review. Under Section 80 of the Income Tax Act 1967, they can enter and inspect land, buildings and premises, and inspect, take and copy documents free of charge. [Framework, Section 6.2]
The visit normally lasts one to three days. The framework allows extensions based on the size and complexity of your transactions, how your records are kept and your level of cooperation. [Framework, Section 6.3]
Officers also interview the business owner and key staff about how the business runs. Refusing to answer, refusing access or withholding documents counts as obstruction under Section 116 of the Income Tax Act 1967. [Framework, Sections 8.2.1 and 8.2.2]
3. Records inspection
Officers inspect every business record linked to your e-invoice obligations. The framework lists:
- Sales invoices, sales receipts and related sales documents
- Purchase invoices, purchase orders and related purchase documents
- Debit notes, credit notes and refund notes
- Financial records, transaction ledgers, payment vouchers and bank statements
- e-Invoice transactions submitted through MyInvois, LHDN’s e-invoice validation system
If your records are electronic, officers can access computers, servers and devices and download data to storage media. If they take original documents, they must give you a list signed by both sides. [Framework, Sections 3.3.2 and 6.4]
Two receipt rules are easy to miss. A business that issues an e-invoice for a sale does not need to issue a separate receipt for it. A business that uses consolidated e-invoices, however, must still issue a receipt for each payment received. [Income Tax Act 1967, s.82(2A) and s.82(2B); Framework, Sections 6.4.8 and 6.4.9]
4. Findings letter
After the inspection, LHDN issues a findings letter that classifies you as compliant, non-compliant or exempted. A non-compliant finding comes with an e-Invoice failure statement and a compound offer letter under the relevant Act. [Framework, Sections 6.5.1 and 6.5.2]
5. Objection
If you disagree with the findings, object in writing within 18 calendar days of the findings letter, with additional information and supporting evidence. If LHDN receives no objection within 18 days, you are deemed to agree with the findings. [Framework, Sections 6.5.3 and 6.5.5]
Once the findings are final, the case moves to LHDN’s Klang Valley Legal Branch or the state Legal Section for compound payment. An unpaid compound can lead to prosecution. You can still appeal against prosecution by submitting further information and evidence. [Framework, Sections 12 and 13]
6. Case closure
LHDN must resolve a review within 90 days of the visit starting, except where the case needs further verification from other parties. A closed case is not reopened for the same year of assessment and issue, but LHDN can run a new review if other issues or new information emerge. [Framework, Section 6.6]
e-Invoice Penalties Found in a Compliance Review
Penalties under the framework apply to each non-compliant transaction, not to the business as a whole. [Framework, Section 10.1] Per-transaction counting changes the scale of exposure. A business that missed 500 e-invoices over two years faces up to 500 separate offences, a statutory range of RM100,000 to RM10 million on conviction. For an enterprise issuing 10,000 e-invoices a month, a single mapping error that runs for one month already means 10,000 potential offences.
| Provision | Offence | Penalty |
|---|---|---|
| s.82C(1) Income Tax Act 1967 | Failing to issue an e-invoice with the required details for a sale or service | RM200 to RM20,000, up to 6 months’ imprisonment, or both [Para 120(1)(d)] |
| s.82C(6) Income Tax Act 1967 | Failing to issue a required self-billed e-invoice, including e-commerce platforms issuing for third-party sellers | RM200 to RM20,000, up to 6 months’ imprisonment, or both [Para 120(1)(d)] |
| s.82C(7) Income Tax Act 1967 | Failing to submit a consolidated e-invoice within the required time and conditions | RM200 to RM20,000, up to 6 months’ imprisonment, or both [Para 120(1)(d)] |
| Para 82(1)(b) Income Tax Act 1967 | Failing to issue or keep serially numbered receipts above the gross income thresholds | RM300 to RM10,000, up to 1 year’s imprisonment, or both [Para 119A(b)] |
The framework does not publish compound rates. The compound offer arrives with the findings letter, and the statutory range above is what applies if a case goes to court. Equivalent penalties apply under the Petroleum (Income Tax) Act 1967 (s.57B) and the Labuan Business Activity Tax Act 1990 (s.22EA). [Framework, Section 10]
The relaxation-period overlap for Phase 1 to Phase 3 companies
A two-year review window can reach back into your phase’s interim relaxation period. Phase 1 (revenue above RM100 million) had relaxation until 31 January 2025, Phase 2 until 30 June 2025 and Phase 3 until 31 December 2025. LHDN’s undertaking not to prosecute under Section 120 during those months applies only where the relaxation conditions for consolidated e-invoices and consolidated self-billed e-invoices were actually met. [e-Invoice Specific Guideline v4.8, Section 16.3 and Table 16.1] Transactions that fell outside those conditions are not shielded, even if they took place inside the relaxation period.
The RM10,000 individual e-invoice rule applies to every business: any single transaction exceeding RM10,000 needs its own e-invoice and cannot be consolidated. [e-Invoice Specific Guideline v4.8, Table 3.6] For a fuller penalty breakdown, see our guide to LHDN e-invoice penalties.
SVDP: Regularising Records After a Review Notice
The e-Invoice Special Voluntary Disclosure Programme (SVDP) is a penalty amnesty for past e-invoice non-compliance, introduced in the e-Invoice Specific Guideline v4.8 on 7 July 2026. Businesses that submit missed or incorrect e-invoices under the SVDP face no compliance review, no penalties and no prosecution on those e-invoices. The window runs until 31 December 2027. (Source: e-Invoice Specific Guideline v4.8, Sections 17.1 and 17.3.)
The SVDP changes how a review notice should be handled. It explicitly covers taxpayers who are currently undergoing, or have been notified that they will undergo, an e-invoice compliance review. [Section 17.1(d)] A business can therefore regularise its records under the SVDP at any point until 31 December 2027, including during the notice period or the review itself. Section 17 does not say whether e-invoices already listed in a findings letter can still be disclosed for relief, so disclose before findings are issued wherever possible.
The relief has firm conditions:
- Exclusions: relief does not apply to disclosures involving fraud, wilful default or negligence, or to SVDP submissions that fail LHDN’s specifications. [Section 17.4]
- Version tags: submissions must use e-invoice version
SVDP 1.2(without digital signature) orSVDP 1.3(with digital signature), and only for SVDP disclosures. [Section 17.5] - Month by month: back-filed consolidated e-invoices must be submitted per month of transaction, never as one lump sum across months. [Section 17.6]
- RM10,000 rule still applies: back-filed transactions above RM10,000 need their own individual e-invoices. [Example 24]
- Good faith: LHDN accepts disclosures on the basis of good faith, and accuracy remains your responsibility. [Section 17.2]
SVDP versus the framework’s voluntary disclosure
The review framework has its own voluntary disclosure route, which predates the SVDP. The two are not the same.
| Framework voluntary disclosure | e-Invoice SVDP | |
|---|---|---|
| Source | Framework, Section 7 (15 Dec 2025) | Specific Guideline v4.8, Section 17 (7 Jul 2026) |
| When you can use it | After your mandatory date and before a review starts | Until 31 December 2027, including after a review notice |
| How you submit | Written disclosure to the State Operations Director, with your income tax return, audited accounts, ledgers and the unreported e-invoices | Submit the missed e-invoices through MyInvois using SVDP 1.2 or SVDP 1.3 |
| Relief | No penalty relief stated; LHDN reviews the disclosure and finalises by mutual agreement. Incomplete documents trigger a visit or query letter, and a disclosure is rejected only if complete information is withheld without reasonable excuse | No review, penalties or prosecution on disclosed e-invoices |
| Best for | Issues that go beyond e-invoices, such as unreported income | Missed, late or incorrect e-invoices |
[Framework, Sections 7.1 to 7.7; e-Invoice Specific Guideline v4.8, Section 17]
Where Review Findings Are Most Likely to Arise
The framework’s records list tests one thing above all: whether three sources agree. Those sources are your ledger, what MyInvois validated, and your bank statements. [Framework, Sections 3.3.2 and 6.4.1] Reading the framework against the e-invoice rules, these are the gaps most likely to produce findings:
- Ledger and MyInvois disagree. Sales posted in the accounting system never reached MyInvois, or were validated and later reversed in the ledger without a credit note.
- Consolidation misuse. Transactions above RM10,000 inside a monthly consolidated e-invoice, consolidated e-invoices submitted after the deadline of 7 calendar days after month end, or no receipts kept for consolidated sales. [e-Invoice Specific Guideline v4.8, Section 3.6 and Table 3.6]
- Missing self-billed e-invoices. Payments to foreign suppliers, agents, dealers or individuals not carrying on a business, with no self-billed e-invoice issued. Our guide to self-billed e-invoice scenarios lists every case where the buyer must issue one.
- Adjustments without a trail. Credit notes and refund notes that do not reference the original e-invoice, or cancellations without a recorded reason.
- Inbound documents not checked. Supplier e-invoices that were never reviewed within the 72-hour window in which a buyer can reject them, leaving incorrect purchase records validated under your TIN.
For a full pre-review self-check, work through our e-invoice compliance checklist for Malaysian businesses.
How to Prepare When the Review Letter Arrives
The 14-day notice period is enough time to prepare well, but only if the work starts on day one. Use this sequence:
- Confirm the letter with the State Operations Director’s office.
- Note the years of assessment and record list requested.
- Appoint a registered tax agent and send LHDN the appointment letter.
- Reconcile MyInvois-validated totals against ledgers and bank statements.
- Decide whether gaps should go through the SVDP first.
- Retrieve overseas-held records and bring them on site.
- Brief the staff that officers are likely to interview.
- Request a deferment early if the date is unworkable.
Only individuals who qualify as tax agents under Section 153(3) of the Income Tax Act 1967 can represent you, and LHDN officers are not allowed to recommend a particular agent. You can also use an interpreter if you are not fluent in Bahasa Malaysia or English. [Framework, Sections 8.1.3, 8.2.3 and 8.3.1]
How JomeInvoice Keeps Your e-Invoice Records Review-Ready
An e-invoice compliance review is decided by whether your MyInvois records reconcile with your ledger, your bank and your counterparties’ data. JomeInvoice is e-invoicing middleware for enterprises that sits between your existing systems and MyInvois, so every outbound, inbound and self-billed document lives in one validated, searchable record instead of across spreadsheets and portal downloads.
What that means when officers ask for records
- One record set for all three document flows. The Sales module manages outbound invoices, credit, debit and refund notes. The Purchase module pulls supplier e-invoices from LHDN so your team can review them and reject incorrect ones within the 72-hour window. The Self-billed module covers the cases where you must issue on a supplier’s behalf.
- Exportable activity trail. The Activity Trail module exports customisable activity log reports, so your team can show how documents were handled when officers ask during a site visit.
- Dates and TINs that hold up. Consolidated and requested e-invoices keep their original invoice dates, and placeholder TINs such as “NA” are rejected at customer and supplier CSV import.
- Works with your current stack. Pre-built connectors cover Shopify, WooCommerce, Loyverse, Salesplay and Cloudbeds. ERPs such as SAP, Microsoft Dynamics and NetSuite connect through our open API, CSV bulk upload or SFTP, without replacing your accounting system.
- Certified infrastructure. JomeInvoice is ISO 9001, ISO 20000-1 and ISO 27001 certified, compliant with the Personal Data Protection Act (PDPA) and MySTI certified (STI202501062), with a Malaysian team that follows every LHDN guideline update.
If a review letter would send your team scrambling across systems, book a demo and we will walk through how your current records would look to an LHDN officer.
The letter gives you 14 days. Your records need to be ready before it arrives.
The e-Invoice Compliance Review Framework turns e-invoice obligations into a fixed process: 14 days’ notice, an on-site inspection of up to two years, penalties per non-compliant transaction and a 90-day close. Businesses with gaps still have the SVDP until 31 December 2027, even after a review notice, so the time to reconcile is now.
Be review-ready before the letter arrives.
Book a demo to see how JomeInvoice keeps your MyInvois records reconciled and easy to produce.
Book a Demo Sign Up Free
Disclaimer: This article is for general informational purposes only and does not constitute legal or tax advice. LHDN guidelines are subject to updates. Always refer to the latest official LHDN e-Invoice Guidelines at myinvois.hasil.gov.my and consult a qualified tax professional for advice specific to your business.
Frequently Asked Questions
What is the e-Invoice Compliance Review Framework?
The e-Invoice Compliance Review Framework is LHDN’s published procedure for checking whether businesses issue, submit and keep e-invoices correctly. Effective 15 December 2025, it sets case selection, notice periods, officer powers, timelines, penalties and objection rights. [Rangka Kerja Semakan Pematuhan e-Invois]
Is an e-invoice compliance review the same as an LHDN tax audit?
No. The e-invoice review runs under its own framework, uses only the comprehensive on-site review method, and tests e-invoice obligations under Section 82C of the Income Tax Act 1967 rather than your income tax return. [Framework, Sections 2 and 3.3]
How much notice does LHDN give before an e-invoice compliance review?
At least 14 calendar days. The notification letter lists the visit date, records to prepare, years of assessment covered, officers’ names and visit duration. You can request a deferment for a reasonable cause. [Framework, Section 6.1]
What records does LHDN inspect during an e-invoice compliance review?
Every record tied to your e-invoice duties: sales and purchase invoices, receipts and orders; debit, credit and refund notes; ledgers, payment vouchers and bank statements; e-invoices validated through MyInvois; and your computer systems, with data downloaded on site. [Framework, Sections 3.3.2 and 6.4]
How many years can an e-invoice compliance review cover?
Up to two years of assessment. Separately, prosecution for an e-invoice offence can be brought up to 12 years from the year it was committed. [Framework, Section 4; Income Tax Act 1967, s.121(1)]
How long do I have to object to e-invoice review findings?
18 calendar days from the date of the findings letter. Submit the objection in writing with additional information and supporting evidence. If LHDN receives no objection in that time, you are deemed to agree with the findings. [Framework, Section 6.5]
Can I still use the SVDP after receiving a review notice?
Yes. The SVDP covers businesses already undergoing, or notified of, an e-invoice compliance review. Disclosed e-invoices face no review, penalty or prosecution, unless fraud, wilful default or negligence is involved. The window closes 31 December 2027. [e-Invoice Specific Guideline v4.8, Section 17]
How much is the penalty for each non-compliant e-invoice?
RM200 to RM20,000, up to six months’ imprisonment, or both, for each non-compliant transaction. Non-compliant findings letters come with a compound offer letter before any prosecution. [Income Tax Act 1967, Para 120(1)(d); Framework, Sections 6.5.2 and 10.1]
Last updated: 15 October 2026 | Written by Yinn Sheng Ng, Head of Marketing