Process Description Malaysia
Introduction
Malaysia has mandated e-invoicing for businesses with a gradual roll-out that started on 1 August 2024. The Inland Revenue Board of Malaysia (LHDNM) defines an e-invoice as a file created in the format specified by the new regulations that can be automatically processed by the relevant accounting system. The file created will then be submitted to IRB's central platform for real-time verification as part of a clearance model. Two methods are available for transmitting invoices to the IRB's central platform: manually via the MyInvois portal or automatically via API in either XML or JSON format. A Certification Serial Number will be generated once the invoice is approved and the IRB will send an email notifying both the issuer and recipient.
In addition to the tax reporting and compliance requirements developed by LHDNM, another government agency (i.e. MDEC) is working on a business e-invoicing digitalization framework via Peppol. In this respect a Malaysian version of Peppol PINT is being developed. It does not appear that the implementation of interoperable e invoicing for business digitalization run by MDEC will be mandatory just yet.
The timeline of the e-invoicing mandate is as follows:
01/01/2024: voluntary implementation of e-invoicing;
01/08/2024: mandatory implementation for businesses that reach a sales threshold value of MYR 100 million annually. The Inland Revenue Board of Malaysia has announced that they are targeting 4,000 businesses for the first mandatory stage of the new e-invoicing system;
01/01/2025: mandatory implementation for taxpayers with an annual turnover or revenue of more than MTR 25 million and up to MYR 100 million;
01/07/2025: mandatory implementation for all other taxpayers
Process Overview - Outbound
Process Steps Overview - Outbound
Step 1 - Creation and Submission
Step 2 - E-Invoice Validation
Step 3 - Notification
Step 4 - Sharing of e-Invoice & visual representation
Step 5 - Rejection or Cancellation
Step 6 - Storing e-Invoices (Optional) - LTA
Step 1 - Creation and Submission
Upon completion of a sale or transaction (including adjustments to the electronic invoice such as direct debit, credit note and refund), the supplier creates an electronic invoice and sends it to Retarus in in-house format. Please make sure to fill in the required mandatory fields. These can be found in the specification/appendix 1 here: Specification. The following invoice types are supported: Invoice, credit note, debit note, refund note and corresponding self-billed invoices.
Retarus converts the invoice into the required XML format, checks the invoice, signs it with the customer-specific certificate (see Prerequisites) and then transmits it via API to IRBM and the MyInvois portal.
Step 2 - E-Invoice Validation
Once validated, the Supplier will receive a validated e-Invoice as well as a visual representation of the validated e-Invoice in PDF from IRBM via Retarus or the MyInvois Portal. The IRBM Unique Identifier Number, date and time of validation, and validation link will be assigned to the validated e-Invoice. The IRBM Unique Identifier number will allow traceability by IRBM and will reduce instances of tampering with the e-Invoice.
If the e-Invoice is returned invalidated, an error message will be displayed. The Supplier is required to correct the error and submit it for validation again once the errors have been corrected.
Step 3 - Notification
Once validated by the MyInvois System, Retarus will receive an API response which contains the following:
the IRBM Unique Identifier Number from IRBM;
date and time of validation; and
information to form validation link via API.
The IRBM Unique Identifier Number will allow traceability by IRBM. If errors are detected during validation, an API error response will be shown. Accordingly, API response will be provided upon successful validation. Once the e-Invoice is successfully validated, notification will be sent by IRBM to the Supplier and Buyer via e-mail.
Status | Value | Note |
|---|---|---|
Submitted | 1 | This means the invoice has passed initial structure validations but is still pending additional validations to be completed |
Valid | 2 | The status of a successful invoice validation |
Invalid | 3 | The status of a submitted invoice with validation issues |
Cancelled | 4 | The status of an invoice cancelled by the issuer |
Step 4 - Sharing of e-Invoice & visual representation
Upon validation of the e-Invoice, the Supplier is obliged to share the validated e-Invoice with the Buyer. In the event the Supplier shares the visual representation of the e-Invoice to the Buyer, the Supplier is required to ensure that the QR code is embedded accordingly, which the QR code can be used to validate the existence and status of the e-Invoice via MyInvois Portal. However, the IRBM acknowledges that there may be practical challenges in sharing the validated e-Invoice with the Buyer. Therefore, until further notice, the IRBM provides a concession allowing the Supplier to share either the validated e-Invoice or a visual representation of the validated e-Invoice with the Buyer. Retarus will transmit the PDF via E-Mail to the buyer.
Step 5 - Rejection or Cancellation
Please note: This process step can only be implemented, if the Retarus customer is able to send/trigger a rejection or cancellation message with the required information from his ERP system. If this is not possible, the customer must use the myInvois Portal to reject or cancel invoices.
Once the e-Invoice has been validated by IRBM, Supplier and Buyer are allowed to cancel or reject the said e-Invoice, within a stipulated time.
Buyer to request rejection of the e-Invoice via API
If the e-Invoice contains errors, the Buyer is able to request a rejection of the e-Invoice within 72 hours from the time of validation via API.
The rejection request in the request body of the API should specify the unique identifier of the e-Invoice and the reason for rejection, which can include erroneous information (e.g., SST number, business registration number, any business-related information, etc.).
Upon the Buyer initiating the rejection request, a notification will be sent to the Supplier.
If the Supplier is satisfied / agreeable to the reason provided, the Supplier may proceed to cancel the said e-Invoice within 72 hours from the time of validation. If the Supplier did not accept the request for rejection initiated by the Buyer (or did not proceed to cancel the said e-Invoice), no cancellation would be allowed after the 72 hours have elapsed. Any amendment thereon would require a new e-Invoice (e.g., credit note, debit note or refund note e-Invoice) to be issued.
Supplier to perform cancellation of e-Invoice via API
a. If the e-Invoice contains errors or was erroneously issued, the Supplier can cancel the e-Invoice within 72 hours from the time of the validation via API where the request body of the API must contain the unique identifier of the e-Invoice.
b. Upon cancellation, a notification will be sent to the Buyer. The Supplier would need to issue a new e-Invoice in accordance with Step 1 above, if applicable.
Prerequisites
TIN required
In Malaysia, both individuals and entities who are registered taxpayers with the Inland Revenue Board of Malaysia (IRBM) are assigned with a Tax Identification Number (TIN) known as “Nombor Pengenalan Cukai”. To facilitate the retrieval and verification of TIN for taxpayers, there are two (2) primary avenues available:
Utilise the MyTax Portal which allows businesses to conveniently check their TIN;
In the event that a TIN cannot be retrieved through this channel, taxpayers can use the e-Daftar platform to initiate registration and obtain their respective TIN via the steps below:
Log in to MyTax Portal (https://mytax.hasil.gov.my)
Choose the e-Daftar option
Fill in the required fields (e.g., type of taxpayer, e-mail and phone number / mobile number)
Click “Search” to register taxpayer’s
Credentials (Retarus → IRBM/myInvois Portal API
The Taxpayer needs to obtain the credentials (Client Id and Client Secret) from the IRBM Portal as described here. Different credentials are required for UAT and PRD. The Taxpayer needs to follow the Guidelines in the User Manual which can be found at the top left menu in each website.
Certificate
Taxpayer to request a signing soft certificate from Malaysian CA, the list of CAs:
Sample used by existing customer:
https://www.posdigicert.com.my/digital-certificate-for-einvoice
Signing spec for developers: https://sdk.myinvois.hasil.gov.my/signature/
Resources
The following links are the official government resources that include detailed and valuable information on various topics:.
Process Overview - Inbound
Process Steps Overview - Inbound
Step 1 - Receiving Invoice
Step 2 - Reject Invoice
Step 1 - Receiving Invoice
Retarus continuously checks the myInvois web service to see if new incoming invoices are available for the Retarus customer. As soon as a new invoice is available, Retarus retrieves it, converts it into the customer-specific EDI in-house format and transfers it to the customer's ERP system.
Step 2 - Reject Invoice
The customer has the option of rejecting an invoice. They can do this via the myInvois portal.