MyInvois ERP Integration

Malaysia

  • Informations vérifiées le : 2026-09-23
  • 7 Sources officielles
  • 7 Liste de contrôle de conformité

Every Malaysian business is in scope for MyInvois e-invoicing since 1 January 2026, but Phase 4 taxpayers keep the relaxed treatment until 31 December 2027 and the exemption threshold rose to RM3 million from 1 September 2026. Dictode builds the MyInvois API integration for Flowyana or your existing ERP, typically in 3–6 weeks.

Informations vérifiées le : 2026-09-23

Échéances et phases

Phase Qui est concerné Échéance Exigence
Phase 1 Annual turnover or revenue above RM100 million 2024-08-01 Interim relaxation period ended 31 January 2025; individual e-invoices required since then
Phase 2 Above RM25 million and up to RM100 million 2025-01-01 Interim relaxation period ended 30 June 2025
Phase 3 Above RM5 million and up to RM25 million 2025-07-01 Interim relaxation period ended 31 December 2025
Phase 4 Up to RM5 million (in practice RM3–5 million after the exemption rise) 2026-01-01 New businesses that commenced in 2023–2025 with turnover of at least RM3 million start on 1 July 2026
RM10,000 transactional rule All industries, every taxpayer in scope 2026-01-01 Any single transaction exceeding RM10,000 requires its own e-invoice (Specific Guideline Table 3.6, item 7) — consolidation is not allowed for it
e-Invoice Special Voluntary Disclosure Programme Taxpayers regularising missed or incomplete e-invoices 2026-07-07 SVDP runs from 7 July 2026 to 31 December 2027 (Specific Guideline v4.9, Section 17)
Exemption raised to RM3 million Turnover or revenue below RM3 million, subject to the shareholder and group tests 2026-09-01 e-Invoice Guideline v4.8 dated 30 August 2026 (Sections 1.6.1(e) and 1.6.10); LHDN's media release gave 1 September 2026 as the effective date, the guideline itself names none
Phase 4 relaxation period ends Taxpayers up to RM5 million with a 1 January or 1 July 2026 implementation date 2027-12-31 Consolidated e-invoices and free-text descriptions accepted until then; full enforcement of individual e-invoices from 1 January 2028

MyInvois portal, API or intermediary — which fits your volume

LHDN's e-Invoice Guideline (Version 4.8, 30 August 2026) gives you two ways to transmit documents: the MyInvois Portal and the MyInvois API. The portal is free, works through MyTax and lets staff key in documents or upload a batch — enough for a firm issuing a few dozen documents a month. The API is a RESTful service that accepts JSON or XML built on UBL 2.1, processes submissions asynchronously and expects your system to poll for the result. Section 2.4 of the guideline lists three API routes: direct integration of your ERP with the MyInvois System, a Peppol service provider, or a non-Peppol technology provider.

An intermediary is a third party you authorise in the portal to act on your behalf. You add it by TIN, business registration number and exact registered name, grant permissions and set a term. It logs in with the "Login as Intermediary System" endpoint using its own client ID and secret, signs with its own digital certificate, and can only see the documents it submitted for you. A group can appoint its own headquarters as intermediary for subsidiaries, which avoids buying a certificate per company.

The practical decision runs on four questions: monthly volume (under fifty documents, use the portal; hundreds, or any POS or subscription volume, use the API), whether you want to hold and renew your own signing certificate, how many legal entities must submit, and whether your ERP already produces clean line-level data — buyer TIN, classification codes, tax type, unit price, tax amount. Direct integration wins when you want the validated UUID and QR link written straight back into your invoice records; an intermediary wins when you would rather not run the signing and retry logic yourself.

The MyInvois API flow step by step

Step one is registration. In the MyInvois Portal (MyTax, then MyInvois, then your taxpayer profile and the Representatives area) you register your ERP by name and receive a client ID and two client secrets with an expiry of up to three years. Sandbox and production are separate systems — preprod.myinvois.hasil.gov.my and preprod-api.myinvois.hasil.gov.my for testing — with their own credentials. An intermediary is added in the same screen and registers its own.

Step two is document mapping. LHDN recognises eight document types: 01 invoice, 02 credit note, 03 debit note, 04 refund note, and 11–14 for their self-billed equivalents. Sales invoices, credit notes and debit notes map cleanly; refund notes and self-billed documents (imports, payments to agents and the other cases in Section 8 of the Specific Guideline) usually need new document types. A consolidated e-invoice is a normal 01 document for the month's receipts and must be submitted within seven calendar days after month end.

Step three is the payload and the digital signature. The SDK defines a JSON convention where every value is wrapped in an underscore key, and an XML variant that needs the usual entity escaping. Documents submitted through the API must be signed in XAdES with SHA-256 and RSA, using an X.509 certificate from a Malaysian certification authority licensed by the MCMC. The certificate profile is specific: the organisation identifier (OID 2.5.4.97) carries your TIN, the serial number carries your BRN, and key usage must include non-repudiation and document signing. A soft certificate (.p12 or .pfx) sits on the ERP server; a roaming certificate lives in the CA's HSM and is called over an API. When a service provider submits for you, the document is signed with the provider's certificate, not yours.

Step four is submission and validation. You call the submit endpoint, receive a submission UID, then poll until each document is reported valid or invalid. A valid document gets a UUID and a long ID; you build the validation link as {envbaseurl}/{uuid}/share/{longid} and render it as the QR code on the PDF. Store the UUID against your own invoice number — every later credit note, debit note or refund note must quote it in the "Original e-Invoice Reference Number" field.

Step five is the 72-hour window. The supplier may cancel a validated e-invoice within 72 hours of validation and reissue it; the buyer may reject it once within the same 72 hours. After that the document is final and every correction is a credit note, debit note or refund note referencing the original UUID, with no time limit on adjustments. Your integration needs a cancel action enabled only inside the window, a listener for buyer rejections, and a rule that a cancelled document is never edited in place.

The RM3 million exemption — a decision table

Test one is turnover. Section 1.6.1(e) of the e-Invoice Guideline exempts taxpayers with annual turnover or revenue of less than RM3 million, measured per year of assessment, and the FAQ says no application or prior approval is needed. Once you reach RM3 million you must implement from 1 January in the second year after that year of assessment — cross the line in 2026 and you start on 1 January 2028.

Test two is ownership. Section 1.6.10 removes the exemption if you have a non-individual shareholder with turnover of at least RM3 million, if you are a subsidiary of a holding company at that level, or if you have a related company or joint venture at that level. LHDN's own example is a RM400,000 subsidiary of a group that already e-invoices: it does not qualify and must implement from 1 July 2026. If any corporate shareholder sits in your cap table, check its turnover before you assume anything.

Test three is whether you are already onboarded. LHDN has answered the question advisers were hedging in early September: the General FAQs updated on 4 September 2026 (questions 17 to 20) say an eligible taxpayer that has already started issuing e-invoices "may discontinue issuing e-Invoices immediately", with no application, or may continue voluntarily. Two things temper that. The exemption is reassessed every year of assessment, so a firm near the line will be back in scope soon, and re-registration, a fresh certificate and re-testing cost more than keeping the flow alive. And large customers may keep asking for validated e-invoices even though the guideline accepts an exempt supplier's ordinary receipt as proof of expense. Our recommendation for a business already onboarded and between RM1 million and RM3 million: keep the credentials and certificate current, decide with your tax agent, and revisit "we are exempt" every year.

What Flowyana does today and what Dictode builds

Flowyana ships the accounting layer this integration needs: the Malaysian sales tax and service tax split in its tax catalogue, invoices, quotations, credit and debit notes, multi-branch operation with per-branch tax registration, a REST API and webhooks. What it does not ship is the e-invoicing layer itself — Flowyana has no MyInvois JSON generation, signing or submission, and it is not on any LHDN list.

Dictode builds the MyInvois integration on top of Flowyana or your existing ERP, typically in 3–6 weeks: document mapping to the eight LHDN types, JSON generation to the SDK schema, XAdES signing with your certificate or through your appointed intermediary, submission with status polling, UUID and QR write-back to the invoice record, 72-hour cancellation and rejection handling, and scheduled consolidated e-invoice runs for the months until 31 December 2027. The same scope applies to systems that are not Flowyana, through a middleware service that reads invoices from SAP Business One, Odoo or a custom application.

Plain words on vendor lists: LHDN does not certify ERPs. Your integration is registered in your own portal as your ERP or your intermediary, under your TIN, and its correctness is proven by validated documents in the sandbox and then production — the evidence we hand over at go-live.

Liste de contrôle de conformité

  • Confirm your implementation date, then run the RM3 million test including the shareholder, holding-company and related-company conditions in Section 1.6.10
  • Register your ERP in the MyInvois Portal, save the client ID and both client secrets, and repeat for preprod, whose credentials are separate
  • Obtain an X.509 signing certificate from an MCMC-licensed Malaysian CA with your TIN in the organisation identifier and your BRN as serial number, or appoint an intermediary that signs for you
  • Map your document types to LHDN codes 01–04 and 11–14 and decide which transactions run individually and which are consolidated monthly
  • Issue an individual e-invoice for every single transaction above RM10,000 and for the industries in Specific Guideline Table 3.6, whatever else you consolidate
  • Build the 72-hour cancellation and rejection handling and store each validated UUID and long ID against your own invoice number
  • Submit consolidated e-invoices within seven calendar days after month end, and diarise 2027-12-31 as the last day of relaxed treatment before enforcement on 1 January 2028

Questions Fréquemment Posées

Une autre question ? Contacter l'équipe commerciale

Is e-invoicing mandatory for a company under RM1 million or under RM3 million?

Not since the threshold rose to RM3 million (e-Invoice Guideline Version 4.8, 30 August 2026; LHDN gave 1 September 2026 as the effective date). A taxpayer below RM3 million is exempt unless it has a non-individual shareholder, holding company, related company or joint venture with turnover of at least RM3 million.

What is the interim relaxation period and when does it end?

A period after each phase's mandatory date in which taxpayers may issue consolidated e-invoices for all transactions and decline requests for individual e-invoices, with no prosecution under Section 120 of the Income Tax Act 1967. It lasted six months for Phases 1 to 3; for Phase 4 it runs until 31 December 2027, with full enforcement from 1 January 2028.

Should I integrate with the MyInvois API directly or through an intermediary?

Directly when you want validated UUIDs and QR links inside your own ERP and are willing to hold a signing certificate. Through an intermediary when you have several entities or do not want to operate signing and retries yourself. Both are API integrations; the difference is whose credentials and certificate the documents carry.

Do I need a digital certificate for MyInvois?

Yes for API submissions. Documents must carry a XAdES digital signature made with an X.509 certificate from a Malaysian CA licensed by the MCMC, with your TIN in the organisation identifier field. If a service provider or intermediary submits on your behalf, the documents are signed with its certificate instead.

Can I cancel or edit an e-invoice after LHDN validates it?

You cannot edit it. The supplier may cancel it within 72 hours of validation and reissue it, and the buyer may reject it once within the same 72 hours. After that, corrections are a credit note, debit note or refund note quoting the original UUID, with no time limit.

Does the RM10,000 rule apply during the relaxation period?

Table 3.6 of the Specific Guideline requires an individual e-invoice for any single transaction exceeding RM10,000 from 1 January 2026, while Section 16.2 permits consolidation "for all activities and transactions" during the relaxation period. Most Malaysian advisers read the RM10,000 rule as not relaxed, and we build integrations that way.

Can Dictode integrate a system that is not Flowyana?

Yes. The integration is a middleware service that reads invoices, credit notes and debit notes from your ERP, builds and signs the MyInvois JSON, submits it, polls for validation and writes the UUID and QR link back. It fits SAP Business One, Odoo and custom applications alike; typical delivery is 3–6 weeks.

Does LHDN certify or list Flowyana?

No, and it lists no ERP: LHDN does not certify products for direct API integration. Each taxpayer registers its own ERP, or an intermediary, in the MyInvois Portal under its own TIN. What proves an integration is validated documents in the preprod sandbox and then in production.

Commencer

Obtenez une démo gratuite de Accounting Software

Parlez-nous de votre entreprise et nous vous montrerons comment il s'intègre — tarifs, migration et déploiement inclus.

Adopté par des entreprises dans plus de 60 pays — développé par Dictode depuis 2019.

Vous préférez WhatsApp ? Discutez avec nous

Ce site est protégé par reCAPTCHA. Google Politique de Confidentialité and Conditions d'Utilisation applicables.