myinvois lhdn e-invoicing compliance deep-dive

LHDN MyInvois Explained: A Deep Dive for Malaysian Businesses

How LHDN MyInvois works in 2026: scope after the RM3m exemption, API login and signing, code tables, real validation errors and the 72-hour rules.

By IntBooks Editorial Team Published 8 April 2026 Updated 29 September 2026

Reading time: ~22 minutes. Audience: business owners, finance managers, and developers responsible for LHDN MyInvois compliance. Skill level: intermediate.

LHDN’s MyInvois system validates e-invoices before they count as e-invoices. Since 1 September 2026, it’s mandatory for businesses with annual turnover of RM3 million or more. Businesses below that are exempt, but LHDN encourages them to adopt it voluntarily (LHDN statement, 30 Aug 2026). This guide covers the technical architecture, the data model, the three different “72-hour” rules, the validation errors you’ll actually see, and your integration options.

Part 1: Why MyInvois exists

MyInvois uses a Continuous Transaction Control (CTC) model: LHDN validates each e-invoice as it’s issued, not months later in a tax return (LHDN General FAQs, Q3). LHDN’s stated aims:

Tax visibility: transactions are recorded with LHDN as they happen.
Less fraud: supplier and buyer TINs are checked against LHDN’s records when the document is validated.
A single digital trail: invoices, credit notes, debit notes and refund notes sit in one system.

Who is in scope? Scope depends on turnover, not SST registration. The rollout ran in four phases: above RM100 million from 1 Aug 2024, RM25–100 million from 1 Jan 2025, RM5–25 million from 1 Jul 2025, and up to RM5 million from 1 Jan 2026 (Bernama, 5 Jun 2025; Bernama, 6 Dec 2025). The exemption threshold rose from RM500,000 to RM1 million on 1 Jan 2026, then to RM3 million on 1 Sep 2026.

Part 2: The technical architecture

MyInvois has three parts.

1. The MyInvois Portal (web UI)

A web interface where you create, submit and track e-invoices by hand. It handles single e-invoices and batch spreadsheet uploads (LHDN General FAQs). Production is myinvois.hasil.gov.my; the sandbox is preprod.myinvois.hasil.gov.my (MyInvois SDK FAQ).

2. The MyInvois API (machine interface)

A REST API for software. The production API host is api.myinvois.hasil.gov.my; the sandbox host is preprod-api.myinvois.hasil.gov.my (MyInvois SDK FAQ).

Authentication. Your ERP system logs in with the OAuth 2.0 client credentials flow, using a client ID and client secret. The access token lasts one hour, and LHDN asks you to reuse it rather than log in for every call (Login as Taxpayer System). A separate login lets an intermediary act on behalf of a taxpayer.

Signing. Each document is digitally signed. The signing certificate must come from a certification authority licensed in Malaysia. The SDK FAQ points to MCMC’s list of licensees and accepts both soft and roaming certificates (MyInvois SDK FAQ).

Key endpoints (from the SDK):

POST /api/v1.0/documentsubmissions/: submit one or more documents
GET /api/v1.0/documentsubmissions/{submissionUid}: check a submission’s status
GET /api/v1.0/documents/{uuid}/raw: get a document’s source and its validation-link details
GET /api/v1.0/documents/{uuid}/details: get a document with its validation results

Formats and limits. Documents can be XML or JSON (UBL 2.1-based). Each submission can carry up to 100 documents and 5 MB, and each document up to 300 KB (Submit Documents). There’s no limit on invoice lines as long as those size limits are met (LHDN General FAQs, Q81).

3. The validation engine

LHDN runs each document through a series of validators (MyInvois SDK: validation rules):

Structure: does the document match the document type’s schema?
Core fields: are the essential fields present and well-formed?
Signature: is the signature present, and does the signer match the submitter?
Taxpayer: are the supplier and buyer valid taxpayers at the issue date?
Referenced documents: do credit, debit and refund notes point to valid originals?
Codes: are classification, tax type, state and other codes valid?
Duplicates: is it a duplicate of a recent document?
Currency: are currency codes and exchange rates used correctly?

A document that passes becomes Valid, and LHDN assigns it a Unique Identifier Number (UIN). LHDN says validation is near real-time, generally under 2 seconds (LHDN General FAQs, Q28). You get a validation link that can be embedded as a QR code on the copy you give your customer. Any QR scanner can read it (LHDN General FAQs, Q88).

Part 3: The data model: what’s on an e-invoice

LHDN’s e-Invoice Guideline lists the required fields. Check it for the full list. The main groups:

Supplier

TIN: a prefix plus digits. Individuals use IG; companies C, partnerships D, LLPs PT, cooperatives CS, and so on. Non-individual TINs end in 0 (LHDN TIN guide; MyInvois SDK FAQ)
Name: legal name as registered
Registration number: for SSM-registered businesses, the 12-digit number SSM has used since October 2019 (SSM)
MSIC code: 5-digit business activity code (SDK)
SST registration number, if registered
Address and contact details

Buyer

TIN and registration or identity number (BRN, NRIC, passport or army number)
Name, address and contact details
SST registration number, if registered
For consolidated e-invoices to the general public, LHDN’s general TIN EI00000000010; for foreign buyers without a TIN, EI00000000020 (LHDN General FAQs, Q20)

Document

e-Invoice type: invoice 01, credit note 02, debit note 03, refund note 04, and self-billed versions 11 to 14 (SDK)
Your invoice number: it stays on the document alongside LHDN’s UIN (LHDN General FAQs, Q30)
Issue date and time
Currency and, if not MYR, the exchange rate
Original e-invoice reference: for credit, debit and refund notes, the UIN of each original e-invoice

Line items

Classification code: one of 45 LHDN codes, 001 to 045. For example, 004 is “Consolidated e-Invoice” (SDK: classification codes)
Description, quantity, unit of measure, unit price
Discounts and charges
Tax type: 01 sales tax, 02 service tax, 03 tourism tax, 04 high-value goods tax, 05 sales tax on low value goods, 06 not applicable, E tax exemption (SDK: tax types)
Tax rate and amount, and the line subtotal

Totals

Total excluding tax, total tax, total payable, plus any document-level discounts, charges or rounding

The totals must add up. Build your documents from the SDK’s samples rather than by hand.

Part 4: The three “72-hour” rules

“72 hours” turns up in three different MyInvois rules. Mixing them up is a common source of confusion.

Issue date can’t be too old. The API rejects a document whose issue date and time is more than 72 hours before submission. The message reads “Issuance date time value of the document is too old” (MyInvois SDK FAQ). Submit when you invoice.
Cancel within 72 hours of validation. A supplier can cancel a valid e-invoice within 72 hours of the time it was validated. After that, adjust it with a credit, debit or refund note (Cancel Document).
Buyer rejects within 72 hours of validation. A buyer can request rejection within the same 72-hour window. The document stays Valid until the supplier cancels it, and a document can be rejected only once (Reject Document).

There’s a fourth use too. If MyInvois itself is down, suppliers get 72 hours after it comes back to issue the e-invoice (LHDN General FAQs, Q89).

Apart from specific cases, LHDN sets no general deadline for issuing an e-invoice. The main exception is the monthly consolidated e-invoice, due within 7 calendar days after month-end. Self-billed e-invoices for imports and e-invoices for foreign income have their own deadlines (LHDN General FAQs, Q24).

The safest approach is to submit at the moment you issue the invoice.

Part 5: Rejections and how to handle them

When a document fails, LHDN returns an error code and message from the validator that failed. Codes you’re likely to meet (validation rules):

TIN problems (`ERR401`, `ERR406`, `ERR246`)

“Supplier TIN is invalid”, “Buyer TIN is invalid”, or “TIN and identity type combination is invalid” (taxpayer validator).

Fix: Check the TIN and the matching ID number (BRN or NRIC) together. LHDN’s Validate TIN API is meant to be used when you set up the customer, not before every submission (Validate TIN).

General TIN misuse (e.g. `ERR228`)

“General TIN (010) is not allowed for NON-consolidated e-invoice”. The general public TIN belongs on consolidated e-invoices. Individual e-invoices need the buyer’s own details.

Invalid codes (`CV302`)

“ItemCode … does not exist in CodeType …”. A classification, unit, tax type or other code isn’t in LHDN’s list (code validator).

Fix: Map your items to the current SDK code tables.

Referenced document problems (`DR304`, `DR303`, `DR307`, `DR308`)

A credit, debit or refund note points to a document that isn’t found, isn’t valid, or has a different supplier or buyer (referenced documents validator).

Fix: Confirm the original e-invoice is Valid and that you quoted its UIN.

Signature problems (`DS301`, `DS311`, `DS322`)

Missing signature, a signer who doesn’t match the submitter, or a document changed after signing (signature validator).

Fix: Check that your certificate matches your TIN, and that nothing modifies the document after it’s signed.

Duplicates (`DV302`, `DuplicateSubmission`)

The document matches one you submitted recently (duplicate validator). The submission API also rejects an identical submission sent within 10 minutes (Submit Documents).

Fix: Check the earlier submission before you resend.

Issue date too old

Covered in Part 4. Set the issue date within 72 hours of submission.

LHDN adds and changes error codes over time. Log the full message and property path it returns.

Part 6: Integration approaches

You can transmit through the MyInvois Portal, through the API, or both, as long as you don’t duplicate e-invoices (LHDN General FAQs, Q3 and Q80).

Approach 1: Portal, one at a time

Approach 2: Portal batch upload

The Portal accepts a spreadsheet upload for batches. It’s faster than typing, but you still prepare the file yourself.

Approach 3: Accounting software

Use accounting software that submits to MyInvois through the API. The software handles building, signing, submitting, retries and UIN storage. IntBooks works this way, and so do many other Malaysian accounting packages. Check each vendor’s current plan details.

Approach 4: A service provider, including Peppol

LHDN accepts any transmission method, including Peppol service providers, that meets its API requirements. It doesn’t currently register or certify technology providers (LHDN General FAQs, Q83–85).

Approach 5: Your own API integration

With an in-house ERP, you can integrate directly. You’ll need:

A client ID and client secret for your ERP system
A digital certificate from a certification authority licensed in Malaysia
Code to build UBL 2.1 documents in XML or JSON and to sign them
Code to submit, poll for results, handle retries and errors, and respect rate limits
Storage for UINs, validation links and LHDN’s responses

This is a substantial engineering job. Unless your requirements are unusual, off-the-shelf software is usually the better route.

Part 7: Sandbox vs production

Environment	Portal	API
Sandbox	`preprod.myinvois.hasil.gov.my`	`preprod-api.myinvois.hasil.gov.my`
Production	`myinvois.hasil.gov.my`	`api.myinvois.hasil.gov.my`

Source: MyInvois SDK FAQ. Sandbox documents aren’t legally valid e-invoices.

Before going live, test your common scenarios in the sandbox:

A B2B invoice with several lines
A consolidated e-invoice using the general public TIN
A foreign-currency invoice with an exchange rate
Lines with different tax types (e.g. taxable and not applicable)
A credit note against a valid invoice
A refund note
A self-billed invoice, if you issue them
A cancellation inside the 72-hour window
A large invoice, to check you stay under the 300 KB limit

Part 8: Practical tips

Tip 1: Validate TINs when you create the customer

LHDN’s own guidance is to validate the TIN during buyer set-up and cache the result, not before every submission (Validate TIN). A wrong TIN found at invoice time means reworking a finished invoice.

Tip 2: Monitor documents that aren’t yet Valid

LHDN processes submissions asynchronously. Poll the submission status (the SDK suggests 3–5 seconds between requests) and alert on anything still Submitted or Invalid (Get Submission).

Tip 3: Don’t backdate

The API rejects issue dates more than 72 hours before submission. Issue with the current date and put the service period in the description.

Tip 4: Issue credit notes from the original invoice

Credit notes are the most error-prone type because they must quote the original UIN. Train staff to start from the original e-invoice, check it’s Valid, and issue the note from there.

Tip 5: Keep a log of rejections

Keep each rejection, its error message and how you fixed it. It helps explain any gaps if LHDN asks later.

Tip 6: Respect the rate limits

The SDK recommends at most 100 requests per minute per client ID for submissions and 12 per minute for logins, cancellations and rejections (Submit Documents; Login; Cancel). Send up to 100 documents per submission, reuse your access token, and queue large month-end batches.

Part 9: Special cases

LHDN’s e-Invoice Specific Guideline covers transactions that don’t fit the standard supplier-to-buyer pattern, including:

Consolidated e-invoices: monthly, for buyers who don’t ask for an e-invoice, except the activities listed in section 3.7 of the Specific Guideline (LHDN General FAQs, Q25)
Self-billed e-invoices: issued by the buyer, e.g. for imports, or for payments to agents, dealers or distributors
Foreign income, cross-border transactions and foreign buyers without a Malaysian TIN

Rules for these cases have changed several times, including the treatment of large single transactions in consolidated e-invoices. Check the current Specific Guideline for your sector before you go live.

Ready to implement?

If you’re in scope, or adopting voluntarily:

Request closed-beta access to IntBooks
Enter your organisation’s TIN, registration number and MSIC code
Grant IntBooks intermediary permissions for your TIN in MyInvois
Collect your customers’ TINs and ID numbers
Submit your first e-invoice and check it validates

If you need help, contact our Malaysia-based team.