The penalty-free period for many Malaysian businesses runs until 31 December 2027 — but that has created a dangerous misunderstanding. Penalties are not the immediate risk. Rejected invoices are. Since 15 August 2026, HASiL's stricter field validation is live in the MyInvois production system, and a rejected invoice never reaches your customer: no invoice, no payment, no fine required.
The three checks catching businesses out
- Date formats. Dates must be written as YYYY-MM-DD. Entries like "N/A" are no longer accepted anywhere.
- State Code 17 ("Not Applicable"). It may only be used on consolidated e-invoices issued in Malaysia, or on transactions outside Malaysia. If your system uses it as a general fallback on normal invoices, those invoices now fail.
- Scientific notation. Every amount field must be a plain number. A total exported as 1E3 instead of 1000 bounces. This mostly bites businesses generating invoices from Excel or custom scripts rather than standard accounting software.
Also enforced: character limits on bank account numbers (max 150), invoice codes (max 50), incoterms (max 3), payment terms (max 300), and buyer TIN/BRN matching against HASiL records (live since 1 August — an outdated BRN gets the invoice rejected outright).
What to do today
- If invoices started failing after 15 August, check dates, state codes, and amount formats first — they explain most rejections.
- Spreadsheet or custom-script invoicing? Test one submission in the MyInvois sandbox before your next billing run.
- Ask regular business customers to confirm their current 12-character SSM BRN, and update your master data.
- Behind on past e-invoices? HASiL's Special Voluntary Disclosure Programme runs until 31 December 2027 — a low-pressure way to regularise before enforcement.