Key Takeaways
- LHDN can look back 7 years across your business records, and the burden of proof sits with you as the taxpayer.
- Section 82 of the Income Tax Act 1967 and Section 245 of the Companies Act 2016 set the rules for what to keep and for how long.
- 7 years is a floor, not a ceiling. Late returns, pending appeals, and suspected fraud or wilful default can extend retention indefinitely.
- A small, dull, repeatable retention system (one cloud drive, fixed folder structure, weekly upload) is more practical than a Year 7 panic.
- MITRS, effective YA 2025 for companies and LLPs, means weak record keeping now bites at filing time, not just during an audit.
Under Malaysia's Income Tax Act 1967, an LHDN 7 year audit in Malaysia can reach back across the past seven years of your business records, and the burden of proof sits with you as the taxpayer, not with the officer. If you cannot produce a receipt, an invoice, or a bank statement on request, LHDN is entitled to assume the worst.
For most Malaysian SME owners, that is a quietly stressful idea. You are running the business, chasing collections, and dealing with staff. You are not sitting in a back room labelling folders by year of assessment.
This guide explains exactly how far back LHDN can look, which records you must keep under Section 82 of the Income Tax Act 1967 and Section 245 of the Companies Act 2016, and how to set up a simple retention system that you and your team can actually follow. It also covers two things most other articles miss: when 7 years is not enough, and why MITRS has changed when poor record keeping starts to hurt.
The 7-year LHDN record rule, in plain English
Two laws set the rule, and they overlap.
Section 82 of the Income Tax Act 1967 requires every person carrying on a business in Malaysia to keep sufficient records for 7 years from the end of the year of assessment to which they relate.
Section 245 of the Companies Act 2016 requires every Malaysian company to keep accounting records for 7 years from the completion of the transactions or operations to which they relate.
The two rules do not cancel each other. Most Sdn Bhd companies need to satisfy both at the same time.
The rule applies to:
- Sdn Bhd companies
- Limited liability partnerships (LLPs)
- Sole proprietorships
- Partnerships
- Anyone carrying on a business in Malaysia, including freelancers and online sellers
Records must be kept in Bahasa Malaysia or English, and they must be physically kept in Malaysia or be readily producible at your registered office or business premises in Malaysia on request. Entries should be made within 60 days of the transaction. If your books live entirely on a foreign cloud server with no local copy, you are technically outside the rule. A local backup or printout that can be produced within the day usually keeps you compliant.
How far back can LHDN audit your business?
In most cases LHDN audits the latest 3 years of assessment, but the open tax window stretches to 5 years, and there is no time bar at all if LHDN suspects fraud, wilful default, or negligence. That is why Malaysian businesses must keep records for at least 7 years, and longer in some cases.
In practice, officers usually start with the most recent 3 years of assessment during a desk or field audit. This is the typical audit window you will hear quoted by tax agents.
Beyond that, Section 91(1) of the Income Tax Act 1967 allows LHDN to raise an additional assessment within 5 years after the end of the year of assessment. If you under-declared income, missed allowable expenses, or claimed something LHDN now disputes, anything within those 5 years is fair game.
There is also the no-limit rule under Section 91(3). If the Director General is of the opinion that there has been fraud, wilful default, or negligence, there is no statutory time bar at all. Cases where LHDN has gone back 10 years or more do exist, particularly for transfer pricing disputes, undeclared property gains, and cash businesses with weak records.
If you want a clearer picture of how an LHDN tax audit Malaysia actually unfolds and what your rights are during the process, read that guide before you start cleaning up your filing cabinet.
What counts as "sufficient records" under Section 82
LHDN's three Public Rulings (4/2000, 5/2000, and 6/2000) describe sufficient records in detail. Below is a practical checklist for an SME.
Books of accounts and ledgers
General ledger, cash book, sales ledger, purchases ledger, journal, and a trial balance for each financial year.
Source documents
Sales invoices, purchase invoices, official receipts, debit notes, credit notes, payment vouchers, cheque butts, pay-in slips, and bank statements. Source documents must reconcile to the ledger entries.
Payroll, EPF, SOCSO, EIS, PCB
Monthly payroll registers, EPF Form A, SOCSO Form 8A, EIS submissions, PCB submissions, employment contracts, and the annual Form EA for each employee plus Form E for the employer.
Stock and inventory
Stock take figures at year-end, valuation methods, and supporting count sheets.
Fixed asset register and capital allowance schedules
Acquisition invoices, disposal records, and the capital allowance computation schedule attached to your tax return. Disposal documentation matters even more when the gain spills into capital gains tax vs RPGT Malaysia territory, so keep the original purchase agreement, the disposal contract, and any valuation reports together with the asset register.
Lists of debtors, creditors, assets, and liabilities
Aged debtor and creditor listings as at year-end, supported by the underlying invoices.
Contracts and resolutions
Customer contracts, supplier contracts, lease agreements, loan agreements, and director's resolutions affecting the financials.
e-Invoices and MyInvois files
The validated XML or JSON files from MyInvois, the Unique Identifier Number, the QR code, and the visual representation. e-Invoice records must be retained for at least 7 years.
If your books still live across paper, email attachments, and WhatsApp screenshots, this is the time to standardise. A clean record set also makes your annual tax compliance checklist Sdn Bhd Malaysia feel routine instead of overwhelming.
How to organise records: digital vs physical
The Income Tax Act allows electronic records, provided they are readable, retrievable, and convertible into hard copy on request. In practice, a hybrid system works best for most SMEs.
Folder structure by year and category
Use one folder per financial year, then sub-folders by category. For example:
/2026/01_sales_invoices//2026/02_purchase_invoices//2026/03_bank_statements//2026/04_payroll//2026/05_einvoices//2026/06_contracts//2026/07_fixed_assets/
This is dull, but it is the difference between a 30-minute audit response and a 30-day one.
File naming convention that survives staff turnover
Pick one format and stick with it. A common pattern is YYYYMMDD_supplier_invoice-no.pdf. Date first means files always sort chronologically, even after the staff member who set up the system has moved on.
Cloud storage rules
Choose one cloud drive (Google Drive, OneDrive, Dropbox, or your accounting platform's document store). Restrict edit access to two people. Set up at least one off-site backup, monthly.
When physical originals are still required
Stamped contracts, original Form 9, original Form 24, board resolutions with wet signatures, and documents bearing duty stamps should be kept in a locked cabinet at the registered office, scanned, and indexed.
How to convert paper to compliant digital records
Scan at 300 dpi, save as PDF, and name the file using your convention. Keep the paper original for at least the same retention period unless your tax agent advises otherwise.
A simple 7-year retention system you can set up this week
Most SMEs do not fail at record keeping because the rules are unclear. They fail because no one is responsible for it. The fix is a small, dull, repeatable system.
- Designate a record owner. Usually the finance or admin lead. Their KPI is: all source documents are uploaded within 7 days of the transaction.
- Pick one cloud drive. Not three. Not WhatsApp. One.
- Standardise the folder structure as set out above. Build it once for the current year, copy it forward each January.
- Standardise the file name.
YYYYMMDD_supplier_invoice-no.pdf. Train every team member who handles documents. - Run a weekly upload routine. Friday afternoon, 30 minutes, no exceptions.
- Reconcile monthly. Match bank statements to invoices and receipts within 7 days of month-end.
- Annual archive. At year-end, lock the folder, generate a checklist of what is inside, and back up off-site.
- Bring your tax agent in once a year for a sufficiency review. Better to fix gaps now than during an audit.
- Destruction log at year 8. Before destroying anything, confirm there is no late return, pending appeal, or open dispute. Log what was destroyed, when, and by whom.
If you have never filed a return because the business made a loss, do not skip this system. As we explain in filing a tax return when your business makes a loss in Malaysia, you still have to file, and you still have to keep records.
The MITRS shift: why 7-year records now matter sooner
From YA 2025, companies and LLPs must submit specified documents to LHDN through the Malaysian Income Tax Reporting System (MITRS) within 30 days after the income tax return form is filed.
The specified documents include:
- Audited Financial Statements (or Unaudited Financial Statements / Settlement Account, where applicable)
- Income Tax Computation
- Supporting working papers required under Section 82B of the Income Tax Act 1967
This changes the timing of the pain. Before MITRS, untidy records only mattered when LHDN opened an audit, which might be years later. Under MITRS, your tax agent now needs to upload finished, defensible documents within 30 days of filing the return. Late uploads, missing schedules, or computations that do not tie back to your books are visible to LHDN immediately.
There is a knock-on effect with e-invoicing. e-Invoices generated through MyInvois must be retained for at least 7 years, and the validated XML files form part of the audit trail LHDN can pull at any time. If you are still figuring out how MyInvois fits in, our explainer on what is e-invoicing in Malaysia covers the basics.
When 7 years is not enough: the longer retention triggers
Most ranking pages stop at "keep records for 7 years". Several real-world scenarios extend the retention period beyond that.
Late returns. The 7-year clock under Section 82 runs from the end of the year of assessment or from the year the return is furnished, whichever is later. If you filed YA 2018 only in 2024, you must keep those records until 2031, not 2025.
Pending appeal or dispute. If you have lodged an appeal, or there is an unresolved query with LHDN, keep all related records until the matter is finally determined and any further appeal window has closed.
Suspected fraud, wilful default, or negligence. Under Section 91(3), there is no statutory time bar. In practice, you should keep records relating to any aggressive tax position, related-party transactions, or large one-off items beyond the 7-year minimum.
Civil contracts. The Limitation Act 1953 imposes a 6-year limitation on contract claims. Keep contracts and supporting evidence for at least 6 years from the end of the contract, which often means longer than 7 years from the original transaction date.
Director's right of inspection. Section 245 of the Companies Act 2016 also gives directors a right to inspect accounting records. Outgoing directors may request access to records relating to their period in office. If you sit on a board, an advance to director Malaysia tax review is a good prompt to check that current and historical records are intact.
Penalties for missing or insufficient records
The cost of weak record keeping shows up in three places.
Income Tax Act 1967, Section 119A. Failure to keep sufficient records under Section 82 carries a fine of up to RM10,000, imprisonment of up to 12 months, or both, on conviction. The exact amount depends on the offence and the court.
Companies Act 2016, Section 245(9). Failure to keep proper accounting records under Section 245 can attract a fine of up to RM500,000, imprisonment of up to 3 years, or both. The penalty applies to the company and every officer in default, including directors and the company secretary.
Best judgement assessment. Under Section 91 of the Income Tax Act 1967, where records are insufficient, LHDN can raise a best judgement assessment using its own estimates. These assessments are usually unfavourable to the taxpayer, and the burden of disproving them sits with you.
For an SME, the third risk is often the most expensive. A best judgement assessment for 5 years of disputed expenses can wipe out a year's profit. If you are also worried about deadline penalties, we cover those separately in our piece on LHDN penalties for late tax filing.
Where this leaves you
Record keeping is not glamorous, and no one will thank you for it on a Friday afternoon. The compounding benefit is that when LHDN does come knocking, whether for a routine 3-year audit, a 5-year assessment review, or an unexpected query on a 10-year-old transaction, your team can respond in days rather than weeks.
A sensible next step is to walk into your finance folder this week, count how many of the records in Section 3 of this article you can produce within 24 hours, and fix the gaps. If the answer is uncomfortable, speak to SSAM Group. Our tax filing and compliance in Kuala Lumpur is backed by 40 years of experience as a MOF-licensed tax agent supporting 1,000+ Malaysian businesses, and we can review your records, set up a retention system, and stand beside you if LHDN does come asking.
WhatsApp the team on +6011-6529 9879 or email tax@ssam-group.com for a calm, no-pressure conversation.
Frequently asked questions
How long must I keep business records in Malaysia?
At least 7 years from the end of the year of assessment under Section 82 of the Income Tax Act 1967, and 7 years from the completion of the transaction under Section 245 of the Companies Act 2016. Keep them longer if you filed late, you have an open appeal, or LHDN is investigating you.
How far back can LHDN audit me?
The standard audit window is the latest 3 years of assessment. LHDN can raise an additional assessment within 5 years under Section 91(1). If LHDN suspects fraud, wilful default, or negligence under Section 91(3), there is no statutory time limit at all.
Can I keep all my business records digitally instead of paper?
Yes, provided the digital records are readable, retrievable, and can be converted to hard copy on request. Keep paper originals of stamped contracts, board resolutions with wet signatures, and any document bearing duty stamps. Many of the common tax filing mistakes Malaysian SMEs make start with abandoning paper records too quickly, so review that list before you decide.
What happens if I lose receipts from a few years ago?
LHDN can fall back on a best judgement assessment under Section 91, usually to the taxpayer's disadvantage. Try to recover the records by contacting suppliers, banks, and your e-invoice trail. If recovery fails, your tax agent can help you negotiate the position rather than leaving it to LHDN's estimate.
Do I still need to keep tax records if my Sdn Bhd is dormant or made a loss?
Yes. Filing is mandatory even at a loss, and the same 7-year retention applies. Loss carry-forward claims also require evidence in future years, sometimes well beyond the original year of assessment.
Where must my business records be physically kept?
Records must be kept in Malaysia, or be capable of being produced at your registered office or business premises in Malaysia on request. A foreign-only cloud setup with no local copy is a compliance risk under Section 82.
Data Sources / References
- LHDN Public Ruling 4/2000 (Revised), Keeping Sufficient Records (Companies & Co-operatives): https://phl.hasil.gov.my/pdf/pdfam/PR4_2000_Rev.pdf
- LHDN Public Ruling 5/2000 (Revised), Individuals & Partnerships: https://phl.hasil.gov.my/pdf/pdfam/PR5_2000_Rev.pdf
- LHDN Public Ruling 6/2000 (Revised), Persons other than Companies or Individuals: https://phl.hasil.gov.my/pdf/pdfam/PR6_2000_Rev.pdf
- LHDN Tax Audit Framework on Income Tax and Employer (March 2025): https://www.hasil.gov.my/media/wgpombsp/20250315_tax-audit-framework-on-income-tax-and-employer.pdf
- LHDN MITRS portal: https://www.hasil.gov.my/en/quick-links/services/mitrs/
- LHDN MITRS Filing Programme (Section 82B): https://www.hasil.gov.my/en/forms/filing-programme-for-documents-specified-under-section-82b-ita-1967-through-mitrs/
- Companies Act 2016 (SSM): https://www.ssm.com.my/Pages/Legal_Framework/Document/Companies%20Act%202016_Akta%20777_BI%20(1.8.2022).pdf
The information in this article is provided for general informational purposes only and does not constitute tax, accounting, financial or legal advice. Tax laws change frequently and may not apply to your situation. Always consult a qualified professional before acting on any information here.
