A tax audit in Malaysia is not bad luck. LHDN selects cases from data, and foreign-owned subsidiaries carry more of the markers that drive selection than almost any other category of taxpayer: transactions with a related party overseas, management fees paid to a parent, thin or negative margins in the early years, withholding tax on cross-border payments, and — since e-Invoice — a transaction-level feed of their own invoices sitting in the tax authority's system. The Tax Audit Framework on Income Tax and Employer (TAF ITE), effective 15 March 2025, widened the scope of a single audit to cover income tax, withholding tax, capital gains tax, Labuan business activities and employer obligations together. This guide sets out what triggers an audit, what the penalty ladder actually costs at each rung, how the five-year time bar works and when it disappears entirely, and why voluntary disclosure is usually an arithmetic decision rather than a moral one.
Audit and investigation are two different things
These words are used interchangeably in conversation and mean very different things in practice. Getting the distinction right determines how you respond on day one.
| Tax audit | Tax investigation | |
|---|---|---|
| Nature | Routine verification of records already submitted | Coercive examination where evasion or serious discrepancy is suspected |
| Forms | Desk audit (at the LHDN office, documents requested by letter) or field audit (at the taxpayer's premises) | Civil or criminal; may involve simultaneous visits, seizure of records and devices |
| Typical outcome | Additional assessment plus a penalty under s.113(2) | Settlement with substantially higher penalties, or prosecution under s.114 |
| Time limits | Generally within the s.91 five-year window | No time limit where fraud, wilful default or negligence is involved |
| Downstream risk | Contained to tax | Possible exposure under the anti-money-laundering legislation, asset restraint |
An audit that is answered badly can become an investigation. That is the single most important operational fact in this article: the response to the first letter is not a clerical task to be delegated to whoever has the files.
What the 2025 framework covers
The Tax Audit Framework on Income Tax and Employer took effect on 15 March 2025 and consolidated into one framework what used to be examined under separate exercises. A single audit may now cover:
Income tax audit — the core exercise on the company's chargeable income. Withholding tax audit — payments to non-residents under sections 107A, 109, 109A and 109B, an area where foreign-owned companies fail most often because the obligation sits on the payer and is easy to miss. Capital gains tax audit — the CGT regime on disposals of unlisted shares. Labuan business activity audit — substance and activity conditions for Labuan entities. Employer audit — monthly tax deductions, Form E and EA, benefits-in-kind, and the treatment of expatriate remuneration.
The penalty ladder
The headline rate under section 113(2) of the Income Tax Act 1967 is a penalty equal to 100% of the tax undercharged. In practice the framework applies a concessionary ladder based on the taxpayer's penalty history, and the difference between the rungs is the whole game.
| Situation | Penalty on tax undercharged |
|---|---|
| Voluntary disclosure made within six months of the return due date | 10% |
| Voluntary disclosure made after six months (before an audit is commenced) | 15% |
| Audit finding — first offence | 15% |
| Audit finding — second offence | 30% |
| Audit finding — third and subsequent offence | 45% |
| Incorrect return submitted intentionally | 100% |
| Technical adjustment — a genuine difference in interpretation of the law | No penalty, unless a public ruling or LHDN guideline already covers the point |
Offence counting is not open-ended. The framework determines penalty history from records of section 113(2) penalties raised between 1 January 2020 and 30 April 2022; where no penalty was imposed in that period, an audit finding from 1 May 2022 onwards is treated as the first offence. Most foreign-owned companies incorporated after 2022 therefore sit at the 15% rung on a first finding — which is precisely why a second finding, at double the rate, is the one to design against.
The technical-adjustment carve-out is worth understanding because it is under-argued. Where an adjustment arises from a genuinely different reading of the legislation on the facts of the case, no section 113(2) penalty should apply. The exception swallows a lot of the rule, though: if LHDN has already published a public ruling or guideline on the point, the position is no longer a matter of interpretation.
The criminal provisions behind the civil penalties
Civil penalties are imposed in lieu of prosecution. The prosecution powers remain, and their existence is what gives the settlement conversation its shape.
| Section | Offence | Exposure |
|---|---|---|
| s.112(3) | Failure to furnish a return | Fine of RM200 to RM20,000, or imprisonment up to 6 months, or both |
| s.113(1) | Incorrect return or incorrect information | Fine of RM1,000 to RM10,000, plus a special penalty of 200% of the tax undercharged |
| s.114(1) | Wilful evasion, or assisting another to evade | Fine of RM1,000 to RM20,000, or imprisonment up to 3 years, or both, plus a special penalty of 300% of the tax undercharged |
| s.107C(9) | CP204 instalment unpaid by the due date | The unpaid amount is increased by 10% |
| s.107C(10) | Actual tax exceeds the estimate by more than 30% | 10% on the excess over the 30% margin |
The section 107C penalties are the ones companies incur without any audit at all — they are computed mechanically from the return. If your CP204 estimate is materially below the eventual liability, the penalty arrives automatically. The mechanics, including the sixth- and ninth-month revision windows, are set out in our guide to CP204 and section 107C instalments.
Five years — until there aren't any
Under section 91(1) of the Income Tax Act, LHDN may raise an assessment or additional assessment within five years after the expiration of the year of assessment. That is the ordinary window, and it means a company reaching its sixth year of operation still has four open years behind it at any given time.
The window disappears entirely where there is fraud, wilful default or negligence. There is no time bar in those cases — LHDN may go back as far as the facts support. "Negligence" is the word that should concern a well-intentioned taxpayer most, because it does not require dishonesty. A group that never prepared transfer pricing documentation for a decade of related-party transactions, or that never considered withholding tax on payments to its parent, is not obviously fraudulent; whether it was negligent is a question a tax officer can put on the table, and the answer determines whether the exposure is four years or fourteen.
Underpinning both is the record-keeping obligation. Section 82A requires sufficient documents to be kept and retained for seven years from the end of the relevant year of assessment. That period is deliberately longer than the five-year assessment window — records must survive to support an assessment raised at the far edge of it. Companies that migrate accounting systems, change service providers or close a Malaysian office without a records plan discover this at the worst possible moment.
The six triggers that put foreign-owned companies on the list
One — related-party transactions without transfer pricing documentation. Any material transaction with the parent or a group affiliate is visible in the return. Where contemporaneous documentation does not exist, the adjustment is straightforward for LHDN to make and difficult for the taxpayer to resist. See our guide to transfer pricing for foreign-owned companies.
Two — management fees, royalties and service charges paid offshore. These attract attention twice: as a deduction that must satisfy the wholly-and-exclusively test and arm's-length pricing, and as a payment that should have suffered withholding tax. Both limbs are now inside the same audit. Our withholding tax guide sets out the rates and the deadlines.
Three — recurring losses or margins out of line with the industry. Start-up losses are normal and defensible. A subsidiary that reports losses for six consecutive years while its group grows is asserting, in effect, that Malaysia is the unprofitable part of a profitable business — a proposition LHDN will ask it to prove.
Four — inconsistency with third-party data. LHDN cross-references customs import declarations, CP58 agent commission statements, CP204 estimates against final returns, and now e-Invoice data. Discrepancies between what a company declares and what another party reported about the same transaction are among the cheapest selection signals available.
Five — expatriate remuneration split across jurisdictions. Where part of a manager's package is paid by the parent company offshore, the employer's reporting obligation in Malaysia is frequently missed. The employer audit limb of the framework exists for exactly this.
Six — large or unusual movements in a cash-intensive business. Trading, food and beverage, retail and construction operations with cash cycles that do not reconcile to declared turnover remain a standing priority.
What e-Invoice changed about audit selection
Before MyInvois, selection relied on the annual return and whatever third-party data could be matched to it. e-Invoice replaces sampling with reconciliation: transaction-level data flows to LHDN as invoices are issued, and both sides of a domestic transaction are visible.
Phase 4 began on 1 January 2026 for taxpayers with annual turnover between RM1 million and RM5 million. On 6 December 2025 the Cabinet raised the exemption threshold from RM500,000 to RM1,000,000, cancelling the planned final wave — businesses below RM1 million in annual turnover are exempt, though they may opt in. The penalty-free relaxation period for Phase 4 was extended by a further twelve months to 31 December 2027, during which consolidated e-invoices may still be used, with full enforcement from 1 January 2028. LHDN issued e-Invoice Specific Guideline version 4.7 on 20 April 2026.
How to handle an audit that has already started
Confirm what it is. Read the letter for the years of assessment covered, the type of audit, the documents requested and the response deadline. Whether it is a desk or field audit determines the shape of everything that follows.
Do not answer piecemeal. Assemble the full response before sending anything. A partial submission that is later corrected invites the officer to question the reliability of the records generally, which is how a scope expands from one year to four.
Reconstruct the position before you defend it. Work out internally what the correct treatment was, including anything the officer has not yet found. Discovering an unrelated exposure mid-audit and disclosing it late is materially worse than putting it on the table early.
Separate technical adjustments from omissions. Where an adjustment turns on a genuine interpretive difference, say so and evidence the basis for the position taken at the time — that is the argument for no penalty under the framework. Where income was simply omitted, arguing interpretation wastes the credibility needed elsewhere.
Keep the appeal route open. Once an assessment is raised, the objection must be filed within the statutory period. Agreeing an adjustment informally without documenting the basis can compromise the position later.
The voluntary disclosure arithmetic
Take a company that under-declared RM400,000 of income in a year of assessment, at the 24% corporate rate — RM96,000 of tax undercharged. Disclosed voluntarily after the six-month window, the penalty is 15%: RM14,400. Found on a first audit, it is also 15% — the same. Found on a second audit finding, at 30%, it is RM28,800. Found and characterised as intentional, at 100%, it is RM96,000. Prosecuted under section 114, the special penalty is 300%: RM288,000, plus fine and possible imprisonment.
The number that changes the decision is not the penalty rate on any single finding — it is the ladder. A first finding costs the same as a disclosure; what a disclosure buys is that the next finding is still a first offence. For a group that intends to operate in Malaysia for a decade, that is the asset being protected. Note also that voluntary disclosure is only available to taxpayers who have already filed the return in question, and the disclosure must be complete, accurate and made in good faith. A partial disclosure calculated to close one issue while leaving another open does not qualify, and does not protect the ladder.
What a defensible file looks like before anything happens
Contemporaneous transfer pricing documentation prepared for the year, not reconstructed after a letter arrives. Intercompany agreements that exist in writing and describe what actually happens. A withholding tax register showing every payment to a non-resident, the rate applied, the treaty position relied on and the date of remittance. CP204 estimates revised in the sixth and ninth months against real forecasts. Employer records covering the full remuneration of every expatriate, including anything paid offshore. Seven years of records retained under section 82A, in a form that survives a change of accounting system or service provider.
None of this is exotic. It is the ordinary work of a properly run finance function — and the difference between a 15% adjustment and a conversation about negligence with no time bar attached.
ONEKEY BIZ provides accounting, tax compliance and audit support for foreign-owned Malaysian companies — CP204 estimates and revisions, withholding tax registers, transfer pricing documentation, e-Invoice implementation, and representation through an LHDN audit from the first letter to the final assessment. See our accounting and tax service, or speak to our team if a letter has already arrived.
Frequently asked questions
What is the difference between a tax audit and a tax investigation in Malaysia?
A tax audit is a routine verification of records already submitted, conducted either as a desk audit at the LHDN office or a field audit at your premises, and normally ends in an additional assessment plus a penalty under section 113(2). A tax investigation is coercive, opened where evasion or serious discrepancy is suspected, may be civil or criminal, and carries no time limit where fraud, wilful default or negligence is involved. An audit that is answered badly can become an investigation.
How much is the penalty if LHDN finds under-declared income?
The headline rate under section 113(2) is 100% of the tax undercharged, but the framework applies a ladder: 15% on a first audit finding, 30% on a second, 45% on a third or subsequent, and 100% where the incorrect return was submitted intentionally. Voluntary disclosure is 10% within six months of the return due date and 15% after. A genuine technical adjustment — a real difference in the interpretation of the law — attracts no penalty, unless LHDN has already published a public ruling or guideline on the point.
How far back can LHDN go?
Under section 91(1) of the Income Tax Act 1967, an assessment or additional assessment may be raised within five years after the expiration of the year of assessment. That window disappears entirely where there is fraud, wilful default or negligence — there is no time bar in those cases. Negligence is the limb that should concern well-intentioned taxpayers, because it does not require dishonesty: never preparing transfer pricing documentation, or never considering withholding tax on payments to a parent, can be characterised that way. Separately, section 82A requires records to be kept for seven years.
Why do foreign-owned companies get audited more often?
Because they carry more selection markers. The six most common are: related-party transactions without contemporaneous transfer pricing documentation; management fees, royalties and service charges paid offshore (examined both as a deduction and as a withholding tax obligation); recurring losses or margins out of line with the industry; inconsistency with third-party data such as customs declarations, CP58 and CP204; expatriate remuneration split across jurisdictions so the Malaysian employer reporting is missed; and unusual movements in cash-intensive businesses.
Is it worth making a voluntary disclosure if the audit penalty is the same 15%?
Yes, because the ladder is what you are protecting. A first audit finding and a voluntary disclosure both cost 15% — but a finding consumes your first-offence status, so the next issue is charged at 30% and the one after at 45%. A disclosure keeps you at the bottom rung. Note that voluntary disclosure is only available to taxpayers who have already filed the return in question, and it must be complete, accurate and made in good faith; a partial disclosure calculated to close one issue while leaving another open does not qualify.
Sources & references
This article is general information only, not legal, tax or immigration advice. Policies, thresholds and official fees are set by the relevant Malaysian authorities and may change. Talk to our consultants about your specific situation.