Revenue Memorandum Circular (RMC) No. 110-2026

Date of Issuance: October 13, 2026

Effectivity: Immediately

Prescribing the Accreditation, Technical, Operational, Security, Data Governance, Institutional, Legal, and Continuing Compliance Requirements for Electronic Invoicing Solutions of Electronic Invoicing Service Providers (ESPs)

RMC No. 110-2026 establishes a comprehensive accreditation and regulatory framework for the electronic invoicing solutions offered by Electronic Invoicing Service Providers (ESPs). The Circular took effect immediately and is intended to ensure that ESP-operated platforms are secure, reliable, interoperable, auditable, operationally sustainable, and capable of providing the BIR with complete and timely access to electronic invoice and sales data.

Key Highlights

1. Mandatory And Solution-specific Accreditation

An ESP may not commercially deploy, activate, or use an electronic invoicing solution for live taxpayer transactions unless the particular solution has been accredited by the BIR and is covered by a valid Electronic Invoicing Solutions Accreditation Certificate (EIS AC). Accreditation is specific to the approved system, version, modules, interfaces, infrastructure, and deployment configuration. Product demonstrations and controlled pre-production testing remain permissible, provided that no live taxpayer transactions are processed and the solution is clearly identified as not yet authorized for production.

2. Coverage And Exclusions

The Circular applies to ESPs providing electronic invoicing, electronic sales reporting, integration, validation, transmission, storage, middleware, and related services to taxpayers. An internally developed system, or software licensed to and operated on the infrastructure of a single taxpayer exclusively for itself and its registered branches, is generally excluded and remains subject to existing Computerized Accounting System (CAS), Point-of-Sale (POS), or other applicable registration rules. However, a system offered to affiliates, subsidiaries, related parties, franchisees, customers, or other separate juridical entities will generally be treated as an ESP service unless the BIR grants an exemption.

3. ESP Accreditation Does Not Replace Taxpayer-level Permits

The ESP’s accreditation does not replace the taxpayer’s own CAS, POS, or other system-registration obligations. In particular, the taxpayer must still obtain the applicable Permit to Issue (PTI) Electronic Invoice and EIS certification under existing BIR rules. A Permit to Use (PTU) or CAS Acknowledgement Certificate (AC), by itself, does not authorize the taxpayer to issue electronic invoices.

4. End-to-end Responsibilities Of Accredited ESPs

An accredited ESP must provide an end-to-end service covering the generation, issuance, validation, preservation, processing, storage, retrieval, audit support, and transmission of electronic invoices and sales data. It must also facilitate the taxpayer’s application for or updating of the (PTI) Electronic Invoice, while recognizing that the permit remains owned and controlled by the taxpayer.

Electronic invoice and sales data must be transmitted to the BIR in real time or near real time, but no later than three (3) calendar days from the transaction date. If immediate transmission is unavailable, the system must securely queue and preserve the data and retransmit it within three calendar days following system restoration, without loss, alteration, corruption, or duplication.

5. Stringent Accreditation Process

Accreditation involves a stage-gated evaluation that includes:

• Documentary completeness review (Checklist of Requirements for the Application for Electronic Invoicing Solutions Accreditation – Annex “A”);
• Fit-and-proper and financial-capacity review;
• Technical architecture and end-to-end data-flow assessment;
• Data privacy, cybersecurity, and data-residency review;
• System or solution demonstration;
• Interoperability and end-to-end transmission testing; and
• Load, stress, scalability, concurrency, failover, backup, and recovery testing.

Documentary compliance alone is insufficient. An applicant must successfully complete every mandatory stage under conditions that reasonably reflect projected and peak production volumes before it may be authorized for production use.

6. Security, Privacy, And Operational Requirements

An ESP must demonstrate compliance with applicable government data-classification and data-residency requirements and maintain layered protections such as firewalls, anti-DDOS controls, web application firewalls, and anti-malware measures. The

platform must undergo source-code review and vulnerability assessment and penetration testing, with favorable or secured results. The Circular also requires relevant information-security certifications, including ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, SOC 1 and SOC 2, or their equivalent.

Third-party certifications may support the application but do not replace independent BIR testing, inspection, audit, or verification.

7. Track-Record Threshold

To demonstrate operational capability, an ESP must show that, for each of the immediately preceding three years, it successfully operated or supported systems collectively capable of processing at least five (5) million transactions annually and supporting at least 1,000 active user or customer accounts each year. It must also maintain qualified personnel, sufficient financial capacity, and secure, resilient, and scalable cloud infrastructure.

8. Accreditation Validity And Continuing Compliance

The accreditation certificate is valid for five (5) years, subject to annual compliance reviews, continuous monitoring, and immediate revalidation following a material change or significant incident. Renewal must be filed at least sixty (60) calendar days before expiration. Failure to maintain a valid accreditation certificate may result in the suspension of the taxpayer’s authority to use the affected solution for electronic invoicing.

A material change, including a change in control, system architecture, core functionality, data model, interfaces, hosting environment, encryption or authentication method, or data location, requires prior BIR notification and approval.

9. Data Ownership, Access, And Portability

The taxpayer retains ownership and legal responsibility for its books, records, invoices, and source business data. Electronic invoices and sales data transmitted to the BIR or stored by the ESP for future transmission or BIR use, constitute official tax-administration records under BIR custody and control. The ESP acquires no ownership, lien, intellectual-property interest, or other proprietary right over such data.

The ESP must provide the BIR with complete, direct, secure, timely, and continuous access to electronic invoices, sales data, metadata, audit logs, acknowledgments, rejection records, and error records. Upon lawful request, the ESP must generally provide:

• Standard summary reports within one working day; and
• Complete transaction-level extracts in a structured, machine-readable, and non-proprietary format within three working days, subject to shorter periods for audits, investigations, enforcement actions, cybersecurity incidents, or system emergencies.

Vendor lock-in is expressly prohibited. An ESP may not withhold, disable, delete, degrade, or condition access to taxpayer data because of unpaid fees, contractual disputes, termination, or a change of provider. Data must be transferable to the taxpayer, the BIR, or another accredited ESP without loss, alteration, duplication, unreasonable delay, or unreasonable cost.

10. Incident Reporting And Business Continuity

Critical security, integrity, availability, or transmission incidents must be reported in writing to the concerned Revenue District Office or Large Taxpayers Service office within 24 hours, unless a shorter period is required by law or technical standards. ESPs must maintain and periodically test business-continuity, disaster-recovery, backup, failover, and incident-response plans.

The system must also support manual invoicing during service interruptions and the subsequent recording, uploading, reconciliation, and linkage of manually issued invoices to the corresponding electronic invoices after system restoration.

11. ESP Liability Does Not Eliminate Taxpayer Responsibility

The ESP is directly accountable to both the BIR and its taxpayer-clients for system failures, unauthorized data access or alteration, invoice manipulation, erroneous or delayed transmission, cybersecurity failures, and deficiencies in storage, backup, audit trails, portability, continuity, and recovery. The BIR may require performance bonds, cyber-risk insurance, professional liability insurance, or other financial assurances proportionate to the ESP’s risk profile and transaction volume.

Nevertheless, engaging an ESP does not relieve the taxpayer of its legal responsibility to issue accurate invoices, maintain books and records, report sales, file returns, and pay the correct taxes. A taxpayer may avoid administrative penalties for a transmission failure caused solely by an accredited ESP if it exercised reasonable diligence, timely reported the incident, and followed the required contingency procedures. This relief does not prevent the BIR from assessing or collecting the correct taxes.

12. Fees And Contractual Protections

ESP fees must be transparent, reasonable, proportionate, and fully disclosed before onboarding. Hidden charges and undisclosed or excessive exit, data-retrieval, and migration fees are prohibited. Contractual provisions that prevent taxpayers from changing providers or accessing and retrieving their records are likewise inconsistent with the conditions of accreditation.

13. Enforcement And Sanctions

The BIR may order corrective action, restrict new client onboarding, suspend accreditation, or revoke accreditation for material misrepresentation, security or performance failures, repeated transmission problems, unauthorized data use, invoice manipulation, refusal to provide access or records, unauthorized outsourcing or system changes, insolvency, or other violations. Immediate temporary suspension may be imposed when continued operations present an imminent and material risk to taxpayers, government revenue, data security, system integrity, or continuity of tax administration.

Suspension, revocation, contract termination, insolvency, or cessation of business does not extinguish the ESP’s obligations concerning data preservation, BIR access, migration, taxpayer assistance, confidentiality, incident reporting, and audit cooperation.