Peppol Service Providers (SP)

An overview of service providers accreditation requirements and process.

Peppol Service Providers (also known as Peppol Access Point (AP)) are responsible for creating and maintaining the connectivity gateways that function as access nodes on the e-invoicing network, compliant to the Peppol standards, routing of e-invoices to the correct destination APs, as well as for registering and updating participant details in the Malaysia SMP. Service Providers intending to provide Peppol Access Point services in Malaysia may apply to be accredited by MDEC as the Peppol Authority for Malaysia.

Accreditation Eligibility Criteria

1. Company registration

a. Locally Incorporated Company, majority Malaysian-Owned:

The company is a company incorporated in Malaysia under the Companies Act 1965 or Companies Act 2016.
Minimum paid-up capital of at least RM50,000; can be from the parent company.
Minimum of 51% equity held by Malaysian(s) as per shareholding structure in the SSM.

b. Locally Incorporated Company, majority foreign-owned:

The company is a company incorporated in Malaysia under the Companies Act 1965 or Companies Act 2016.
Minimum paid-up capital of at least RM300,000 or equivalent in local currency for overseas organisations; can be from the parent company.

c. Foreign-based Company:

The company is a registered business.
Minimum paid-up capital of at least RM300,000 or equivalent in local currency for overseas organisations; can be from the parent company.

2. The company is in operation for at least one (1) year as of the date of submission, either the locally incorporated company or their parent company.

3. The management of the company to declare if the company is not the subject of liquidation/ winding up/ dissolution order.

4. The management of the company to declare if the company is not under any legal proceeding for criminal offenses under any applicable laws or liquidation/ winding up/ dissolution order.

5. The management of the company to declare if the company is not blacklisted by any Malaysian authority.

6. Member of OpenPeppol AISBL.

7. Compliance with Malaysia Peppol Authority Specifications.

8. Compliance with the following Information Security requirements:

- Enable Multifactor Authentication;
- Encryption At Rest;
- Encryption in Transit;
- Regular Security Monitoring; and
- Self-certification or independent certification of ISO/IEC 27001 (non-mandatory)

9. Compliance with Malaysia Tax Authority requirements.

Accreditation Process

Service Providers who are interested to provide Access Point services in Malaysia will be required to attain the Peppol Service Provider Accreditation instituted by MDEC as the Peppol Authority for Malaysia.

For more details on the criteria and process for Accreditation of Peppol Service Providers, please click HERE