5 invoice risk criteria according to Circular 91/2026: What should businesses be aware of?

From July 1st, 2026, the criteria for identifying high-risk taxpayers in the registration for using electronic invoices are stipulated in Article 7 of Circular 91/2026/TT-BTC. There are five groups of indicators related to a history of invoice fraud/trading, suspicious transactions, registered address, connections to taxpayers with problematic tax identification numbers or compliance issues, and other risk indicators identified by the tax authorities.

The important point to understand correctly is: Meeting a risk criterion does not mean the business has been found in violation or that all of the business's invoices are illegal.. This serves as the basis for the tax authorities to conduct inspections, request explanations/additional information, or verify actual operations according to the electronic invoice registration process.

The content below is updated as follows: Circular 91/2026/TT-BTC and clearly distinguish between two concepts that are often confused: Risk criteria when registering to use electronic invoices and Risk indicators to watch for during the process of receiving, checking, and processing invoices..

5 high-risk criteria when registering to use electronic invoices from July 1, 2026.

According to Article 7 of Circular 91/2026/TT-BTC, after the registration information has been verified and the taxpayer confirms it within the deadline, if any of the following five signs are present, the application will be processed according to the procedure for cases requiring explanation, additional information, or verification.

Criteria	Points to note	Businesses should conduct a preliminary check.
1. Related to fraud and the buying and selling of invoices.	The owner, legal representative, or related entity simultaneously listed as/representing an organization, household, or individual business that has been found by a competent authority to have committed fraud or engaged in the buying and selling of invoices in the tax authority's database.	The legal history and compliance status of the representatives/owners of the relevant legal entities.
2. Included in the list of suspicious transactions.	Owners, representatives, or related parties on the list of those involved in suspicious transactions under anti-money laundering laws.	Identification information, transaction records, and related compliance alerts.
3. The registered office address shows signs of risk.	The registered office address does not have a specific address within administrative boundaries or is located in an apartment building not permitted for business purposes; exceptions are made for cases permitted by law and for individuals conducting business within the scope of Article 7.	Registered address, documents proving the right to use the premises and the legal purpose of use.
4. The representative/owner has a connection to the taxpayer with a compliance issue.	The legal representative or owner, who is also the representative/owner of the taxpayer, has ceased operations but has not completed the procedures for terminating the tax identification number, is not operating at the registered address, or has committed violations related to taxes, invoices, and documents as stipulated in risk management regulations.	The relevant legal entities, their tax identification number status, and their compliance history.
5. Other risk indicators as determined by the tax authorities.	Other indicators are identified according to regulations on compliance management and risk management in tax administration and are notified by the tax authorities for taxpayers to be aware of and explain.	Monitor electronic notifications from the tax authorities and prepare explanatory documents that can be quickly retrieved.

How will businesses that meet the risk criteria be handled?

The appearance of an indicator under Article 7 is not a final conclusion regarding a violation. According to the procedure in Article 6 of Circular 91/2026/TT-BTC, the tax authority may send a notification requesting further action. Explanation, additional information, and documents or perform Verify actual activity at the registered address..

Upon receiving a notice requesting clarification/additional documents, taxpayers have the option to... 3 working days From the date of receiving the notification to take action. Therefore, the practical challenge for businesses is not to find ways to "avoid the criteria," but to ensure that the registration information is consistent and that there is sufficient documentation to prove actual business operations.

• Check legal information: The business name, tax identification number, legal representative, owner, and registered address must be consistent with the registration documents.
• Check the status of the relevant legal entities: Especially when a representative or owner is involved in multiple businesses.
• Prepare evidence of actual operations: Lease agreements, sales contracts, personnel records, transaction documents, and operational documents relevant to the registered business activities.
• Follow electronic notifications: Avoid missing the 3-business-day deadline for submitting your explanation.

If businesses need to see all the changes to the e-invoice system from July 1, 2026, they can read more in this article. Decree 254 & Circular 91 on electronic invoices.

How do the risk criteria for registering e-invoices differ from the indicators of operational risk in invoices?

This is the most confusing part. The five criteria in Article 7 of Circular 91/2026/TT-BTC have a specific scope: identifying taxpayers with a high risk of registering to use electronic invoices. Meanwhile, when a business receives hundreds or thousands of incoming invoices, the accounting department must also monitor many other operational signals to decide which invoices require further investigation.

Group	Purpose	For example
Criteria as stipulated in Article 7 of Circular 91/2026	To facilitate the registration process for using electronic invoices and to identify cases requiring explanation/verification.	The subject's fraud history, suspicious transactions, registered address, and contact information for entities with compliance issues.
Signs requiring monitoring during operation.	It helps businesses identify documents or suppliers that need review before accounting/payment.	Duplicate invoices, mismatched tax identification number/seller name, supplier status changes, invoices not matching purchase orders/grocery orders/contracts, unusual payment data.

An operational indicator does not automatically prove an invoice is illegal. Businesses need to verify the actual transaction records, the legal status of the invoice and the supplier, and retain supporting documents proving the economic transaction occurred.

What data should be checked before accounting for input invoices?

To reduce risk, accountants should shift from checking each individual piece of information to a more comprehensive verification process. The relationship between invoice – supplier – transaction – document – payment. A practical checklist might include:

• Supplier: Tax identification number, operating status, name and registered address.
• Bill: Symbol, invoice number, date of issue, status, XML data, and digital signature as applicable.
• Purchasing operations: Contracts or purchase orders, delivery/acceptance records, warehouse receipts.
• Pay: The recipient's name, receiving account, amount, payment date, and supporting documents must be provided.
• Consistency: The goods/services, quantity, unit price, tax rate, and total amount must match the purchase records.

For invoices showing signs of irregularities, accountants should separate them into an exception stream for further investigation instead of proceeding directly to the accounting or payment process.

What should businesses do when they receive an invoice from a supplier that shows signs of risk?

Instead of automatically rejecting an invoice upon detecting a risk signal, businesses should handle it in stages:

1. Verify supplier status and invoices. Based on appropriate sources.
2. Compare actual transactions with contract, purchase order, gross receipt/acceptance report and payment documents.
3. Check for data consistency. between XML invoices, instances, and internal records.
4. Request for additional documents If there are any unclear points in the transaction or discrepancies in information between the documents.
5. Leave a record of the inspection. To be able to demonstrate the control process when explanations or audits are required.

If further verification of the document's validity is needed, please refer to the following: How to check if an electronic invoice is valid and the article What is invoice trading?.

How to organize invoice risk control when dealing with a large number of documents.

For businesses with few invoices, a manual checklist may suffice. However, as the number of documents increases, the problem often isn't about the accountant "knowing what to check," but rather the ability to consistently check all invoices.

A control process can be divided into four layers:

1. Centralized reception: Limit the number of invoices scattered across personal emails or multiple uncontrolled sources.
2. Check the data: Standardize invoice information, detect duplicates or fundamental discrepancies.
3. Transaction reconciliation: Compare the invoice with the purchase order (PO), final acceptance report (GR), contract, and payment data.
4. Exception handling: Only unusual cases are referred to the accounting department for in-depth review, while a record of the handling process is kept.

This also marks the line between a tool that simply "reads invoices" and a system. input invoice processingThe value lies in the ability to control data throughout the entire process, not just at the data entry stage.

FAQ regarding invoice risk criteria 2026

Does meeting one of the five criteria mean the business has violated the regulations?

Are not. The criteria in Article 7 of Circular 91/2026/TT-BTC are used to identify high-risk cases in the registration of electronic invoices and lead to corresponding inspection, explanation, or verification procedures. Conclusions of violations must be based on the specific regulations and documentation of each case.

What is the deadline for providing an explanation when requested by the tax authorities?

In cases falling under the procedure specified in point c, clause 2, Article 6 of Circular 91/2026/TT-BTC, taxpayers shall provide explanations and supplementary information and documents. 3 working days from the date of receiving the notification.

Is the address of an apartment building always considered high-risk?

This should not be interpreted in an absolute sense. Article 7 excludes apartments or portions of apartment buildings that are legally permitted for commercial use; the regulation also has a separate scope of application for individual businesses.

Should a business immediately reject an invoice from a supplier showing signs of risk?

One should not draw conclusions from a single sign. Businesses need to verify the supplier's status, check invoices, and provide proof of the actual transaction through contracts, delivery/acceptance records, payment documents, and related paperwork.

Conclude

From July 1st, 2026, when referring to 5 invoice risk criteria, Businesses should directly refer to Article 7 of Circular 91/2026/TT-BTC. These criteria focus on risks in Register to use electronic invoices and should not be interpreted as an automated list of conclusions about the legality of every invoice.

For the finance and accounting department, a safer approach is to build data-driven control capabilities: verifying suppliers, checking invoice status, reconciling documents, and recording processing history. When the volume of invoices is large, businesses can evaluate automation solutions like Bizzi to reduce manual operations and focus personnel on cases that truly require in-depth verification.