Philippines Mandates Strict Accreditation for Electronic Invoicing Service Providers

Context

On October 12, 2026, the BIR issued Revenue Memorandum Circular (RMC) 110-2026, establishing a mandatory accreditation framework for ESPs. This circular took effect immediately and is directly tied to the December 31, 2026 mandatory e-invoicing compliance deadline previously signaled in RMC 98-2026. The novel focus of this briefing is the seven-stage technical and procedural accreditation pathway that ESPs must complete before they may commercially offer electronic invoicing services in the Philippines.

The accreditation process comprises seven sequential stages: documentary completeness review, fit-and-proper assessment of the ESP entity, technical architecture review, data privacy and cybersecurity assessment, system demonstration, interoperability testing, and load/stress testing. This framework represents a comprehensive pre-market authorisation approach for ESPs, combining security certification requirements, operational resilience testing, and data residency obligations into a single regulatory gate.

What's Changing: The Accreditation Pathway

The cybersecurity assessment stage is particularly demanding. ESPs must demonstrate compliance with internationally recognised security frameworks, specifically ISO/IEC 27001 (information security management), ISO/IEC 27017 (cloud security controls), and ISO/IEC 27018 (protection of personally identifiable information in cloud environments), as well as SOC 1 and SOC 2 audit certifications. Additionally, ESPs must comply with Executive Order 119, series of 2026, which governs Government Data Classification and Data Residency — a requirement with direct implications for where taxpayer invoice data may be stored and processed.

Load, stress, scalability, failover, and backup recovery testing are explicitly required, signalling that the BIR intends to hold ESPs to operational resilience standards, not merely documentary compliance. Successful completion of all stages results in the issuance of a BIR Electronic Invoicing Solutions Accreditation Certificate, which is a prerequisite for commercial deployment. The BIR retains authority to suspend or revoke accreditation for non-compliance, service failures, data security breaches, tax evasion-related violations, insolvency, or violations of applicable laws.

Implications for ESPs

RMC 110-2026 also prohibits vendor lock-in practices and mandates data portability and migration support when taxpayers transfer between providers — a consumer protection measure that complements the technical accreditation regime. This regulation represents a significant shift in the Philippine e-invoicing landscape, ensuring that only providers meeting stringent technical and procedural standards can operate commercially.

Outlook: What to Watch

For Kworia readers tracking e-invoicing infrastructure governance, the Philippines model represents a comprehensive pre-market authorisation approach for ESPs. This regime combines security certification requirements, operational resilience testing, and data residency obligations into a single regulatory gate. This approach is likely to set a precedent for other jurisdictions considering similar frameworks.