CFR Malta and the EU 2028 e-invoicing mandate
The Commissioner for Revenue's roadmap from voluntary Peppol pilots to the EU ViDA mandate that lands in July 2028.
Malta has historically run a paper-and-PDF VAT invoicing regime, but that ends with the EU's Vat in the Digital Age (ViDA) package. From 1 July 2028, every cross-border B2B transaction inside the EU must be reported in near real time using structured electronic invoices in the EN16931 format. The Commissioner for Revenue (CFR Malta) is the competent authority that will receive, process and audit these digital filings. CFR has already opened a voluntary Peppol Access Point register and published guidance Notice 178/2024 setting out the technical and legal expectations for Maltese suppliers, so businesses that move early avoid a rushed 2027/2028 implementation.
- Mandate scope: B2B intra-EU transactions reported per-invoice, not per-quarter, by 1 July 2028.
- Format: structured XML in EN16931 (UBL 2.1 or CII), no more PDF-only invoices for B2B EU sales.
- Channel: Peppol BIS Billing 3.0 over the Peppol 4-corner model, via a CFR-accredited Access Point.
- Domestic B2B: Malta retains member-state freedom on timing — voluntary today, expected mandatory shortly after the EU baseline.
How it works
You confirm with CFR Malta that your VAT registration is active and your business is in scope for ViDA — broadly, every Maltese entity that issues a B2B invoice to a counterparty established in another EU member state.
You select a Peppol Access Point: either MITA (Malta's public-sector AP, free for low-volume use) or a commercial AP. The AP registers your participant identifier (Maltese VAT number + 0007:MT scheme) on the Peppol SMP so other corners can route invoices to you.
You upgrade your invoicing software so it can output EN16931-compliant XML — fields include the buyer VAT, the supplier VAT, line totals, tax categories, payment terms and a structured legal reference. PDF-only output stops being acceptable for in-scope B2B EU transactions.
On send, the AP wraps your XML in an SBDH envelope, signs it and pushes it to the recipient's AP. The recipient acknowledges receipt via the Peppol MLR (Message Level Response). Both sides retain the structured invoice for 6 years per the Maltese VAT Act Chapter 406.
CFR Malta consumes the same data stream through the Digital Reporting Requirements (DRR) channel — your VAT return preparation becomes a reconciliation against pre-populated data, not a manual re-entry.
Legal references
- Council Directive (EU) 2025/0067 — VAT in the Digital Age (ViDA), Digital Reporting Requirements pillar.
- VAT Act, Chapter 406 of the Laws of Malta, art. 50 — invoicing obligations and electronic transmission.
- CFR Malta Notice 178/2024 — voluntary Peppol Access Point register and EN16931 readiness guidance.
Frequently asked questions
Does ViDA apply to domestic Maltese B2B invoices as well?
Not at the EU mandatory date of 1 July 2028 — ViDA only mandates intra-EU B2B reporting on that date. Each member state may extend the same rules to domestic B2B without needing a derogation from the EU Council. Malta has signalled in CFR Notice 178/2024 that it will follow the EU baseline closely, with domestic B2B mandatory shortly after, but no Maltese law has set a final domestic date yet.
What's the role of MITA in Malta's e-invoicing setup?
MITA (Malta Information Technology Agency) runs Malta's public-sector Peppol Access Point, used by central government and several agencies for B2G invoicing. MITA's AP is open to private businesses too as a low-cost option for low-volume Peppol sending, but commercial access points (Pagero, Edicom, OpenPeppol-certified providers) are usually a better fit for high-volume or feature-rich workflows.
Do I need a separate Maltese Peppol participant ID?
Your Peppol participant ID is built from the Maltese VAT number (the 8-digit number prefixed by MT) plus the Peppol electronic-address scheme 0007:MT. Once your Access Point registers this identifier with the Peppol SMP, any other corner in the EU network can resolve it and route invoices to you — there's no separate registration with CFR.
What happens to PDF and email-only invoicing after July 2028?
PDF and email-only invoicing remain legal for B2C, for non-EU exports and for domestic B2B until Malta extends the rules. But for any B2B sale to a VAT-registered buyer in another EU member state, only EN16931-compliant structured electronic invoicing through Peppol (or an equivalent EU-recognised channel) will be accepted from 1 July 2028. PDFs sent as attachments to a Peppol message are allowed but the structured XML is the legal document.
How long must Maltese businesses retain e-invoices?
Six years from the end of the year in which the supply took place, per art. 50 of the VAT Act. The retention applies to the structured XML, not just a PDF render — CFR can request the original Peppol payload during an audit, so your archive must keep the digital signature and the SBDH envelope intact, not just a printable copy.