German companies doing business in the Philippines have eight weeks left – and only one night separates the two deadlines that matter. Under Revenue Memorandum Circular (RMC) No. 98-2026 of the Bureau of Internal Revenue (BIR), dated 22 September 2026, covered taxpayers in the Philippines must issue their invoices electronically on or before 31 December 2026. What is required is actual issuance, not mere technical readiness – and a Permit to Issue (PTI) must be granted beforehand. Only the certification of the system and the transmission of sales data to the BIR may follow later. From 1 January 2027, every business in Germany whose total turnover exceeded EUR 800,000 in the previous year must issue e-invoices for domestic B2B transactions under section 14 of the German VAT Act. Two conversions, two legal systems – and usually the same IT department.

Who is covered

The circular lists five groups, each of which triggers the obligation on its own: businesses engaged in e-commerce or internet transactions, taxpayers under the jurisdiction of the Large Taxpayers Service, large taxpayers with gross sales of PHP 1 billion or more, users of a computerized accounting system, computerized books with electronic invoicing or other invoicing software, and other taxpayers designated by the Commissioner. Only micro taxpayers are exempt.

Size alone is therefore not decisive. A small or medium-sized company without e-commerce is covered as soon as it generates its invoices from a system – a subsidiary in Manila or Cebu that bills out of a group ERP falls within the mandate. On the wording, it remains outside only if it does not sell electronically, issues its invoices manually on BIR-authorized forms and is not handled by the Large Taxpayers Service. At the same time, the e-commerce definition is broad: the circular covers any commercial transaction conducted through electronic, optical or similar media. Businesses that regularly take orders through online portals or electronic ordering systems should not rely on the exception. The obligation extends to the head office and all branches.

Same principle, different procedure

Both jurisdictions agree that a PDF sent by email is not an e-invoice. That is where the similarities end. A German e-invoice under the European standard EN 16931 – XRechnung or ZUGFeRD, for example – is exchanged between businesses without any government approval. In the Philippines, the PTI must be obtained before the first e-invoice is issued; the BIR evaluates applications within 20 working days. An existing CAS registration does not replace it, and each distinct invoicing system needs its own PTI. Within six months, the system must also pass EIS certification, failing which the PTI may be revoked. Data is transmitted to the BIR in JSON. Ongoing electronic sales reporting will only begin once separate implementing rules are issued.

Accreditation of service providers

The real bottleneck lies with the providers. Since 12 October 2026, under RMC No. 110-2026, solutions for invoicing, system integration, data storage, validation and middleware may only be deployed for taxpayers once accredited by the BIR. Accreditation is solution-specific, valid for five years and subject to annual review. The provider must be organized or licensed in the Philippines, maintain accountable officers there and comply with the data residency rules of Executive Order No. 119 (2026).

The first application window ran from 16 to 30 October 2026 and has now closed. No extension, second window or list of accredited providers has been announced so far. Anyone relying on an external provider is therefore planning against a deadline whose prerequisites will only take shape in the coming weeks.

For German groups, the key question is the exemption. According to the analyses published so far, it covers only systems that a taxpayer develops or licenses itself and operates on its own infrastructure for itself and its branches. KPMG considers it possible that systems shared by affiliated companies require accreditation. An ERP run centrally by the German parent company, or a cloud solution hosted on third-party infrastructure, might then fall outside the exemption.

There is one more mandatory field: under Revenue Regulations (RR) No. 6-2026, creditable withholding tax must be shown separately on invoices – for systems subject to e-invoicing, likewise by 31 December 2026 under RMC No. 112-2026.

Four recommendations

1. Assess each entity, not the group. Which entity sells, which one invoices, and through which system?
2. Apply for the PTI in November. With a review period of 20 working days and the December holidays, this is the last realistic month. Planned ERP migrations trigger a new PTI.
3. Run both conversions as one project – and clarify upfront whether the group solution qualifies as an in-house system or requires accreditation.
4. Scrutinize providers. Obtain proof of accreditation for the specific solution, secure data portability and support with the PTI process by contract, and keep a fallback plan.

The direction is the same in both jurisdictions: the invoice is turning from a document into a data set that the tax authority reads along. In the EU, reporting of cross-border B2B transactions will follow from 1 July 2030 under Council Directive (EU) 2025/516. Planning both deadlines together now means building only once.

—

Your point of contact in the Philippines: Lutz Kaiser

Villanueva Gabionza & Dy Law Offices

20th/F Corporate Center
139 Valero St., Salcedo Village
Makati City 1227, Philippines

CELL: +63 995 985 4957
TEL: +63 2 8813 3351

www.vgdlaw.ph
kaiser@adwa-law.com

On 20 October 2026, a further phase of amendments under the Corporate and Accounting Laws (Amendment) Act 2025 came into effect. The reform expands the requirements for the Annual Return and simplifies corporate formalities as well as procedures for striking off and restoring legal entities.

Overview of the Key Changes:

• Expanded Annual Return Requirements: Companies must confirm the accuracy of the most recently filed information with the Accounting and Corporate Regulatory Authority (ACRA) concerning directors (members of the governing body), Chief Executive Officers (CEOs), company secretaries, auditors and certain shareholders. Companies must also indicate whether an individual holds the position of CEO. Companies limited by guarantee must additionally confirm the total number of members most recently reported through Bizfile.

• Simplification of Corporate Formalities: The requirement to file a Statement in Lieu of Prospectus is abolished in the cases provided for by law. Public Limited Companies with share capital (comparable to a German AG) are no longer required to hold statutory meetings or prepare the corresponding statutory reports.

• Striking Off and Restoration: The new regulations apply to companies, Limited Liability Partnerships (LLPs), Variable Capital Companies (VCCs) and their Sub-Funds. The striking-off procedures have been shortened: In the case of voluntary striking off, publication in the Government Gazette may take place as early as the day the notice is sent. Where striking off is initiated by the Registrar, publication may take place no earlier than 15 days after the letter has been sent. Dissolution or restoration takes effect upon the removal or restoration of the entity’s name from or to the register. The court or Registrar must refuse restoration if the legal entity is likely to be used for an unlawful purpose or a purpose prejudicial to public peace, welfare or order in Singapore, or if restoration would be contrary to national security or national interests.

• Registered Office and Inspection Rights: The previous minimum opening hours for public access have been abolished, while statutory inspection rights remain in place. Upon reasonable prior notice, the relevant documents must be made available for inspection for at least two hours on each relevant business day. Changes to the registered office address must still be reported within 14 days of the change.

Implications for Foreign Companies and Investors

The amendments also affect Singapore subsidiaries and shareholding structures of foreign investors. Companies should ensure, in particular, that the information filed with ACRA is up to date and complete before submitting their next Annual Return. At the same time, the new regulations provide greater flexibility in organizing the registered office and simplify certain corporate administrative procedures.

Further information is available in the official ACRA announcement.

—

Your point of contact in Singapore: Dr. Andreas Respondek

Respondek & Fan Pte Ltd

1 North Bridge Road
#16-03 High Street Centre
Singapore 179094

CELL:      +65 9751 0757
TEL:        +65 6324 0060

www.respondekfan.com
respondek@respondekfan.com

On October 1, 2026, a new law to combat cybercrime entered into force in Japan as part of a staggered legislative package. It includes various provisions aimed at preventing, defending against, and investigating cyberattacks in Japan by domestic and foreign actors.

In addition to numerous other new provisions and amendments, the law regulates the following key areas, among others:

1. Reporting Obligations for Operators of Critical Infrastructure

The law provides for notification obligations for operators of specified critical social infrastructure to the competent supervisory authorities when they introduce certain important systems (“critical systems”), such as certain new computer systems. This applies where there is a risk that the functions of the facilities and programs used by the operator to provide infrastructure services could be impaired or disrupted if the cybersecurity of the respective critical system is compromised, for example, by a hacker attack.

Operators of critical infrastructure are companies from 15 sectors defined in greater detail in Japan’s “Economic Security Promotion Act” that meet the respective statutory criteria and are designated as relevant operators. These include, among others, operators in the electricity, telecommunications, banking, and finance sectors.

The notification obligations include the product name, the manufacturer, and further information about the newly introduced system.

2. Immediate Reporting of Cyberattacks

If a cybersecurity-related incident occurs in a critical computer of such an operator, as defined in greater detail by the law, the operator must notify both the competent minister and the Prime Minister. Circumstances that could lead to such an incident must also be reported.

The notification must be made “without delay.” The minister may require an operator who fails to submit such a report or submits an incomplete report to provide a correct notification. Violations of these obligations may result in fines of up to 2 million yen, depending on the nature of the violation.

3. Powers of Intervention of the Police and Supervisory Authorities

Another new provision grants the police the authority, in the event of legally defined threat situations in the area of cyber defense, to take measures via the network itself to remove data that pose significant risks to the life, physical integrity, or property of individuals. For example, the police may delete the affected malware and inspect the computer’s records. Except in cases of imminent danger, permission from the commission established for this purpose is required.

In exceptional cases, the supervisory authorities may, with the commission’s permission, access the communication data and systems of operators without their consent if there are reasonable grounds to believe that data related to cyberattacks are being transmitted through these systems. Depending on the individual case, this is conceivable even in the case of cyberattacks with no direct connection to Japan, provided there are reasonable grounds to assume that relevant data concerning the cyberattack can be found in the respective systems.

In individual cases, telecommunications companies may be required to cooperate with the government, particularly by sharing information about their facilities and other data.

The Law Is Also Relevant to Foreign Companies:

If a foreign company or its subsidiary operates critical infrastructure as a relevant operator, the notification obligations described above may also apply directly to that company or subsidiary.

In individual cases regulated by law, the competent minister may also require foreign companies that supply technology to operators of Japanese critical infrastructure to share information with the minister if a vulnerability is discovered in a product. In addition, the minister may, where necessary, share the information obtained about the vulnerability and its remediation with the public. Depending on the individual case, the minister may also be authorized to request that the company remedy the vulnerability.

The law is also expected to affect foreign companies indirectly. For example, it can be assumed that companies providing cloud services or operating Security Operations Centers may in the future be asked by operators of critical infrastructure to agree to new, short-term notification obligations in the event of cyberattacks, etc., due to the requirement to report incidents “without delay.”

Companies should therefore assess at an early stage whether they or any of their subsidiaries are affected by the changes. Where appropriate, it may be advisable to adapt internal processes to the new legal situation.

Further laws forming part of the legislative package relating to cybersecurity are expected to enter into force gradually by November 2027.

—

Your point of contact in Japan: Michael Andreas Müller

Mueller Foreign Law Office

Shin-Kasumigaseki Building
3-3-2 Kasumigaseki, Chiyoda-ku
Tokyo 100-0013, Japan

TEL:      +81 3 6805 5161

www.mueller-law.jp
info@mueller-law.jp