FBR Digital Invoicing: A Step-by-Step Setup Guide for Small Businesses

Last reviewed: 7 October 2026. This is general information, not tax or legal advice. Confirm your own obligations with your tax advisor.

FBR Digital Invoicing (DI) means every sales tax invoice you issue is sent to FBR's system first, and comes back with a unique FBR invoice number and a QR code before it goes to the buyer. For a small distributor, manufacturer or service provider, the setup looks intimidating, but it follows a fixed path in IRIS. This guide walks through that path using PRAL's own Digital Invoicing User Manual v1.6 (April 2026) and the DI API technical documentation.

Who must comply, and by when

The legal basis is Chapter XIV of the Sales Tax Rules 2006, rewritten by SRO 69(I)/2025. FBR then notified who must integrate in stages. The latest schedule, SRO 1852(I)/2025, covers all sales-tax-registered persons (Comarch summary):

So as of October 2026, every deadline has passed. Exempt supplies must also go through DI (rule 150R(9)). Tier-1 retailers already integrated through FBR's POS system are treated as integrated. Islamabad service providers registered for ICT sales tax were brought in separately in mid-2026; see our guide on Digital Invoicing for Islamabad services businesses.

You may see a "31 July 2026" deadline on vendor blogs. We could not find an SRO behind it, so treat it with caution.

What happens if you don't

Under the Finance Act 2026, a person who must integrate and doesn't is liable to a penalty of up to Rs 1 million, then up to Rs 5 million if the default continues a month after the first penalty, and the business premises may be sealed (Finance Act 2026, s.33). Registration can also be suspended, and FBR began suspending non-integrated registrations in September 2026. How this applies to you is a question for your tax advisor.

Choose your route: PRAL, a private integrator, or manual entry

In IRIS, under Digital Invoicing, you choose an integration mode:

• Manual Invoice Generation. You key each invoice into the FBR portal. It is free and fine for a handful of invoices, but slow at any volume.
• API Integration. Your invoicing or accounting software posts invoices to FBR automatically. Here you nominate a licensed integrator.

There are two kinds of licensed integrator. PRAL (Pakistan Revenue Automation, FBR's IT company) acts as licensed integrator by law and must provide integration "free of cost" on demand (rule 150XF). Private licensed integrators, such as Haball, EY Ford Rhodes and WebDNAworks, charge for their service. Under STGO 01 of 2026 you may engage more than one.

For most small businesses, the PRAL route with your chosen software is the simplest: PRAL is free, and your software provider supplies the technical details. The rest of this guide follows that route.

Step-by-step: the PRAL route in IRIS

Step 1: Log in to IRIS yourself

Log in at iris.fbr.gov.pk with your NTN or CNIC and password, preferably on a desktop browser, and open Digital Invoicing. Never give your IRIS password to anyone, including a setup service. You log in; they guide you.

Step 2: Select API Integration and PRAL

Choose Integration Mode, API Integration, then Proceed with PRAL as Licensed Integrator.

Step 3: Fill in the technical details

The form asks for:

• a technical contact (name, mobile, email);
• ERP/System Provider (the name of your invoicing software), Software Type (Cloud or On Premises) and Software Version;
• a user ID and password for PRAL's support portal, dicrm.pral.com.pk, where you raise tickets;
• Business Nature (you can choose several, e.g. Manufacturer, Distributor, Service Provider) and Sector (exactly one).

Choose Business Nature and Sector carefully. They decide which test scenarios you must pass in the next steps.

Step 4: Whitelist the server's IP address

FBR only accepts API calls from IP addresses you register. Enter the hosting company, hosting country and between one and three IP addresses of the server that will send your invoices. For cloud software, your provider gives you these. PRAL accepts or rejects the IPs, according to its manual, within two working hours. Acceptance automatically starts sandbox testing.

Step 5: Get your sandbox token and see your scenarios

IRIS now shows the sandbox API details, sample JSON and a sandbox token: a long secret key your software uses to identify you. The Eligible Scenarios tile lists the test scenarios your Business Nature and Sector must pass, for example:

A pure service provider in the Services sector typically needs only SN018 and SN019. A manufacturer can face eleven or more. Always trust the IRIS tile over any list you find online, including this one.

Step 6: Pass the sandbox scenarios

Your software posts one valid test invoice per required scenario to the sandbox. A failed scenario shows the error in IRIS. Common causes are a wrong HS code, a unit that doesn't match the HS code, or rounding; see FBR Digital Invoicing error codes explained and how to find the right HS code.

Step 7: Receive the production token and go live

When all scenarios pass, IRIS generates a production token automatically. Your software switches to it, and from then on each invoice you issue is posted live and returns an FBR invoice number for printing with the QR code. The production token is valid for five years, according to the technical documentation.

After go-live: rules to train your accountant on

• Post before you send. The buyer should receive an invoice that already carries the FBR number.
• 72-hour correction window. Genuine errors can be cancelled or edited in IRIS within 72 hours; after that, prior approval from the Commissioner is needed (Profit). PRAL's manual adds limits, such as editing each item only once.
• Offline invoices. Invoices issued during an internet or power outage must be marked as offline and uploaded within 24 hours of restoration (rule 150XC).
• Keep records. Electronic records must be kept for six years (rule 150S).
• Check your ATL status. FBR updates the Active Taxpayers List weekly.

What is still unclear

• Rule 150R(13)(c) asks for a "software registration number" on each invoice, but there is no published way for software on the PRAL route to get one.
• The exact content of the QR code is not defined in the technical documentation; common practice is to encode the FBR invoice number.
• Whether one taxpayer can whitelist more than three IPs (the form allows a spreadsheet upload, which suggests yes).

Do it yourself, or get help

Everything above is free to do yourself, and FBR's IRIS Sales Invoice Management SOP is a useful companion. Where businesses get stuck is choosing the right sector, getting each scenario to pass, and knowing what to do when a live invoice is rejected.

If you are in Islamabad or Rawalpindi and want it done with you, our FBR Digital Invoicing setup service connects you via PRAL, runs the tests and gets your first FBR-numbered invoice out, starting with a free ATL check. We are an independent service, not affiliated with FBR or PRAL, and not a licensed integrator. For regular invoices that don't need FBR, our free invoice generator works in PKR.