Running FBR digital invoicing for many clients: a CA firm playbook

Answer first. A firm that runs FBR digital invoicing for many clients needs three things that a single business does not. It needs a register of every client’s credentials, kept by the firm and never in someone’s phone. It needs a daily check of each client’s rejected and doubtful invoices, because a wrong invoice can only be cancelled or edited by hand within 72 hours. And it needs a month-end plan that spreads the work, so that every client’s reconciliation does not land on the same three days. The tax advice stays where it always was, with the engagement partner. What changes is that the firm now also runs a small daily operation.

What changes with many clients

With one client, a partner can carry the whole picture in their head. They know who holds the IRIS login, which products use a reduced rate and which buyer always sends the wrong NTN. With twenty clients, that knowledge has to live somewhere the whole team can see it, or it walks out of the door with the first manager who leaves.

The work also changes shape. Registration and testing happen once per client. Invoicing happens every day, for every client, and FBR answers every invoice on its own. A one-in-a-hundred error rate sounds small until it means fifty failed invoices a month across your book of clients, each needing someone to read the reason, fix the data and send it again.

So the playbook below is about routine: the same stages, the same checks and the same records for every client, with only the tax conclusions changing from one to the next.

Sort your clients first

Before you choose tools or assign staff, sort clients by how their invoices are actually made. The group decides how much of your team’s time each client will need.

Put the group in the client file and in the engagement letter. It sets expectations on both sides. A client in the first group who suddenly sends 2,000 invoices in a month has moved groups, and the fee and staffing should move with them.

One client, one set of keys

Credentials are where multi-client work goes wrong first. FBR’s digital invoicing token is tied to one registration number and stays valid for five years. A client group with three registered companies needs three tokens. If the wrong one is used, FBR answers with an access failure, which looks nothing like the data error your team will go looking for.

Keep a credential register for the whole firm. For each client it should show:

• the registration number each token belongs to, and the environment (sandbox or production)
• who at the client holds the IRIS login, and who covers them on leave
• the IP address the client sends from, if they send from their own system, because FBR whitelists it before anything works
• the date the token was issued, so the five-year renewal does not arrive as a surprise
• who in your firm may act for that client, and what they may do

The register lists who holds what. It should not hold the secrets themselves. Tokens belong in the software that uses them. Keep them out of spreadsheets and WhatsApp groups. In eInvoicePro, one account can hold FBR tokens for many seller NTNs or CNICs. The tokens are stored encrypted and can be saved or replaced but never read back out, so a team member who leaves cannot take them with them.

Never let a client’s staff log in with a partner’s personal IRIS details, or the other way round. Apart from the professional risk, it makes it impossible to tell later who did what.

The onboarding pack

Every new client should go through the same pack, in the same order. It saves the partner from rediscovering the process each time, and it gives juniors something they can follow.

1. Registration facts. NTN or CNIC, sales tax registration, province, and whether the client is also registered with PRA, SRB, KPRA or BRA for services.
2. Business nature and sector. The client picks these on the technical details screen in IRIS. They decide which sandbox test scenarios FBR assigns, anywhere from two to fifteen. Agree the answers with the client before anyone clicks.
3. Product list. Every item the client sells, with its HS code, the sale type it falls under and the unit FBR accepts for that code. This is where most early rejections come from.
4. Buyer list. Regular customers with their NTN or CNIC checked against FBR, and a rule for walk-in or unregistered buyers that the engagement partner has signed off.
5. Sandbox evidence. The assigned scenarios cleared, plus the client’s own common invoices, a debit note and at least one invoice that is meant to fail.
6. First live week. A named person checking every invoice for the first few days, then dropping to the daily routine below.

Keep the finished pack in the client file. When the client changes accountant, opens a branch or adds a product line, you start from the pack rather than from memory.

The daily check and the 72 hours

Since 30 March 2026, Sales Tax General Order 01 of 2026 lets a business cancel, delete or edit a valid e-invoice made by genuine mistake within 72 hours of creating it. After that, it needs the Commissioner Inland Revenue’s prior approval, and FBR has not published how to ask for it. Three details make this tighter than it sounds:

• There is no cancel or edit function in FBR’s API. Someone with portal access has to do it by hand.
• PRAL’s user manual caps all edits and cancellations together at 10% of last month’s sales. It is one shared allowance per month.
• Editing a single line of an invoice removes the option to cancel that invoice later.

For a firm, this turns a weekly review into a daily one. A wrong invoice spotted on Monday for a sale made on Thursday is already outside the window. So build a short daily check for every client your firm operates, and ask client-operated clients to do the same:

The daily check should take a few minutes per client. If it takes longer, the client probably has a data problem worth fixing at the source. Our guide to correcting or cancelling an FBR invoice has the full rules.

Month end without the crunch

Most firms already feel month end as a wall of returns. Digital invoicing adds one useful thing and one risk. The useful thing is that Annexure-C is filled from the invoices FBR already holds, so a clean month needs less typing. The risk is that any gap between the client’s books and FBR’s record now shows up in the return.

Two changes in September 2026 made that gap more expensive. Under rule 150XD(2), as substituted by SRO 1666(I)/2026, an invoice with an FBR number that is missing from Annexure-C or the return is treated as an unaccounted sale, and the officer works out and recovers the tax, unless the invoice was cancelled through the approved route. And SRO 1655(I)/2026 added electronic scrutiny: FBR’s system can now send an advance intimation through IRIS when it finds a discrepancy. The client gets at least seven days to respond, then a reminder with at least seven more. Someone in your firm should be watching each client’s IRIS inbox as well as the client.

Three habits keep it calm:

• Reconcile weekly for busy clients. Comparing the sales register with FBR-accepted invoices once a week means the month-end check finds only a handful of gaps.
• Stagger the clients. Give each manager a fixed set of clients and a fixed order. The firm-operated and bulk clients go first, because they carry the most invoices.
• Watch the 180 days. A credit or debit note must carry the FBR invoice number of the original and be issued within 180 days of the supply. A return or price change spotted late in the year may already be outside it.

When a client sends a file of hundreds of invoices on the last day of the month, bulk upload helps with the typing but not with the thinking. Each invoice still goes to FBR on its own and gets its own answer. Agree a cut-off date in the engagement letter so the file arrives with time to fix the failures.

Clients who also owe PRA or SRB

An FBR invoice does not cover a provincial services obligation. A client who sells services in Punjab, Sindh, Khyber Pakhtunkhwa or Balochistan may also have to report to the provincial authority, through a separate system that gives its own invoice number.

In Punjab, PRA’s E-IMS applies to restaurants with turnover of Rs 6 million or more and to other services at Rs 10 million or more. The Punjab Finance Act 2026 also changed things for firms like yours. From 1 July 2026, accountants, auditors and tax consultants moved from the 5% rate to 8%. And buyers in Punjab can no longer claim input tax on invoices from a business that is not on the PRA or FBR active taxpayer list. That makes a client’s active status something their customers will start asking about.

Keep a column in your client register for each provincial authority, with the threshold that applies and the date the client crossed it. The PRA E-IMS guide and SRB POS guide cover the provincial rules.

Roles and engagement letters

Three roles keep each engagement clear. One person can hold more than one role for a small client, but each role needs a name.

• Engagement partner. Scope, tax treatment and anything that needs the Commissioner. Signs off the product and buyer rules before go-live.
• Delivery lead. Sandbox, setup, the daily check and month-end reconciliation for their set of clients.
• Client contact. Owns the daily invoices once the client runs them, and tells the firm the same day when something was wrong.

The engagement letter should then say, in plain words, who makes the invoices, who fixes rejections, who may cancel or edit in the portal, how fast the firm responds inside the 72-hour window, and the cut-off for month-end files. These lines prevent most of the arguments that come later.

Some firms prefer to recommend software and train the client. Others run invoicing as a managed service. Both work. Through the Alliance Partner Program, firms that recommend or set up eInvoicePro earn a commission, get training and marketing material, and are listed on our website. It does not change anyone’s legal duties, and it does not replace your advice.

FAQs

Can one person in our firm manage FBR invoicing for several clients? Yes, as long as each client’s credentials stay separate and the person has written authority from each client. A firm-wide credential register and a daily check per client keep it manageable. In eInvoicePro, one account can hold tokens for many seller NTNs or CNICs.

Does each client need its own FBR token? Yes. The token is tied to one registration number and lasts five years. A client group with several registered companies needs one token for each, and using the wrong one fails as an access error.

How fast must a wrong invoice be fixed? Under Sales Tax General Order 01 of 2026, a valid e-invoice made by genuine mistake can be cancelled or edited within 72 hours, by hand in FBR’s portal. After that, the Commissioner Inland Revenue’s prior approval is needed. Later commercial changes, such as returns, go through a credit or debit note within 180 days.

Should our firm run invoicing for clients or train them to do it? Either works. Train clients who have steady accounts staff, and run it as a managed service for clients who do not. Write the choice, the cut-off dates and who may cancel invoices into the engagement letter.

Do PRA or SRB clients need anything extra? Often, yes. Services in the provinces fall under provincial law, with separate systems and invoice numbers. In Punjab, PRA E-IMS applies from Rs 6 million turnover for restaurants and Rs 10 million for other services.

Related reading: eInvoicePro for CA and tax firms, bulk digital invoicing and the Alliance Partner Program.