How long must you keep receipts & records for SARS?

The five-year rule

Under the Tax Administration Act, SARS requires you to keep the records that support your tax returns for five years from the date the return is submitted. That applies to income tax, VAT and other taxes. The clock starts at submission, not at the end of the tax year — so a return you filed late is held against the date you actually filed it.

Two situations extend that period:

• Late returns. If you submitted a return after its due date, the five years runs from the later submission date.
• Audits, objections and disputes. If SARS has begun an audit or investigation, or you've lodged an objection or appeal, you must keep the relevant records until the matter is fully concluded — even if that pushes you past the five years.

Because of this, many businesses simply keep everything indefinitely once it's digital — there's no cost to holding a PDF, and it removes any risk of binning something you later need.

What counts as a record?

A "record" is anything that supports a figure on your returns. For a typical small business that means:

• Receipts and tax invoices for the expenses you claimed;
• Invoices you issued to customers;
• Bank statements and proof of payments;
• Contracts and agreements;
• Asset records for anything you're depreciating;
• Payroll and employee records.

If it backs up income you declared or a deduction you took, keep it. (Other laws, like the Companies Act, set their own retention periods for company documents — often longer — so check those separately if they apply to you.)

Are digital and photographed receipts allowed?

Yes — and unlike most articles on this topic, we can point you at the exact rule that says so.

The authority is Government Notice 787, published in Government Gazette 35733 on 1 October 2012, issued by the SARS Commissioner under section 30(1)(b) of the Tax Administration Act. It defines "electronic records" as records stored electronically that are "either originally created in an electronic form or are converted from any non-electronic form into an electronic form."

That final clause is the one that matters. Converting a paper slip into a digital image is expressly contemplated by the rules. A photo of a till slip is a valid record, not a tolerated substitute for one.

This matters because thermal till-slip ink fades. A receipt that's perfectly readable today can be a blank grey rectangle in eighteen months. Capturing a digital copy the moment you get it isn't just convenient — for fading slips, it's the only way the record survives the five years you're required to keep it.

The four conditions your digital records must meet

Notice 787 doesn't just permit digital records, it sets conditions. Most businesses meet them without trying, but it's worth knowing what they are.

1. An "acceptable electronic form." The record's integrity must meet the standard in section 14 of the Electronic Communications and Transactions Act, meaning it stays complete and unaltered. And when SARS asks, you must be able to give them an electronic copy they can "readily access, read and correctly analyse," or a paper copy. In plain terms: it has to be legible and you have to be able to produce it. A blurred, half-cropped photo fails this. So does a folder of 4,000 files named IMG_2847.jpg that you can't search.

2. Records must be stored in South Africa. Rule 4.1 is blunt: electronic records "must be kept and maintained at a place physically located in South Africa." A senior SARS official may authorise offshore storage (rule 4.2) where the system is accessible from your SA address, a reciprocal tax-assistance agreement exists with that country, and the records still meet every other requirement. The form for that authorisation is the EFR001.

This one deserves a flag, because almost nobody mentions it. Xero, Sage, QuickBooks, Google Drive, Dropbox and most cloud platforms host data offshore. If your records live only in offshore cloud storage, rule 4 is engaged. We're not going to tell you this is a crisis — enforcement against ordinary small businesses using mainstream cloud software isn't a live issue, and South Africa has a wide network of reciprocal tax agreements. But you should know the rule exists. Know where your provider stores data, keep your records accessible from your South African address, and raise the EFR001 question with your practitioner. If you also retain a local copy, the question becomes largely academic.

3. System documentation — which probably doesn't apply to you. Rule 5 requires businesses to document their record-keeping system. But rule 5.1 exempts you entirely if you use "computer software or an electronic platform that is commonly recognised in South Africa." Use mainstream accounting software and you can ignore this. Build something bespoke and you can't.

4. Keep the keys, not just the records. Rule 6 requires you to store the passwords, log-in codes and certificates needed to access encrypted records, for the full retention period. An archive you can't open, or a cloud account whose password left with a former bookkeeper, is not a compliant record.

A schedule of expenses is not evidence of expenses

SARS states it plainly on its supporting-documents guidance: it will not accept schedules or lists of expenses on their own. It wants the actual invoices and receipts.

A beautifully reconciled spreadsheet showing R84,000 of deductible expenses isn't evidence of R84,000 of deductible expenses. It's a claim about them. The evidence is the documents. If you can't produce them, the deduction is disallowed and you pay the tax, plus interest (10.25% per annum from 2 March 2026) and penalties.

While you're at it: is the slip even a valid tax invoice?

Keeping a receipt for five years is pointless if it was never valid to begin with. Under section 20 of the VAT Act, the requirements scale with the amount:

• Over R5,000 — you need a full tax invoice: the words "tax invoice"/"VAT invoice"/"invoice", the supplier's name, address and VAT number, your name and address (plus your VAT number if you're a registered vendor), a serialised number and date, a proper description, the quantity, and the value and VAT.
• Not exceeding R5,000 — an abridged tax invoice is fine, and it can leave your details off entirely.
• Not exceeding R50 — no tax invoice required at all, though you still need some document to support the expense.

The expensive, recurring mistake: an employee spends R7,500 on the company card and comes back with a slip carrying none of the business's details. The business claims R978 of input tax it isn't entitled to. Above R5,000, the invoice must carry your details — and if it doesn't, the claim fails on audit. Check at the counter, not in March.

How to store records so an audit is a non-event

A good system has three properties: complete (nothing missing), legible (every copy clear), and retrievable (you can find any single document in seconds). A folder of loose photos on a phone fails the third test. A structured, searchable, backed-up store passes all three.

This guide is general information, not tax or legal advice. Retention rules can change and other laws may apply to your business — confirm the current requirements with SARS or a registered tax practitioner.