SARS asked you for supporting documents. Here's exactly what to do.

First: it's a verification, not an audit

These are two different processes and people conflate them constantly. Verification is SARS checking the information you declared against third-party data, your financial and accounting records, and your supporting documents. SARS aims to conclude it within 21 business days of receiving what it asked for.

An audit is a fuller examination of your financial statements, accounting records and supporting documents. SARS says an audit can run from 30 business days to 12 months, longer if the matter is complex or you're slow to cooperate.

A verification can be referred for audit — that's one of the three possible outcomes — but the letter that just arrived is almost certainly the lighter one. SARS states plainly that it can verify any taxpayer. Being selected does not mean SARS thinks you've done something wrong.

Read the letter properly

The verification letter tells you two things that matter: exactly which information SARS wants, and the date by which you must respond. Read the list carefully rather than skimming it. Sending SARS a general pile of paperwork that doesn't match the request is a common and expensive mistake.

You have two possible responses. Submit the documents SARS asked for. Or, if you now realise your original declaration was wrong, submit a Request for Correction (RFC) to change it instead. Choosing the RFC route when you know there's an error is far better than defending a figure you can't support.

The technical limits nobody mentions

Whether you're uploading via eFiling or the SARS Online Query System, the constraints are the same:

• Accepted formats: .pdf, .doc, .docx, .xls, .xlsx, .jpg and .gif
• Maximum 5MB per document
• Maximum 20 documents in total

That 20-document ceiling is the one that bites small businesses. If SARS wants substantiation for a year of expenses and you have 180 individual receipt photos, you cannot upload 180 files. You have to combine them into a small number of merged PDFs — and if your slips are 4MB phone photos, a merged PDF of forty of them will blow straight through the 5MB limit.

The practical answer is to merge receipts into themed PDFs (fuel, materials, subscriptions, travel) and compress them so each file lands comfortably under 5MB while staying legible. An illegible scan is not evidence. Neither is a file SARS can't open.

Where to send it

If you file on eFiling, the upload link appears once SARS has issued the verification letter. Alternatively use the SARS Online Query System, or book an appointment at a branch. If you submit via SOQS or at a branch, include the verification letter itself — it carries a unique barcode that links your documents to your tax record. Without it, your submission can drift.

For Filing Season 2026 SARS has also opened WhatsApp as a channel: you can view your ITA34 and Statement of Account there, and upload supporting documents through WhatsApp when prompted.

What happens next

SARS will attempt to complete the verification within 21 business days of receiving your upload, and may ask for more information during that window. If you're owed a refund, it is paid only once verification is finished — which is the real reason a slow or incomplete response hurts.

Three outcomes are possible:

• No issue. SARS notifies you on eFiling, by email or by post that the verification is complete.
• A discrepancy. SARS issues a Notice of Assessment based on a revised assessment.
• Financial risk. SARS issues a Referral for Audit Letter and the matter escalates. Any refund waits until the audit concludes.

If you disagree with the outcome, you can dispute it through the objections process. That is a separate road with its own deadlines.

How long SARS can come back to you

For taxes SARS assesses, such as income tax, an assessment normally becomes final three years from the date of assessment. For self-assessed taxes such as VAT, it's five years. But SARS can reopen an assessment where it finds fraud, misrepresentation or non-disclosure, and can extend finality in some cases.

This is why the five-year record retention rule exists and why it matters more than it looks. Here's what SARS requires you to keep, for how long, and whether photos count →

The part that decides the whole thing

Everything above is procedure, and procedure is easy. The outcome of a verification is decided months earlier, by whether the documents exist.

A verification request is a fixed-deadline demand for documents you were supposed to have kept anyway. If you've been capturing slips as you go, responding is an afternoon of merging PDFs. If you haven't, it's a weekend of turning out a car, a drawer and an email archive — and whatever you can't find becomes a deduction you lose, on top of a refund that sits frozen until you're done.

One further point worth knowing: a schedule of expenses is not evidence of expenses. A spreadsheet listing what you spent proves nothing on its own. SARS wants the underlying invoices and receipts.

This article is general information, not tax advice. Process details and timeframes are drawn from SARS's published guidance and can change — check the current SARS guidance or speak to a registered tax practitioner about your specific letter.