Invoice and accounts payable capture in South Africa: what to automate, outsource and check
Invoice and AP capture, outsourced or automated: the VAT invoice details to check, how long to keep invoices, and bank statement extraction.
Last checked

The short answer
Invoice processing outsourcing in South Africa means handing the capture of your supplier invoices to software, an outside team or both: each invoice is received, its fields are read, it is checked for the details a valid tax invoice needs, matched to an order and a delivery, coded, and posted for your approval. The same tools and teams can extract the transactions from bank statements, with different checks.
Regular suppliers whose invoices arrive as PDFs in the same layout each month suit extraction software. Scanned slips, handwritten delivery notes, credit notes and anything that does not match need a person to read them.
You can run the software yourself, outsource the capture to a team, or buy a managed service that combines both. Whichever you choose, keep two things in-house: approving what gets paid, and approving any change to a supplier's banking details.
What accounts payable capture covers
- Intake. Invoices arrive in a shared mailbox, on supplier portals, by post and with deliveries. Each one gets a received date and a reference.
- Capture. The header fields (supplier, invoice number, date, order number, totals and VAT) and, where you need them, the lines (item, quantity, unit amount).
- Validation. Is it a valid tax invoice? Is the supplier's VAT number the one on file? Do the lines add up to the total?
- Matching. Two-way matching compares the invoice with the purchase order. Three-way matching adds the goods received note, so you pay only for what arrived.
- Coding. Each invoice or line is given its general ledger account, cost centre and tax code.
- Approval. The invoice goes to the person who may approve it, by value and by budget.
- Posting. The approved invoice is posted to your accounting or ERP system, ready for the payment run.
- Statement reconciliation. Each supplier's monthly statement is compared with what you have posted, so missing and duplicate invoices are found before month-end.
A provider can do steps one to five and eight for you. Approval and the payment run are yours.
The details a tax invoice must carry
The Value-Added Tax Act sets out what a valid tax invoice contains, so it is also the minimum list of fields to capture and check. Except as the Commissioner may otherwise allow, a full tax invoice must be in rand and show:
- the words "tax invoice", "VAT invoice" or "invoice";
- the supplier's name, address and VAT registration number;
- your name and address and, where you are a registered vendor, your VAT registration number;
- an individual serialised number and the date of issue;
- a full and proper description of the goods or services;
- the quantity or volume supplied;
- the value of the supply, the VAT charged and the total, or the total with the VAT or a statement that VAT is included and the rate.
Where the consideration in money for a supply does not exceed R5 000, an abridged tax invoice may be issued instead. It may leave out your details and the quantity, but must still carry the supplier's details, a serialised number and date, a description, and the amounts. The abridged form does not apply to a supply charged with tax under section 11, the zero-rating section.
SARS says that without a proper tax invoice a business cannot deduct input tax on business expenses. An invoice missing your VAT number, or with the supplier's VAT number wrong, is therefore worth catching at capture, while the supplier can still correct it. Except as the section otherwise provides, a VAT-registered supplier making a taxable supply must issue the tax invoice within 21 days of the date of that supply, and the same section says it is not lawful to issue more than one tax invoice for each taxable supply.
Automate, outsource, or both
- Software you run. Suits steady volumes from suppliers whose invoices arrive as PDFs. Ask how it handles a supplier it has not seen before and how it reads line items, which are harder than headers.
- An outsourced capture team. Suits paper, scanned slips, mixed layouts and lower volumes. Ask whether the team keys straight into your system or into a file you import, and how its accuracy is checked.
- A managed service. Software reads the invoices and people handle the exceptions, run for you. Ask which part is software and which is people, and who checks the people's work.
One way to start: capture invoice headers only for a month, measure the accuracy against your own records, and add line items and matching once the headers are right.
Controls that protect the payment run
- Changes to banking details. Never accept a supplier's new bank account from an invoice or an email alone. Confirm it by phone on a number you already hold, and have a second person approve the change in your system. A capture provider should flag a bank account that differs from the one on file and stop there.
- Duplicate invoices. Check supplier, invoice number, date and amount together, since a resent invoice may carry a new file name or a slightly different number.
- Unknown suppliers. An invoice from a supplier not on your master file goes to a person, not into the system.
- Separation of duties. Whoever captures an invoice should not be able to approve it or release the payment.
Bank statement extraction
Bank statement extraction reads each transaction's date, description, amount and running balance into structured data, and checks that the balances add up. It is used to reconcile your own accounts, and to read the statements applicants send with a credit or lease application. The checks differ from invoices:
- The balance test. The opening balance plus the transactions should equal the closing balance on every page. A statement that fails it has been misread or altered.
- The source test. A statement downloaded by the applicant is a document the applicant could have edited. Ask the provider how it detects a changed PDF, and whether it can read statements sent directly by the bank with the applicant's consent.
- Passwords and formats. Statements may arrive as password-protected PDFs or as images. Agree who holds the passwords and how long they are kept.
- Personal information. Statements reveal far more than a balance: salary, debit orders, spending. Capture only the fields you need and delete the rest on a schedule.
How long to keep invoices
The Tax Administration Act says a person who has submitted a return need not retain the records after a period of five years from the date of the submission of the return. SARS's short guide to the Act (Version 3, 29 March 2018), which says it is not a legal reference, adds that records under audit or investigation, or subject to an objection or appeal, are kept until that is concluded or final, or the five-year period ends, whichever is later.
The Act also sets the form. Records must be kept in their original form in an orderly fashion and in a safe place, in the form, including electronic form, prescribed by the Commissioner in a public notice, or in a form a senior SARS official specifically authorises. Ask your auditor which form applies before you rely on scanned copies alone.
Other laws can require longer periods. A company must keep the records it is required to keep for a period of seven years, or any longer period another applicable public regulation specifies, under the Companies Act, which also requires accounting records for the current financial year and the previous seven completed financial years.
Where invoices and statements carry personal information, such as a sole trader's details, section 14 of POPIA also applies: records may not be kept longer than their purpose needs, unless a law requires or authorises it, it is reasonably required for your lawful functions, a contract requires it, or the person consented. Once keeping them is no longer authorised, they must be destroyed, deleted or de-identified as soon as reasonably practicable.
POPIA when a provider handles your invoices
Supplier invoices name sole traders and individuals, staff expense claims carry employees' details, and bank statements are personal through and through. A provider that captures them for you is an operator, and section 21(1) requires you, in terms of a written contract, to ensure that it establishes and maintains the security measures in section 19. If the work or the data is outside South Africa, section 72 requires a listed ground for the transfer, such as a recipient bound by a law, binding corporate rules or a binding agreement giving adequate protection, or the person's consent.
How fees are usually charged
We found no published typical rates for invoice capture in South Africa, so compare quotes on the same basis. Providers may charge by the invoice, by the line, by the page, or for a dedicated team, with a set-up fee for connecting your accounting system or a monthly minimum. Ask what counts as an invoice when one PDF holds several, and whether credit notes and statements are charged the same. Then compare on the cost of one correct, posted invoice, including the exceptions your own staff still handle.
What to ask a provider
- Which accounting and ERP systems have you posted into, and do you post directly or by file import?
- Do you capture line items, or headers only, and how is accuracy measured for each?
- How do you check the tax invoice details and the supplier's VAT number?
- What happens when an invoice shows bank details that differ from our supplier file?
- How do you find duplicates, and what do you do with them?
- Can we test you on a month of our own invoices, including the worst ones?
- Will you sign our operator agreement, and where are the documents processed and stored?
- If we leave, do we get back every image, every captured field and the rules you built for our suppliers?
Where IAMX fits
IAMX's Document processing and data capture service is automation that takes in documents and data by email, upload, shared drives, messaging apps, webhooks or direct links to your accounting, CRM and ERP systems. It reads what matters and checks each item against your other systems; simple cases are handled automatically and anything unusual is passed to a person for a decision. It is built first for insurers, brokers and financial services firms, and approving payments stays with you. Where the work needs a team of people, IAMX's business process outsourcing service covers data capture, cleaning and removal of duplicates through BPO partners, drawn from its vetted network of specialist partners.
Questions buyers ask about invoice and accounts payable capture
-
Which companies offer invoice processing outsourcing in South Africa?
Invoice processing in South Africa is offered by three kinds of provider: accounts payable automation software that your finance team runs, outsourced data capture teams that key invoices into your system, and managed services that combine software and people and post checked invoices for your approval. Pick the type by how your invoices arrive, then test two or three providers on a month of your own invoices.
-
Can we outsource invoice processing in South Africa?
The capture can be outsourced: reading invoices, checking them, matching them to orders and posting them. Keep approval of what is paid, and of any change to a supplier's bank details, with your own staff.
-
What is three-way matching?
Three-way matching compares an invoice with the purchase order and with the goods received note before it is paid, so you pay only for what was ordered and what arrived. Two-way matching leaves out the goods received note and suits services, where nothing is delivered to a store.
-
Which details must a South African tax invoice show?
A full tax invoice shows the word invoice or tax invoice, the supplier's name, address and VAT number, your name and address (and your VAT number if you are registered), a serial number and date, a description, the quantity, and the amounts with the VAT, as section 20(4) of the VAT Act sets out, except as the Commissioner may otherwise allow. Where the consideration does not exceed R5 000, an abridged invoice may leave out your details and the quantity, except for zero-rated supplies.
-
How long must we keep supplier invoices?
Five years from the date you submitted the return, under section 29 of the Tax Administration Act, and longer while they are under audit or the subject of an objection or appeal. A company must also meet the Companies Act's seven years, so a company keeps them for the longer of the two. Confirm with your auditor.
-
Can a provider extract data from bank statements?
Yes, though the checks differ from invoices. Agree the balance check on every page, how altered PDFs are detected, who holds statement passwords, which fields are kept, and when the statements are deleted. Bank statements are personal information, so sign the operator agreement first.
-
Who approves payments if accounts payable is outsourced?
You do. A provider can capture, check, match and post invoices, and prepare the payment run, but the approval to pay and the release of payment should stay with authorised people in your business, separate from whoever captured the invoice.
Sources
- South African Revenue Service: Section 20(4) of the Value-Added Tax Act, quoted in SARS Interpretation Note 83 (Issue 3, 30 September 2024), says that, except as the Commissioner may otherwise allow, a full tax invoice must be in the currency of the Republic and contain the words tax invoice, VAT invoice or invoice; the supplier's name, address and VAT registration number; the recipient's name, address and, where the recipient is a registered vendor, its VAT registration number; an individual serialised number and the date of issue; a full and proper description of the goods or services; the quantity or volume; and the value, tax and consideration, or the consideration with the tax or a statement that tax is included and its rate. Checked .
- South African Revenue Service: Section 20(5) of the Value-Added Tax Act, quoted in SARS Interpretation Note 83 (Issue 3, 30 September 2024), says that where the consideration in money for a supply does not exceed R5 000, a tax invoice (an abridged tax invoice) must be in the currency of the Republic and may contain, instead of the full particulars, the words tax invoice, VAT invoice or invoice, the supplier's name, address and VAT registration number, a serialised number and date of issue, a description of the goods or services, and the value, tax and consideration; the subsection does not apply to a supply charged with tax under section 11, the zero-rating section. Checked .
- South African Revenue Service: SARS's Tax Invoices page (last updated 11 March 2021) says that without a proper tax invoice a business cannot deduct input tax on business expenses. Checked .
- South African Revenue Service: Section 20(1) of the Value-Added Tax Act, quoted in SARS Interpretation Note 83 (Issue 3, 30 September 2024), says that, except as otherwise provided in the section, a supplier, being a registered vendor, making a taxable supply (other than a supply contemplated in section 8(10)) must within 21 days of the date of that supply issue a tax invoice, and that it shall not be lawful to issue more than one tax invoice for each taxable supply. Checked .
- South African Government (gov.za), Government Gazette 35491: Sections 29 and 30 of the Tax Administration Act 28 of 2011, as published in Government Gazette 35491 of 4 July 2012, say a person who has submitted a return need not retain the records after a period of five years from the date of the submission of the return, and that records must be kept in their original form in an orderly fashion and in a safe place, in the form, including electronic form, prescribed by the Commissioner in a public notice, or in a form a senior SARS official specifically authorises. Checked .
- South African Revenue Service: SARS's Short Guide to the Tax Administration Act (Version 3, 29 March 2018), which says it is not a binding ruling and should not be used as a legal reference, gives the record retention period for a person who has submitted a return as from the date of submission of the return until the last day of a period of five years, and, for records under audit or investigation or subject to an objection or appeal, until that is concluded or final or the five-year period ends, whichever is the latest. Checked .
- Department of Justice and Constitutional Development: Section 24(1) of the Companies Act 71 of 2008 (Department of Justice text after amendment by the Companies Amendment Act 16 of 2024) says records a company must keep under that Act or any other public regulation must be kept for a period of seven years, or any longer period specified in any other applicable public regulation, and section 24(3)(c)(iii) requires accounting records for the current financial year and the previous seven completed financial years. Checked .
- South African Government (gov.za): Section 14 of POPIA says records of personal information must not be retained longer than necessary for the purpose unless retention is required or authorised by law, reasonably required for lawful purposes related to the responsible party's functions, required by a contract or consented to, and that a record no longer authorised to be kept must be destroyed, deleted or de-identified as soon as reasonably practicable; destruction or deletion must be done in a manner that prevents its reconstruction in an intelligible form. Checked .
- South African Government (gov.za): Section 21(1) of POPIA requires a written contract between the responsible party and the operator that ensures the operator establishes and maintains the security measures in section 19. Checked .
- South African Government (gov.za): Section 19 of POPIA requires the responsible party to identify all reasonably foreseeable internal and external risks to personal information and to establish, verify and update safeguards against them. Checked .
- South African Government (gov.za): Section 72 of POPIA bars transferring personal information to a third party in a foreign country unless a listed ground applies, such as a recipient bound by a law, binding corporate rules or binding agreement giving adequate protection, or the data subject's consent. Checked .