Most small and medium businesses in Pakistan don’t get into tax trouble because they’re trying to cheat the system. They get into trouble because bookkeeping was the thing that always got pushed to “next week,” until FBR or SECP came asking questions the owner couldn’t answer with a clean paper trail. By then, it’s not a bookkeeping problem anymore. It’s a penalty problem.
Here are five mistakes that show up again and again in SME files, what the law actually says about each one, and what it costs to get them wrong.
1. Treating “keeping records” as optional
A lot of business owners think of bookkeeping as something you do for your own sake, to know if you’re making money. Legally, it’s not optional. Section 174 of the Income Tax Ordinance requires every taxpayer to maintain accounts, documents, and records, and to keep them for six years after the end of the tax year they relate to, longer if a case is still open with any authority or court.
If you’re registered for sales tax, Section 22 of the Sales Tax Act goes further and spells out exactly what “records” means: sale and purchase invoices, credit and debit notes, bank statements, inventory records, utility bills, salary and labour bills, and even rental or lease agreements, all kept in English or Urdu at your business premises.
Here’s what actually bites: if you can’t produce a receipt or supporting record for a transaction when asked, the Commissioner is entitled to simply disallow or reduce that expense claim. So a business that genuinely spent money but never filed the invoice properly ends up paying tax as if that expense never happened.
It’s not usually one big missing invoice that causes damage. It’s a drawer full of small ones that adds up over an audit year.
A familiar scenario: a small trading firm pays a transporter in cash every month with no proper invoice, just a scribbled note. When the return gets picked for audit two years later, that entire year’s transport expense gets disallowed for lack of evidence, and the firm ends up with a tax bill on income it never really had.
2. Getting withholding tax wrong, or ignoring it entirely
This is the mistake with the sharpest teeth, and the one SME owners most often don’t see coming. If your business pays contractors, vendors, rent, or certain services above the prescribed thresholds, you are very likely a withholding agent under the Income Tax Ordinance, whether or not you’ve registered as one.
That means you’re legally required to deduct tax at source before you pay, deposit it with FBR, and file a monthly withholding statement.
Get this wrong and Section 161 makes you personally liable for the tax you should have deducted, plus a penalty equal to that same amount. In plain terms, if you should have withheld Rs 100,000 and didn’t, you can end up owing Rs 200,000 out of your own pocket, on top of the payment you already made to your vendor.
Late deposits add a further surcharge of 12% per annum under Section 205, and late or missing monthly statements carry a penalty under Section 182 of Rs 2,500 for each day of default, capped at Rs 2,500,000.
A familiar scenario: a small IT services company pays a freelance developer’s invoice in full, assuming withholding tax is “something only big companies worry about.” Two years and several missed monthly statements later, FBR raises a demand that includes the undeducted tax, the matching penalty, and accumulated surcharge, on a single vendor payment that felt routine at the time.
3. Skipping FBR’s digital invoicing integration
This one is new enough that many SMEs still haven’t caught up, and it’s already being enforced. Under STGO 01 of 2026, sales-tax-registered businesses are required to report invoices to FBR’s system in real time, before the invoice even reaches the customer, generating an FBR invoice number and QR code as proof.
There’s a 72-hour window to correct an invoice after issuing it. After that, changes need the Commissioner’s approval.
FBR began issuing notices to corporates and importers in late 2025 and widened enforcement to registered persons generally from January 2026, so the grace period most SMEs were relying on is over.
The penalties escalate with repeat non-compliance: Rs 500,000 for a first default, rising through Rs 1,000,000 and Rs 2,000,000 to Rs 3,000,000 for subsequent ones. A business still issuing manual or off-system invoices “for now” is sitting on an exposure that grows every time it happens again.
A familiar scenario: a retail brand keeps using its old manual invoice book at one outlet because the software integration “hasn’t gotten around to it yet.” A routine check flags the outlet, and the first default penalty alone wipes out a decent chunk of that outlet’s monthly profit.
4. Letting personal and business money mix
This is the oldest mistake in the book, and it’s becoming a more expensive one. Business owners who pay personal expenses from the business account, or deposit personal income into it without a clear trail, create exactly the kind of unexplained movement that makes an audit painful, because there’s no clean way to show which rupee belongs to what.
It’s also getting easier for FBR to notice. Finance Act 2026 introduced Section 165AB, requiring banks to report customers whose combined deposits and withdrawals across accounts hit Rs 100 million or more in any six-month period, including cash deposits, withdrawals, and peak balances.
That data gets run through automated matching against declared tax records, with mismatches flagged for review.
Even well below that reporting threshold, a business account that mixes personal and business transactions is simply harder to defend in any FBR inquiry, because there’s no bookkeeping left that clearly separates the two.
A familiar scenario: a boutique owner runs both her shop’s supplier payments and her household expenses through the same business account “to keep things simple.” When a routine query comes in about a large deposit, she can’t produce a clean explanation, because the deposit is tangled up with six months of unrelated personal transactions.
5. Forgetting SECP has its own bookkeeping demands
If your business is a private limited company, FBR isn’t the only regulator watching your books. Under the Companies Act 2017, your financial statements must be approved by the board and laid before the Annual General Meeting within 120 days of your financial year-end.
Companies with paid-up capital above Rs 10 million must file audited statements with SECP within 15 days of the AGM; smaller companies, broadly those with paid-up capital up to Rs 1 million, can file unaudited statements within 30 days instead. Miss these and Section 233 of the Companies Act brings penalties that can fall on the company and its officers directly, not just the business as an abstract entity.
A surprising number of small private limited companies treat SECP filing as an afterthought handled once at incorporation, then let it lapse in year two or three once the person who set it up moves on.
The books don’t disappear. The deadline just gets missed quietly, until it isn’t quiet anymore.
A familiar scenario: two partners incorporate a private limited company, file everything properly in year one while excited about the new venture, and then let annual filings slip for two years once daily operations take over.
By the time they need a clean company record, for a bank loan or a new investor, they’re facing late filing penalties and a scramble to reconstruct statements that should have existed all along.
The pattern underneath all five
None of these mistakes are really about tax law being unreasonable. They’re about bookkeeping being treated as paperwork for later, instead of the thing that protects you when someone official asks a question.
Good records don’t just keep you out of trouble. They’re also the only real way to know whether your business is actually making money.
The businesses that stay out of FBR and SECP’s crosshairs aren’t the ones with the cleverest structures. They’re usually just the ones that never let their books fall behind.
This article reflects the Income Tax Ordinance 2001, Sales Tax Act 1990, and Companies Act 2017 as amended by Finance Act 2026, along with FBR’s digital invoicing rules under STGO 01 of 2026, current as of September 2026. Specific penalty amounts and thresholds are periodically revised by FBR and SECP through SROs and circulars, so it’s worth confirming the current figure before relying on it for a specific situation.
Sources
FBR: Section 182 penalty schedule
SECP: Annual audited accounts requirements
