Uganda: the URA's EFRIS e-invoicing system

Uganda mandates electronic invoicing and receipting through EFRIS (the Electronic Fiscal Receipting and Invoicing Solution), a real-time clearance platform run by the Uganda Revenue Authority (URA). Every invoice or receipt is sent to the URA, which "fiscalises" it by stamping a Fiscal Document Number (FDN), a verification code and a QR code. Mandatory for all VAT-registered taxpayers since 1 January 2021, the regime expanded in 2025 to many sectors, including non-VAT-registered operators.

Context & legal framework

EFRIS is the cornerstone of Uganda's tax digitalisation. It sits within the Domestic Revenue Mobilisation Strategy and aims to close the VAT gap by making every transaction visible to the Uganda Revenue Authority (URA) in real time.

• Who runs it? The URA, the national tax administration, which hosts the central EFRIS server and issues the fiscal identifiers stamped onto every document.
• Legal basis. Section 73A of the Tax Procedures Code Act, 2014 makes EFRIS mandatory and empowers the URA to require e-invoices and e-receipts.
• Who is in scope? Originally all VAT-registered taxpayers. From 1 July 2025 (General Notice No. 2218 of 2025) the obligation extends to roughly a dozen sectors — fuel, mining and quarrying, manufacturing, energy, construction, transport and storage, accommodation, ICT, real estate, professional services — including non-VAT-registered businesses.
• Why? To curb under-declaration, pre-fill VAT returns, speed up refunds and strengthen the tax base.

EFRIS coexists with the Digital Tax Stamps (DTS) regime, which applies digital stamps to excisable goods (beverages, sugar, cement, etc.). Together they give the URA a unified view of goods movements and turnover.

Regulatory timeline

Dates are indicative: some thresholds and sectoral deadlines evolve; confirm with the URA for a specific case.

Format & technical schema

EFRIS uses neither UBL nor any open standard: the exchange relies on a proprietary URA JSON API. Each call (an "interface") is wrapped in three blocks:

• data — the business payload: content (encrypted, Base64-encoded payload), signature (RSA signature) and dataDescription with codeType and encryptCode.
• globalInfo — the technical context: appId, version, dataExchangeId, interfaceCode, requestCode, requestTime, tin, brn, taxpayerID, deviceNo, deviceMAC, longitude/latitude, etc.
• returnStateInfo — the response status: returnCode and returnMessage.

Key interface codes: T101 (system info / dictionaries), T103 (symmetric key / login), T104 (obtain the AES key), T109 (invoice/receipt upload), T130/T131 (goods and stock management). The business content of a T109 invoice includes sellerDetails, buyerDetails, basicInformation, goodsDetails, taxDetails and summary — none of which may be empty.

{
  "data": {
    "content": "<AES-encrypted, Base64-encoded JSON payload>",
    "signature": "<RSA signature of content>",
    "dataDescription": { "codeType": "1", "encryptCode": "2", "zipCode": "0" }
  },
  "globalInfo": {
    "appId": "AP04",
    "version": "1.1.20191201",
    "dataExchangeId": "9230489223014123",
    "interfaceCode": "T109",
    "requestCode": "TP",
    "requestTime": "2026-06-23 10:15:42",
    "responseCode": "TA",
    "userName": "admin",
    "deviceNo": "1010101010",
    "tin": "1000000000",
    "brn": "",
    "taxpayerID": "1",
    "longitude": "32.5825",
    "latitude": "0.3476"
  },
  "returnStateInfo": { "returnCode": "", "returnMessage": "" }
}

Uganda's standard VAT rate is 18%; amounts are in Ugandan shillings (UGX), and every good/service must map to a previously registered commodity code (goodsCategoryId). The decrypted business content (interface T109) carries the sellerDetails, buyerDetails, goodsDetails (with taxRate 0.18), taxDetails and summary blocks.

Transmission flow

The taxpayer picks one of the integration channels offered by the URA, after which every transaction is fiscalised by the EFRIS server before being handed to the customer.

• System-to-System (API) — the company's ERP/POS talks directly to EFRIS over the JSON API; best for high volumes and full automation.
• Electronic Fiscal Device (EFD) — a certified device (POS + Sales Data Controller, SDC) with tamper-proof fiscal memory that issues e-receipts and e-invoices, including offline.
• e-Invoicing client — an installable desktop / smartphone application for taxpayers without an integrated ERP.
• EFRIS web portal — manual entry via the URA portal (TIN + password), suited to low volumes.

Fiscalisation cycle:

1. The sale is captured (POS, ERP, portal or client).
2. The document is sent to the EFRIS server, which validates it and stamps four mandatory fields: the FDN (Fiscal Document Number), the Invoice Identification Number, the verification code and the QR code.
3. The fiscalised invoice/receipt is returned to the seller and given to the customer (paper or electronic).
4. The customer can verify authenticity by scanning the QR or entering the FDN / verification code in the EFRIS validation app or the URA portal widget.

Offline mode: the system-to-system connection tolerates up to 5 days of offline operation; documents are stored locally and synchronised with EFRIS once connectivity returns. EFDs also issue offline.

Validation & compliance

• Authentication & encryption. API integration requires a key exchange: fetch an AES key via T104 (decrypted with your RSA private key), AES-encrypt the payload, then RSA-sign the content. Any mis-signed or mis-encrypted request is rejected.
• Non-empty fields. EFRIS rejects an invoice if sellerDetails, buyerDetails, goodsDetails or summary are empty, or if invoiceType = 4 without a populated extendField.
• Tax consistency. VAT amounts must reconcile (18% standard rate, correct zero/exempt codes) and each line must point to a registered commodity code with up-to-date stock (interfaces T130/T131).
• Traceability. The FDN and verification code guarantee document uniqueness; the QR code enables instant public validation.
• Penalties (2025–2026). For a VAT taxpayer, failure to issue or to use a fiscal device: double the tax due or UGX 200,000 (whichever is higher). For the newly added non-VAT sectors, non-issuance can expose the business to fines of up to UGX 30 million and/or imprisonment of up to 10 years upon conviction.

Common pitfalls

• Assuming EFRIS speaks UBL/Peppol. It does not: it is a proprietary URA JSON API with AES/RSA encryption. No direct standard mapping — plan a transformation layer from your ERP.
• Neglecting key management. The AES key from T104 has a lifetime; an expired token or invalid RSA signature blocks all submissions. Automate renewal.
• Unregistered goods catalogue. Issuing an invoice for an item whose commodity code or stock is not configured triggers a rejection; stock must be maintained alongside sales.
• Mishandling offline mode. Beyond 5 days without synchronisation, issuance is compromised; actively monitor the offline queue.
• Assuming non-VAT means out of scope. Since July 2025, entire non-VAT sectors are subject to EFRIS — with the heaviest penalties for non-compliance.
• Confusing EFRIS and DTS. Digital Tax Stamps are a separate regime for excisable goods; one operator may fall under both.
• Omitting the buyer TIN in B2B. For B2B sales, a missing buyerTin prevents the buyer from recovering input VAT.

Cross links

• Official site: URA — EFRIS and the EFRIS portal.
• Since EFRIS is proprietary, compare it with the open standards used elsewhere: the UBL format, the Peppol network, or ISO 20022 banking messages. For classic EDI, see EDIFACT.
• Browse other jurisdictions in the country index, or check the glossary for technical terms.