Keeping Business Records for 5 Years: A Digital Filing Setup

How long Singapore businesses must keep records

IRAS's record keeping requirements for companies say a company must keep source documents, accounting records and schedules, bank statements and other records of business transactions for at least 5 years from the relevant Year of Assessment (YA). Because the YA follows the financial year, the real period is longer than five years from the date of a receipt.

IRAS's own example: a company with a December year end has its financial year 2022 assessed in YA 2023, and must keep those records until 31 December 2027. The MOM employment records page sets the separate rules for employee records, which may be kept in soft or hard copy.

Are scanned receipts and electronic records accepted?

Yes. IRAS's GST record-keeping page says you can keep records in electronic media and imaging systems without seeking approval from IRAS, provided you meet the conditions in its record keeping guides. The Record Keeping Guide for GST-Registered Businesses (twelfth edition, 30 January 2026) states that physical copies of source documents need not be kept if the source documents are kept electronically.

The condition is quality. The same guide says you should have internal controls to ensure the integrity, completeness, accuracy, availability and reliability of electronic records, and points to the Evidence (Computer Output) Regulations as a reference for imaging systems. In practice:

• Scans must be legible in full: amounts, dates, supplier name and GST number readable.
• Every page of multi-page invoices and contracts is captured.
• Files are stored where they cannot be quietly edited or lost, with backups.
• You can find and produce any record quickly if IRAS asks.
• Thermal-paper receipts fade, so scan them promptly; IRAS suggests photocopying them if you keep paper.

A digital filing structure that survives five years

Most records already live in your accounting software (Xero, QuickBooks) with the receipt image attached. Everything else, such as contracts, bank statements, payroll exports and GST working papers, needs a simple, consistent folder structure in Microsoft 365 SharePoint or a Google shared drive.

1. 1

   Create one finance library owned by the company

   Use a SharePoint site or Google shared drive, not someone's personal OneDrive or My Drive, so files stay when people leave.

2. 2

   Organise by financial year, then by type

   For example: FY2026 / Bank statements, Sales, Purchases, Payroll, GST returns, Year-end. Use the same folders every year.

3. 3

   Name files the same way every time

   Date first, then counterparty and document type: 2026-10-03 Supplier-name Invoice INV1234.pdf. Searchable and sorted by date.

4. 4

   Capture receipts at source

   Staff photograph or forward receipts into a capture tool or accounting app the same day, rather than collecting paper for month-end.

5. 5

   Lock each year after filing

   Once the tax return for a year is filed, set that year's folder to read-only for everyone except the finance owner.

6. 6

   Diary the deletion date

   Record when each year's folder may be reviewed for deletion, for example 'FY2022: review after 31 Dec 2027'.

Receipt capture tools speed up the 'capture at source' step; our comparison of Dext vs Hubdoc covers the two common Xero and QuickBooks add-ons. For which document is which, see receipt vs invoice vs tax invoice.

Permissions: who can see and change financial records

Financial records contain salaries, bank details and personal data of customers and staff. Keep access narrow and changes traceable.

Backup: the copy IRAS will never ask about

IRAS's guide notes that if records are missing or destroyed, it is your responsibility to reproduce them from other documents. A ransomware attack, an accidental mass deletion or a cancelled subscription can wipe out years of records, and cloud storage alone does not protect against those.

Keep at least one backup copy of the finance library and periodic exports from your accounting software outside the main system, ideally immutable so it cannot be altered or deleted for a set period. Our guides to backing up Microsoft 365 and Google Workspace and to choosing a backup service explain the options.

Balancing 5-year retention with the PDPA

The PDPA pulls the other way. Section 25 requires an organisation to stop keeping documents containing personal data, or anonymise them, as soon as it is reasonable to assume the purpose is no longer served and retention is no longer necessary for legal or business purposes. The PDPC's guidelines on the Retention Limitation Obligation explain that the PDPA does not set a fixed period, but organisations must follow legal and industry retention requirements and should not keep data 'just in case'.

So the tax rule is a reason to keep invoices and payroll records for five years, not a reason to keep everything forever. Old enquiry forms, CVs of unsuccessful applicants and marketing lists have their own, shorter purposes. A written retention schedule sorts this out; our data retention policy template gives a starting point. This is general information, not tax or legal advice.

Do it yourself or get help?

A small business can set up the folder structure and permissions in an afternoon. The parts that usually get skipped are backups outside the main system and the yearly review of what can be deleted.

Our Backup & Ransomware Recovery service (S$290) sets up protected backups of your finance library and mailboxes. For receipt capture and accounting sync, Xero / QuickBooks Integration (S$390) connects your bank, payment and receipt tools so records land in one place.