The invoice compliance change that will hit US accounts payable teams hardest in 2026 isn't the e-invoicing news everyone is talking about. It's the OFAC sanctions retention rule that doubled the recordkeeping window from five to 10 years — quietly finalized in March 2025 and now in force for every payment a US business makes. Most AP teams haven't updated their retention schedules. The penalties for getting it wrong run up to $356,579 per violation, and the statute of limitations was simultaneously extended to 10 years. That's the headline buried under the e-invoicing coverage.

Invoice compliance in 2026 is best understood by jurisdiction, because the obligations don't stack neatly. A US-based AP team paying a French SaaS vendor needs to satisfy IRS retention rules, OFAC screening, and receive a Factur-X structured invoice through France's Public Invoicing Portal. The same team paying a UK vendor sits in a calmer regime — for now. This post is the working checklist: what each region actually requires, what changed in 2026, what the penalties look like, and the order of operations for getting compliant without running three parallel programs.

United States: Sanctions and 1099 Are the 2026 Story

The federal compliance stack for US AP teams has four layers: IRS information reporting, SOX recordkeeping, BSA/AML obligations administered by FinCEN, and OFAC sanctions screening. Three of those layers shifted in 2025 and 2026.

OFAC Retention Now Runs 10 Years

On March 20, 2025, the US Department of the Treasury's Office of Foreign Assets Control published a final rule extending the recordkeeping requirement for compliance with US economic sanctions regulations from five years to 10. The rule became effective in 2025 and now applies to every record demonstrating sanctions compliance: vendor screening logs, the OFAC list version checked, the result, and the payment context. The change was paired with a corresponding extension of the statute of limitations for sanctions violations from five to 10 years.

For AP teams this means two things. First, your existing retention policy almost certainly needs updating — most schedules cap at seven years, which was the longest applicable period before March 2025. Second, every payment to every vendor needs a screening record that survives a decade. Civil penalties for OFAC violations now run up to $356,579 per violation or twice the transaction value, whichever is greater, regardless of intent. A single missed screening on a $200,000 vendor payment is a $400,000 exposure.

The 1099-NEC Threshold Tripled

The One Big Beautiful Bill Act, signed in July 2025, raised the 1099-NEC filing threshold from $600 to $2,000 effective for payments made during tax year 2026. This is the rare compliance change that reduces work. AP teams that issue thousands of 1099s annually for small contractor payments will see the long tail compress significantly — typical mid-market estimates suggest a 25-35% drop in total 1099-NEC filings. The administrative savings are real, but the trap is over-collecting W-9s on vendors who no longer need them. Update your vendor onboarding workflow to apply the new threshold, and stop forcing W-9 collection on under $2,000 relationships unless your state requires it (some do at lower thresholds).

SOX and IRS Baselines Haven't Moved

SOX Section 802 requires retention of audit-relevant records for seven years after the audit concludes, with willful destruction punishable by fines up to $5 million and 20 years imprisonment. IRS Publication 583 sets the same seven-year baseline for AP records that support deductions. SEC enforcement of recordkeeping has accelerated: in fiscal year 2024, the SEC ordered $8.2 billion in financial remedies, including $600 million specifically for recordkeeping failures, and 2025 added another $238.5 million in fines tied to inadequate documentation and incomplete audit trails.

The practical implication: set your global retention floor at 10 years to satisfy OFAC, and stop treating SOX and IRS as the binding constraints. They aren't anymore.

European Union: ViDA Adopted, Mandates Going Live Region by Region

The VAT in the Digital Age (ViDA) package was adopted by the Council of the EU in March 2025, locking in the framework that will require structured e-invoicing on all intra-EU B2B transactions by July 1, 2030. ViDA also gives member states the standing right to mandate domestic B2B e-invoicing without seeking individual derogations from Brussels — which is why the country-level mandates accelerated in 2026.

For AP teams paying EU vendors, the question isn't whether you'll need to receive structured invoices. It's which of your vendors lives in a market that flipped the switch in 2026.

Belgium: Live as of January 1, 2026

Belgium's mandatory B2B e-invoicing regime went live on January 1, 2026, using the Peppol network with UBL 2.1 as the data format. The mandate applies to invoices between two Belgium-established VAT-registered businesses. PDF invoices sent between in-scope parties are no longer compliant. If you have a single Belgian supplier, you need a Peppol access point — either through your AP automation vendor or a certified service provider.

Poland: KSeF Phased February and April 2026

Poland's KSeF (Krajowy System e-Faktur) became mandatory on February 1, 2026 for businesses with 2024 sales exceeding 200 million PLN, and April 1, 2026 for the rest, except very small businesses (monthly invoiced sales under 10,000 PLN) who have until January 1, 2027. KSeF is a clearance system: invoices route through a government platform for validation before reaching the buyer. Foreign companies without a Polish fixed establishment are not required to issue through KSeF, but they are required to receive — meaning your AP system needs to ingest KSeF-issued XML.

France: Receive in September 2026, Issue Per Company Size

France's regime begins September 1, 2026, with mandatory e-invoice reception for all VAT-registered businesses regardless of size, and mandatory issuance for large and mid-sized companies. SMEs have until September 1, 2027 to issue. The architecture uses a hybrid model: businesses transmit through accredited Partner Dematerialization Platforms (PDPs), with the central Portail Public de Facturation (PPF) acting as the directory and data concentrator for tax reporting. Acceptable formats include Factur-X (a hybrid PDF/XML), UBL, and CII.

Germany: Reception Live, Issuance Phased Through 2028

Germany made e-invoice reception mandatory in January 2025 — every German VAT-registered business has needed the capability for over a year. Issuance is phasing in: businesses with annual turnover above €800,000 must issue from January 2027, and all remaining businesses from January 2028. Acceptable formats are XRechnung, ZUGFeRD (the German hybrid PDF/XML), and Peppol BIS. If you sell to German customers, you should already be issuing-capable; if you only buy from German vendors, your reception capability is the priority.

EU Cross-Border: July 1, 2030

The cross-border piece of ViDA — Digital Reporting Requirements (DRR) for intra-EU B2B transactions — takes effect July 1, 2030. By that date, all intra-EU B2B invoices must be structured and reported to tax authorities in near real time. The format is the EN 16931 European standard. For mid-market AP teams, 2030 feels distant, but procurement contracts signed in 2026 with three-to-five-year terms will need to clear that bar. Build the requirement into your vendor master now, not in 2029.

United Kingdom: The Slow Lane With One Big 2026 Change

The UK is on a deliberately slower path than the EU, but two changes in 2026 matter for AP teams.

MTD for Income Tax Expanded April 2026

Making Tax Digital for VAT has applied to all VAT-registered businesses since April 2022. The April 2026 expansion brings Making Tax Digital for Income Tax Self Assessment (MTD-ITSA) into force for self-employed individuals and landlords with qualifying income above £50,000. For AP teams paying UK contractors, this isn't a direct obligation — but it does mean a meaningful share of your UK supplier base now needs digital records and quarterly digital submissions. Expect contractors to push back on accepting paper or PDF receipts and request structured invoice data for their own MTD compliance.

April 2029 Mandatory E-Invoicing — Design Phase Started January 2026

The UK government confirmed at Autumn Budget 2025 that mandatory e-invoicing for all VAT invoices (B2B and B2G, excluding B2C) will take effect April 1, 2029. The design phase started in January 2026, with HMRC running detailed stakeholder collaboration through 2026 and publishing an implementation roadmap at Budget 2026. The current direction signals Peppol as a likely format, with no real-time reporting to HMRC initially. Three years feels like time, but the UK transition will rhyme with Germany's: reception capability first, then issuance. AP teams buying from UK vendors should plan reception readiness for late 2027.

Records: Six Years, Digital, Per Notice 700/21

UK VAT records must be kept for six years from the date of issue under HMRC's Notice 700/21. Under MTD-VAT rules, designated VAT data must be held in functional compatible software with digital links between systems. Spreadsheets are still permitted as part of the digital records architecture, provided the links between them and the bridging software are digital, not manual cut-and-paste.

The 2026 Master Checklist

If you operate across all three jurisdictions, run your AP compliance program against this consolidated checklist. The retention floor is set by the longest applicable rule (OFAC's 10 years), which simplifies policy if you adopt one global standard.

Requirement	US	EU	UK
Record retention	10 years (OFAC); 7 years (SOX/IRS baseline)	10 years (most member states); 7 minimum	6 years (VAT records)
Sanctions screening	OFAC SDN, every vendor, every payment	EU consolidated list + member-state lists	UK OFSI consolidated list
Information reporting	1099-NEC ($2,000+ from 2026); 1099-MISC ($600+)	DAC7 (digital platforms)	MTD-VAT; MTD-ITSA from Apr 2026
E-invoicing — receive	Voluntary	Required wherever you transact (Belgium live, Poland, France, Germany active)	Plan for 2027–2028
E-invoicing — issue	Voluntary	Required by jurisdiction and size threshold	Mandatory April 2029
Audit trail	SOX-compliant, immutable, 10 years	Per member-state tax code	HMRC compliance, digital under MTD
Penalty exposure	$356,579 per OFAC violation; $5M + 20 yr criminal under SOX 802	Country-specific, often percentage of VAT due	Per-failure penalties under VAT Act

The first action is unglamorous: rewrite your AP retention policy to a single 10-year floor, retroactive where possible. The second is a vendor master audit — every active supplier tagged by jurisdiction with the e-invoicing capability you need to receive from them. The third is a sanctions screening cadence: not just at onboarding, but at every payment, with the screening result captured in the audit trail for each transaction. Most AP automation platforms — Ken included — handle the screening-and-capture step automatically, which is the only realistic way to maintain a 10-year defensible record across thousands of payments.

For vendor onboarding, update your intake forms to capture e-invoicing readiness as a structured field: format support (UBL, Factur-X, XRechnung, ZUGFeRD), Peppol access point identifier, and any country-specific portal IDs (KSeF, PPF). This data lives in your vendor master and routes invoices to the correct ingestion path. Without it, your AP team is doing manual triage on every EU invoice that arrives in 2026 and beyond.

The compliance posture that worked in 2024 — paper-aware, screening-light, retention set to seven years — will fail an audit in 2026. The teams that stay clean are the ones that consolidate: one retention standard, one screening process, one vendor compliance management policy applied globally, with jurisdiction-specific routing for e-invoicing. Everything else is execution against deadlines you already know.

Frequently Asked Questions

How long do I need to retain invoices in 2026?

Set a 10-year global retention floor for all AP records, including invoices, approval logs, sanctions screening results, and supporting documentation. The 10-year period satisfies the OFAC sanctions recordkeeping rule (extended from five years on March 20, 2025), and it comfortably exceeds the SOX seven-year requirement, the IRS seven-year baseline under Publication 583, and the UK VAT six-year rule under Notice 700/21. EU member states vary, with most requiring seven to 10 years depending on local tax law. A single 10-year policy is easier to enforce and prove than parallel jurisdiction-specific schedules.

What invoice compliance changes took effect in 2026 specifically?

Four changes hit in 2026. First, Belgium's mandatory B2B e-invoicing went live January 1, 2026, using Peppol UBL 2.1. Second, Poland's KSeF clearance system became mandatory for large businesses on February 1, 2026, and the rest on April 1, 2026. Third, the US 1099-NEC threshold rose from $600 to $2,000 for tax year 2026 under the One Big Beautiful Bill Act. Fourth, the UK's Making Tax Digital for Income Tax came into force in April 2026 for self-employed individuals and landlords with income over £50,000. France (September 2026), Germany (issuance from January 2027), and the UK (mandatory e-invoicing April 2029) are the next deadlines on the horizon.

What are the penalties for invoice non-compliance?

Penalties scale by jurisdiction and rule. In the US, OFAC sanctions violations carry civil penalties up to $356,579 per violation or twice the transaction value (whichever is greater), and SOX Section 802 willful destruction of audit records carries criminal penalties up to $5 million and 20 years imprisonment. The SEC ordered $600 million in recordkeeping-failure penalties in fiscal year 2024 alone. EU penalties are country-specific but often calculated as a percentage of VAT due. The UK applies per-failure penalties under the VAT Act and corresponding income tax legislation. The hidden cost is remediation: companies typically spend two to four times the fine amount reconstructing records and addressing material weaknesses identified in audit findings.

Do I need to issue e-invoices or just receive them?

It depends on where you and your trading partner are established. For 2026, US businesses have no e-invoicing obligation. EU businesses face country-specific rules: if you're established in Belgium, Poland (above threshold), or transact with French large companies, you need issuance capability now. Reception capability is broader — any business buying from a German supplier has needed it since January 2025, and the obligation expands across the EU as more mandates go live. UK businesses don't issue mandatorily until April 2029, but should plan reception capability for 2027–2028. The safe default for any AP team buying internationally: implement e-invoicing reception across UBL, Factur-X, and XRechnung formats now.

How does AI-powered AP automation help with 2026 compliance?

AI-powered AP automation closes three compliance gaps that humans struggle to maintain at scale. First, it captures a complete audit trail automatically — every action, system or human, timestamped and immutable, satisfying SOX and equivalent requirements without manual log-keeping. Second, it runs sanctions screening on every vendor and every payment, capturing the screening result into the transaction record for the full 10-year retention period. Third, it ingests structured e-invoice formats (UBL, Factur-X, XRechnung, ZUGFeRD, KSeF XML) alongside PDFs, routing each invoice through the correct compliance path based on the supplier's jurisdiction. Manual AP processes can technically meet 2026 requirements; they just can't do it reliably or affordably across hundreds of vendors and thousands of payments per month.

Related Resources

What is E-Invoicing? Compliance Guide for 2026 — Format details and country-by-country mandate matrix
AP Audit Trail: What It Is and Why Regulators Want One — How to build a SOX-compliant audit trail
Vendor Compliance Management — Framework for managing supplier compliance at scale
Vendor Onboarding — Capturing W-9s, sanctions checks, and e-invoicing capability at intake
Three-Way Matching — Core control for invoice authorization

Invoice Compliance Requirements: 2026 Checklist for AP Teams