You've found your first contractor in Kuala Lumpur. Or Singapore. Or Jakarta. The work is clear, the rate is set, and then comes the tax question: how much do you withhold, where does it go, and what paperwork proves you did it right? Most teams get this wrong the first time. They either withhold nothing (and face a fine when the tax authority audits), or they withhold too much (and tie up contractor cash while they fight for a refund). The rules differ sharply by country, and a single missing field in your invoicing system can trigger an audit that stops payments for weeks. This guide walks you through the three most common contractor hiring scenarios in Southeast Asia—Malaysia, Singapore, and Indonesia—and shows you exactly which fields to capture, how to withhold, and which platform steps prevent costly compliance drift. Malaysia: The NPWP field that stops audits In Malaysia, contractor tax withholding hinges on a single piece of information: the contractor's tax ID, known as the NPWP (Nombor Pendaftaran Warga Pajak—but in practice, Malaysian tax identifiers include NRIC for residents or passport number for non-residents, linked to their tax file). Here's what most first-time hirers miss: if you cannot produce the contractor's tax ID in your audit trail, you cannot prove to the Inland Revenue Board (IRB) that you withheld tax correctly. And if you can't prove withholding, you personally become liable for the unpaid tax—even if you already paid the contractor and thought you were done. The withholding rule: Malaysia applies a 3% withholding on contractor payments, but only if the contractor is not registered for GST (Goods and Services Tax). If they are GST-registered, no withholding applies—they'll invoice you with GST, and that's their tax obligation. What to capture in your invoicing system: Contractor NRIC or passport number (linked to their tax file) Contractor GST registration status (yes/no) If GST-registered: their GST ID Withholding calculation and amount (3% if non-GST registered) Date withheld and payment method (this creates your audit trail) When you use a platform like Orin's invoicing layer , you can embed these fields directly into your contractor invoice template and automate the withholding calculation. If the contractor ticks 'GST-registered,' the system skips the 3% withholding automatically. If not, it calculates and logs the withholding amount every time, with a timestamp. That audit trail is what stops the IRB from coming back six months later asking, 'Where's the proof?' One more critical step: you must remit the withheld tax to the IRB monthly. If you withhold 3% but never file it, the IRB will eventually match the contractor's claim (they'll ask for proof of withholding on their end) with your records. A mismatch kills you. Use Orin's accounting layer to post withheld tax to a payable account immediately—don't wait until month-end to remember it exists. Singapore: The contractor tax gate Singapore's contractor tax system is simpler than Malaysia's but has a hard gate: if a contractor is classified as an employee, you owe CPF (Central Provident Fund) contributions. If they're genuinely independent, you don't. This gate is not a gray area—the Inland Revenue Authority of Singapore (IRAS) audits it aggressively. The classification test: IRAS uses a three-part test. The contractor must satisfy all three to avoid CPF: They provide their own tools, equipment, or materials (not company-provided) They can hire others to do the work on their behalf (you're not paying for their personal labor only) They carry their own business risk—if the work isn't done right, they bear the cost of fixing it, not you If all three are true, no CPF. If any fail, you owe CPF contributions at 17% of their gross income (split between employee and employer contributions, but you're liable for both if you misclassify). Withholding on contractor payments: Once classified as independent, there is no mandatory withholding on payment day. However, if the contractor earns over SGD 22,000 in a calendar year, they must file an income tax return, and IRAS may assess income tax at marginal rates. As the payer, you don't withhold—the contractor handles it. But you must file a contractor statement with IRAS at year-end, reporting all payments to that person. What to capture: Contractor's NRIC (Singapore ID number) Classification notes: document which of the three criteria they meet (to defend yourself if audited) Annual income YTD (so you know when they cross SGD 22,000 and trigger tax-filing obligations) Invoice and payment date (for year-end contractor statement filing) The audit trap in Singapore is misclassification combined with missing documentation. If IRAS comes back and says, 'This person looks like an employee to us,' you need to show written evidence that they met all three independence criteria. Email correspondence, their own invoice templates, photos of their own equipment—all of it matters. A signed contract