The Karachi Chamber of Commerce and Industry (KCCI) has voiced strong concerns regarding the Federal Board of Revenue’s (FBR) newly implemented QR code authentication system for accessing the IRIS portal. The KCCI contends that while the measure aims to bolster cybersecurity, its practical application is creating significant operational difficulties for taxpayers and tax professionals, particularly for businesses with complex structures.
In a formal letter addressed to FBR Chairman Rashid Mehmood Langrial, the KCCI detailed the challenges arising from the abrupt introduction of mandatory QR code scanning for IRIS portal logins.
Single Device, Multiple Headaches
KCCI President Jawed Bilwani acknowledged the FBR’s intent to strengthen cybersecurity but questioned the practicality of the QR code requirement. The system, which has been reintroduced through the Tax Asaan App, limits IRIS portal access by authorizing only a single device per account after a One-Time Password (OTP) verification via a registered mobile number.
Bilwani highlighted that this setup creates a “logistical nightmare” for firms employing multiple accountants who work on different devices. “The OTP usually goes to the CEO or a director, making it impossible for accountants or tax lawyers to get real-time access every time they need to log in,” Bilwani stated. He emphasized that this restriction is particularly problematic during tax season, when professionals manage numerous client accounts. Under the new QR code system, authorizing a new account on a device automatically revokes access for any previously authorized account, severely impeding efficient workflow across multiple clients.
Threat to Timely Compliance
The KCCI warned that this single-device limitation imposed by the QR code system will severely impact the timely submission of various critical tax annexures, including H, J, and C. This could lead to widespread delays in tax filings and significant compliance issues across the business community.
Call for Optional Features
In its communication, the KCCI urged the FBR to reconsider the mandatory nature of the QR code login, single-device authorization, and the 60-day password expiration feature. “We support enhanced cyber protection,” the letter stated, “but it must not come at the cost of business continuity. The taxpayer should have the discretion to enable or disable these features based on their individual needs.”
By raising these issues, the KCCI aims to ensure that the FBR’s cybersecurity enhancements genuinely support security without hindering the efficiency and compliance efforts of businesses and tax professionals during Pakistan’s crucial tax return period.
