Verifactu

What is Verifactu?

Verifactu (short for Sistema de Verificación de Facturas) is Spain's certified electronic invoicing system, established by the AEAT (Agencia Estatal de Administración Tributaria). It mandates that all billing software used by Spanish businesses must produce verifiable, tamper-proof invoice records.

The primary goal is to eliminate so-called "dual-use" software — accounting systems that can be manipulated to hide sales or income from tax authorities. Verifactu ensures every invoice record is cryptographically chained and auditable.

How Verifactu Works

Verifactu is fundamentally about record integrity, not invoice format. Every billing system must implement:

1. Hash chaining — Each invoice record is linked to the previous one via a cryptographic hash (SHA-256). This creates a tamper-evident chain: altering any record breaks the chain and is immediately detectable.

2. Digital signatures and timestamps — Records must be signed to prove authorship and timestamped to prove when they were created.

3. Complete event log — Every create, edit, void, or export action on an invoice must be logged in an unalterable audit trail.

4. QR code — Each invoice must include a QR code that links to the AEAT verification portal, allowing anyone (including the buyer) to verify the invoice's authenticity.

Two Compliance Modes

Businesses can choose between two modes:

Verifactu mode — Invoice records are submitted to the AEAT in near real-time (within 8 days). This is the more transparent option and may offer compliance advantages.

Non-Verifactu mode — Records are kept locally with the same integrity requirements (hash chaining, signatures, logs) but are not automatically sent to the AEAT. They must be available upon request during an audit.

Both modes require certified billing software. The only difference is whether data flows to the AEAT proactively or on demand.

Relationship to SII

Spain already has the SII (Suministro Inmediato de Información) system, which requires large companies (revenue > €6M) to report invoices to the AEAT within 4 days. Companies already on SII are generally exempt from Verifactu, since they already provide real-time invoice data.

For everyone else — SMEs, freelancers, and smaller businesses — Verifactu is the new baseline requirement.

Timeline

The Verifactu mandate has been postponed from its original 2026 dates. Following Real Decreto-ley 15/2025:

1 January 2027 — Corporate Income Tax (CIT) taxpayers must comply.

1 July 2027 — Self-employed individuals and other non-CIT taxpayers must comply.

Software developers and vendors must have certified compliant systems ready before these dates.

Penalties

The penalties are substantial and apply to both businesses and software vendors:

Businesses using non-compliant invoicing software: up to €50,000 per year.

Software vendors distributing non-compliant systems: up to €150,000 per year.

This creates strong incentives for ERP vendors to achieve compliance early.

What ERP Developers Need to Know

Verifactu is a CTC (Continuous Transaction Controls) system, but it differs from Italy's SDI or France's PPF in that it focuses on software certification rather than centralised invoice routing. Your billing software must:

Implement hash chaining across all invoice records

Generate compliant QR codes per AEAT specifications

Support the XML format defined in the Reglamento de Facturación

Maintain an immutable event log

Optionally support real-time submission to AEAT's Verifactu endpoint

The AEAT provides technical specifications and a test environment for software certification.

Quick Facts

Definition