What is VeriFactu?

What is VeriFactu?

VeriFactu (officially: “invoicing system that guarantees the integrity, preservation, accessibility, readability, traceability and unalterability of invoicing records”) is the Spanish e‑reporting and secure invoicing framework created under the Anti‑Fraud Law and Royal Decree 1007/2023.

In practical terms, VeriFactu means:

• Every invoice you issue must create a secure, unalterable electronic record.

• This record is chained cryptographically to previous records so that any later manipulation becomes visible.

• Your invoicing software must meet strict technical requirements and may be certified by AEAT.

• In Veri*Factu mode, invoice records are transmitted (almost) in real time to the tax agency and a QR code + specific phrase is added to each invoice.

The system applies across Spain except the Basque Foral territories, which have their own specific frameworks.

Why is Spain introducing VeriFactu?

Spain’s Anti‑Fraud Law 11/2021 aims to fight undeclared sales, “double books” and invoice manipulation by forcing all businesses to use secure invoicing systems. VeriFactu is the technical pillar of this strategy:

• It closes the door to software that allows hidden sales or invoice deletion.

• It gives AEAT a clear, near real‑time view of invoiced transactions.

• It simplifies audits and reduces disputes over invoice authenticity.

• It supports digitalisation of SMEs by pushing them to modern invoicing tools.

For businesses, this means compliance is not optional . Uncertified or non‑compliant software can lead to penalties and may be forbitten to do business in Spain.

Who must comply – and when?

VeriFactu affects almost everyone issuing invoices in Spain: companies, freelancers and professionals, in B2B, B2C and B2G scenarios.

Current timeline (after recent extensions):

• Corporate Income Tax payers (SL, SA and other capital companies): mandatory from 1 January 2027.

• Self‑employed individuals / professionals (IRPF): mandatory from 1 July 2027.

  • Before these dates, you are expected to prepare, test and migrate your systems.

There is no “small business” exemption from the principle: eventually, all taxpayers who issue invoices with Spanish VAT must comply, although phasing may differ based on size.

If you are an international company selling into Spain, you must check whether you issue Spanish invoices (with Spanish VAT) and whether your ERP/POS stack is used on Spanish territory – if yes, VeriFactu will apply.

Key technical principles: what your software must do

VeriFactu is not a platform you log into, but a set of technical rules that your billing software must follow. The core requirements include:

Unalterable invoice records

Each invoice must generate a Billing Information Record that:

• Contains all mandatory tax data: issuer and customer IDs, dates, VAT breakdown, amounts, series, etc.

• Includes a cryptographic hash so any later change can be detected.

• Is time‑stamped and stored in a way that guarantees preservation and readability for years.

The law explicitly forbids features that allow deletion or hidden modification of invoices in the system.

4.2 Chaining and electronic signatures

To guarantee traceability, VeriFactu uses two main security mechanisms:

• Chaining of records: each new invoice record includes the hash of the previous one, forming a chain. If a past invoice is changed or removed, the chain breaks.

• Electronic signature / seal: records (and often the invoices) are signed electronically, authenticating origin and integrity.

Your software must handle these cryptographic operations automatically in the background.

4.3 QR code and AEAT verification text

A “VeriFactu invoice” will typically contain:

• A QR code that customers and inspectors can scan to verify authenticity and, in VeriFactu mode, check registration with AEAT.

• The phrase “Invoice verifiable at the AEAT electronic headquarters” or “VERI*FACTU” (in Spanish) printed on the invoice, as defined by the regulation.

This way each invoice is a verifiable document and making inspections much faster.

VeriFactu vs non‑VeriFactu modes

AEAT distinguishes two modes of operation for compliant systems:

VERIFACTU mode (online, with AEAT connection)

In VERIFACTU mode:

• Each invoice record is transmitted automatically and in near real time to AEAT.

• AEAT confirms receipt and may generate data that feeds the QR code.

• The QR code, when scanned, shows a positive verification on AEAT’s electronic headquarters.

• AEAT effectively becomes the custodian of your invoice records.

Benefits: maximum transparency, easier audits, possibly simpler VAT returns because AEAT already has much of your data.

Non‑VERI*FACTU mode (offline, no automatic sending)

In non‑VERIFACTU mode:

• Your software still creates secure, chained, unalterable records.

• No VeriFactu QR code is printed; no real‑time transmission occurs.

• Records are stored locally (or in your system) and must remain ready for later inspection or submission.

Both modes comply with Royal Decree 1007/2023, but only VERIFACTU mode gives the “live” verification experience and shifts custody of records to AEAT.

The complete documentation about the technical details als API can be found here: https://verifactu-aeat.github.io/

Relationship to SII and existing Spanish systems

Many large companies in Spain already know SII (Suministro Inmediato de Información) – the Immediate Supply of Information for VAT – which requires near real‑time reporting of VAT ledger entries. VeriFactu is different:

• SII focuses on VAT ledgers and applies mainly to companies above certain revenue thresholds.

• VeriFactu focuses on the invoicing software itself and the integrity of each invoice record.

• VeriFactu extends secure e‑reporting obligations to all businesses and freelancers, not just large taxpayers.

For many businesses, both systems will coexist: VeriFactu secures and reports invoices; SII uses that data for VAT reporting.

Legal consequences and penalties

Spain backs VeriFactu with meaningful fines to ensure adoption:

• Using uncertified or non‑compliant invoicing software can result in penalties up to 50,000 EUR per fiscal year in some scenarios.

• Intentionally manipulating records or using systems designed to hide sales can lead to higher sanctions and criminal exposure under the Anti‑Fraud Law.

• AEAT has clear powers to audit not just your figures, but also the technical characteristics of your billing solution.

From a risk‑management perspective, migrating early and documenting your approach is far cheaper than waiting until the last moment and facing emergency projects, errors and possible fines.

What it means for your business processes

VeriFactu is not just an IT topic: it touches finance, sales, operations and customer experience.

Impact on invoicing and POS

• You must ensure all invoicing channels (ERP, POS, e‑commerce, manual billing tools) produce VeriFactu‑compliant invoices.

• This usually requires either upgrading your software, adding a certified connector or moving to a solution already certified for the Spanish market.

• If you operate multiple locations, franchises or stores, you must coordinate deployment across all POS terminals and branches.

Impact on accounting and reporting

• With VeriFactu, invoice data is highly structured and traceable, which can streamline internal reporting and monthly closings.

• Pre‑filled tax returns and simplified reconciliations become more realistic because AEAT already holds detailed invoice records.

• Internal fraud or “informal” sales become harder to hide, which is positive for governance but may require cultural change.

Impact on customers and partners

• For customers, the QR code and AEAT verification message act as a quality seal: they know the invoice is real and registered.

• For your auditors, banks and investors, VeriFactu can be a sign of robust compliance and process maturity.

If you have any questions, feel free to ask us. We are able to set up a billing system for you that is compliant with the Live VERIFACTU System and manages your invoices as easy as possible completely automatic.