What is VeriFactu? Spain's verifiable invoicing system

VeriFactu is the verifiable electronic invoicing system that the Spanish Tax Agency (AEAT, Agencia Tributaria) requires from businesses and professionals in Spain. Here is what you need to know to be ready. For the full reference with requirements, deadlines and penalties, see our always up-to-date VeriFactu guide.

Where does VeriFactu come from?

The legal basis is Law 11/2021 on measures to prevent and combat tax fraud (known as the Anti-Fraud Law). Its article 29.2.j requires every producer of invoicing software to make sure the systems it sells guarantee the integrity, preservation, accessibility, legibility, traceability and inalterability of invoicing records.

Royal Decree 1007/2023 sets out the technical requirements that invoicing systems must meet, and Order HAC/1177/2024 specifies the XML formats, the mandatory fields and the endpoints for communicating with the AEAT.

What exactly does VeriFactu do?

Every invoice you issue must include an invoicing record that contains:

• 📋 The invoice data in XML format, following the AEAT’s technical specification
• 🔐 An electronic signature with your digital certificate, which guarantees that nobody has altered the invoice
• 🔗 A SHA-256 hash chained to the previous invoice, forming an unbreakable chain
• 📤 (Optional but recommended) Real-time submission to the AEAT to obtain the VeriFactu code and the official logo

Who does it apply to?

To all taxpayers under the direct estimation regime who are not already in the SII (Suministro Inmediato de Información, the immediate VAT information system), that is, companies with turnover above €6 million a year.

In practice this includes the vast majority of Spanish self-employed people and SMEs: more than 3 million self-employed people and almost 2.7 million micro-businesses.

Is it mandatory to send invoices to the AEAT?

Technically, no. You can be a “VeriFactu system” without sending records to the AEAT. But if you don’t send them, you cannot include the official VeriFactu logo or the verification QR code on your invoice, which may make your customers distrust it.

Our recommendation is always to send. Submission is practically instant, protects you in an inspection and gives you the VeriFactu code (CSV, código seguro de verificación) that certifies the AEAT has received and validated the invoice.

When do you have to comply?

• 🏢 Companies and legal entities: 1 January 2027
• 👤 Self-employed people and natural persons: 1 July 2027
• ⚡ Large companies (turnover above €6M): already in the SII, exempt

Royal Decree 254/2025 and then Royal Decree-Law 15/2025 extended the original deadlines — which is why the obligation now falls in 2027. Even so, we recommend not waiting until the last moment: getting and setting up the digital certificate can take weeks.

Keep reading

• Full VeriFactu guide — requirements, modes and how to comply.
• Is VeriFactu mandatory in your case? — who is obliged and the exceptions.
• Official dates and deadlines — current calendar after Royal Decree-Law 15/2025.
• You are self-employed → Cofactu for freelancers. You have a company → Cofactu for SMEs.

Official sources

• BOE · Royal Decree 1007/2023 — Regulation that sets out the VeriFactu requirements.
• BOE · Order HAC/1177/2024 — Technical specification (XML, signature, hash chain).
• BOE · Law 11/2021 — Anti-Fraud Law (article 29.2.j).
• AEAT · VeriFactu computer systems — Official AEAT documentation.