Fingerprint and signature01
Each record links the fingerprint (hash) of the previous invoice in its series and is signed with your digital certificate.
What is VeriFactu.
Requirements and deadlines.
VeriFactu is Spain's rule that protects the record of every invoice. This map gathers the decisions: whether it applies to you, when, what your software must keep and which route to follow.
See the journey ↓
- RD 1007/2023
- Hash, signature and QR code
- Data in the EU
You do not need to memorise the rule.
You need to place yourself in it.
Start from your situation. The map leads from the obligation to the evidence that stays with every invoice. If you are a foreign group with a Spanish subsidiary, start with the guide for foreign companies.
Verifiable record
- Generate the record Invoice and series data
- Sign and chain SHA-256 hash + certificate
- Include the QR code Verification on the document
- Keep the evidence Or submit it to the AEAT
Verifiable QR code02
An invoice issued with software must include the QR code with the verification URL on the AEAT's electronic office.
Events logged03
Start-up, shutdown, errors and relevant changes are stored with a timestamp.
Correction without rewriting04
The record is kept. To correct it, you cancel it and generate another record.
A legal fork Same technical base.
Same technical base.
Two destinations for the record.
The difference is not complying or not complying. It is where the proof is available and what can be checked on the AEAT's electronic office.
Cofactu Invoice → AEAT → CSV VeriFactu · with submission
Each record is sent to the AEAT as the invoice is issued. It returns a confirmation CSV (secure verification code) and allows the “verifiable invoice” logo. Cofactu's mode. First invoice accepted in the AEAT sandbox: May 2026.
Valid alternative Invoice → Retention Not VeriFactu · no submission
It meets hash, signature, events and tamper-proofing without sending records. It is valid, but you must be able to prove the integrity of what you kept. No “verifiable invoice” logo and no verification QR code on the AEAT site.
Verifiable result When you choose submission,
When you choose submission,
the proof comes back too.
Cofactu uses the mode with submission. Its first invoice was accepted by the AEAT's official test environment in May 2026.
See electronic invoicing →| Invoice | F-2026-00002 |
|---|---|
| Environment | AEAT sandbox |
| Confirmation CSV | A-MMURGK5EJUWRZU |
| First acceptance | May 2026 |
Invoice validated → Record submitted → CSV kept
A test validation; not a customer invoice.
Rule, date and risk.
On the same plane.
| Basic law | Law 11/2021, art. 29.2.j LGTAnti-Fraud Law · BOE 10 Jul 2021 |
|---|---|
| Technical regulation | RD 1007/2023VeriFactu requirements · BOE 5 Dec 2023 |
| Technical specification | Order HAC/1177/2024XML formats and fields · BOE 28 Oct 2024 |
| 1st extension | RD 254/2025Producers: July 2025 · BOE 2 Apr 2025 |
| Current deadlines | RDL 15/2025Obliged taxpayers: 2027 · BOE 3 Dec 2025 |
| 29 Jul 2025 | Software producersSoftware on the market must be compliant. · RD 254/2025 |
|---|---|
| 1 Jan 2027 | Corporate Income Tax payersCompanies: SL, SA and others. · RDL 15/2025 |
| 1 Jul 2027 | Self-employed and other Personal Income Tax payersAll other obliged taxpayers. · RDL 15/2025 |
The AEAT app invoices.
Cofactu carries the work on.
Both can generate compliant records. The difference lies before and after you issue.
| Capability | AEAT app | Cofactu |
|---|---|---|
| Generates VeriFactu-compliant invoices | Yes | Yes |
| SHA-256 hash, electronic signature and QR code | Yes | Yes |
| Real-time submission to the AEAT | Yes | Yes |
| Accounting and general journal | No | Yes |
| Tax returns (Modelo 303, 130, 111…) | No | Yes |
| POS, team and API | No | Yes |
| Price | Free | From €0, unlimited · Pyme €39/month |
Routes of the guide Follow the question
Follow the question
you need to answer.
Eleven pages to go deeper without turning this atlas into an endless manual.
The essentials, without turning the rule into a maze.
Direct answers on the definition, deadlines, modes, penalties and the statement of conformity.
Talk to us → See the official dates and deadlines ↗What is VeriFactu exactly?
VeriFactu is Spain's verifiable-invoicing mode, regulated by Royal Decree 1007/2023, in which invoicing software sends its records to the AEAT (Spanish Tax Agency). It requires records with a chained SHA-256 fingerprint and a verification QR code. In this mode the authenticated submission replaces the individual XAdES signature, and the software's own event log required by the mode without submission is not required.
When is VeriFactu mandatory in Spain?
For software producers and resellers since 29 July 2025. For Corporate Income Tax payers from 1 January 2027, and for the self-employed and other taxpayers from 1 July 2027. The current dates are set by Royal Decree-law 15/2025.
Do foreign companies need VeriFactu in Spain?
A Spanish subsidiary and the branch or permanent establishment of a foreign company are covered if they invoice with software, unless they are on the SII or taxed in the Basque Country or Navarre. A foreign company with no establishment is not mentioned in the regulation. The guide for foreign companies explains each case.
Is the AEAT's free app VeriFactu compliant?
Yes, it generates compliant records. Its scope is basic invoicing: it does not include accounting, POS, multi-user access, an API or the filing of tax returns.
What is the difference between VeriFactu and TicketBAI?
They are different systems. VeriFactu applies in mainland Spain (common territory) and TicketBAI in Araba, Bizkaia and Gipuzkoa. Navarre has its own system.
What is the penalty for not complying?
Article 201 bis of the General Tax Law sets €50,000 per financial year for users of non-compliant software and €150,000 per financial year and type of system for producers or resellers.
What is the VeriFactu statement of conformity?
It is the producer's document certifying that the system meets Royal Decree 1007/2023 and Order HAC/1177/2024. You should be able to demand it from your provider.
The next record Start with one invoice.
Start with one invoice.
The evidence is built from there.
Cofactu already includes chained hash, signature, QR code and submission to the AEAT. Start free and work with the flow you will need before your obligation date.
No card · See the plans when you need them
