Spain Verifactu certified billing software requirements (2)
    E-Invoicing Compliance

    Spain Verifactu: Software Requirements & Anti-Fraud Compliance

    Updated:
    9 min read

    Tax & Compliance Series

    This guide is part of a comprehensive series. Explore all 202 topics:

    Spain's Verifactu (Sistema de Verificación de Facturas) mandates that all invoicing software used by Spanish businesses must meet strict anti-fraud certification requirements from July 1, 2026 (businesses >€8M) or July 1, 2027 (all businesses). Non-compliant software carries fines up to €50,000 per fiscal year. The system requires tamper-proof invoice records, cryptographic hash chains, and QR codes for tax authority verification.

    What Technical Requirements Must Verifactu Software Meet?

    1. Immutable Invoice Records

    • Every invoice record must be tamper-proof once created
    • Records cannot be modified or deleted — only corrective invoices (credit notes) can adjust previous invoices
    • The software must log every action with timestamps

    2. Cryptographic Hash Chain

    • Each invoice generates a SHA-256 hash incorporating key invoice data
    • The hash of each invoice includes the hash of the previous invoice, creating an unbreakable chain
    • Any attempt to modify or delete a record breaks the chain, making tampering detectable
    • The first invoice of each series uses a known initial value

    3. QR Code on Every Invoice

    • Every printed or PDF invoice must include a QR code
    • The QR code links to AEAT's verification portal
    • Recipients can scan the QR to verify the invoice was properly registered

    4. Reporting Options

    Businesses choose one of two modes:

    • Verifactu mode: Invoice data is transmitted to AEAT in real-time or near-real-time. Offers the "Verifactu" label on invoices as a trust signal.
    • Non-Verifactu mode: Records are maintained locally with the hash chain intact. Subject to AEAT audit requests.

    How Does Software Certification Work?

    Unlike some countries (e. g.

    Unlike some countries (e.g., SAF-T certification in Portugal), Spain uses a "responsible declaration" model:

    1. Self-certification: Software producers declare their product meets all technical requirements
    2. Declaration filing: Submitted to AEAT through their electronic portal
    3. No pre-approval testing: AEAT does not test or certify software in advance
    4. Post-market enforcement: AEAT can audit and sanction non-compliant software at any time

    What Data Must Be Included in Each Record?

    Invoicemonk meets all Verifactu technical requirements with built-in hash chain generation, QR code creation, optional real-time AEAT transmission, and immutable invoice records — ready for the July 2026 deadline.

    FieldDescription
    NIF (tax ID) of issuerIssuer's tax identification number
    Invoice number and seriesUnique identifier within the series
    Invoice dateDate of issuance
    Invoice typeF1 (standard), R1 (credit note), etc.
    Tax base and VAT amountsPer applicable rate (21%, 10%, 4%)
    Total amountIncluding all taxes
    Hash of current recordSHA-256 incorporating all fields + previous hash
    TimestampRecord creation date and time

    Invoicemonk meets all Verifactu technical requirements with built-in hash chain generation, QR code creation, optional real-time AEAT transmission, and immutable invoice records — ready for the July 2026 deadline.

    Tags:
    spain
    verifactu
    software-certification
    anti-fraud
    hash-chain
    OO
    Olayinka Olayokun

    Digital Marketing, SEO Specialist, Content Creator & Product Professional

    CIM Certified
    MBA in Digital Marketing and Business Transformation

    Olayinka is a digital marketer, content creator, growth and SEO specialist with 10+ years helping businesses in Nigeria, the UK, the US, Australia, and Dubai achieve their goals online.

    More from Tax & Compliance