Verifactu is the new set of rules for secure invoicing. It affects anyone using invoicing software who isn't in SII. The goal is simple: stop invoice tampering and make every record traceable and unalterable. This guide covers dates, who has to comply, what changes on your invoices and how Verifactu differs from the B2B e-invoice under the Crea y Crece law. For the full picture, also check our complete electronic invoice guide.
Below you'll find a quick Q&A, a plain-English checklist and the mistakes that catch out the most SMBs and autónomos.
What is Verifactu? The AEAT's secure channel for invoicing records. It guarantees every record is chained, signed and traceable.
Who does it affect? Anyone issuing invoices with software who isn't in SII. People who only invoice manually are out of scope.
What changes on the invoice? A mandatory QR on full and simplified invoices. In many cases, the legend "VERI*FACTU" or "Factura verificable en la sede electrónica de la AEAT" too.
When is it mandatory? Companies on corporate tax (IS) are obliged from 1 January 2026. Autónomos and the rest, from 1 July 2026.
Is it the same as e-invoicing? No. Verifactu is about secure records and optional submission to the AEAT. The electronic invoice is about B2B exchange in structured formats.
What are the penalties? Up to 50,000 € per year for using non-compliant software. Up to 150,000 € per year per product type for vendors that develop or sell non-compliant software.
AEAT: the Spanish tax agency.
SIF: Sistemas Informáticos de Facturación. Invoicing software that meets the rules for integrity, traceability, unalterability, accessibility and legibility.
Verifactu mode: your SIF sends invoice records to the AEAT as you issue them.
Non-Verifactu mode: your SIF keeps the same secure records locally. You still print the QR and the legend.
QR on invoices: the square code that opens an AEAT page to verify the record.
SII: for large companies. They send every invoice to Hacienda online in real time. If your business uses SII, you don't use Verifactu.
IS: corporate tax (Impuesto sobre Sociedades).
POS: the system you use to take payment at the counter.
ERP: your accounting or management system where you issue invoices.
Hash chain: a sequence where each record's digital fingerprint includes the previous one, so any change breaks the chain.
Digital signature: a cryptographic seal that proves who issued a record.
Trusted timestamp: reliable proof of the exact creation time of a record.
Event log: the automatic diary of every creation, edit, void or export.
Facturae: the Spanish standard e-invoice format for public administrations and businesses. Mandatory when selling to the public sector.
UBL: international e-invoice format used in Europe (PEPPOL). Ideal for cross-border B2B.
Crea y Crece: Law 18/2022 that will require B2B electronic invoicing.
Parallel series: multiple numbering series for the same activity. Used to hide sales. Not allowed.
Declaración responsable: a signed declaration from the software vendor confirming the product complies with the SIF rules.
Basque Country and Navarra regimes: regional tax systems with their own rules, currently outside the national scope of Verifactu.
Verifactu is the AEAT's secure channel for invoicing records. It was created under the anti-fraud law to put an end to "dual-use" software and hidden edits.
Verifactu has two valid modes:
Both modes require a QR on the invoice and integrity controls in the software.
At a glance, the invoice changes in two ways: every full and simplified invoice carries a QR, and where the rules apply, also the legend "VERI*FACTU" or "Factura verificable en la sede electrónica de la AEAT". These visible marks are the tip of a larger security system under the hood.
Verifactu locks down invoicing data from the moment it's issued. The system enforces integrity, traceability, unalterability, accessibility and legibility.
Who it targets. Companies and professionals who use invoicing software and aren't in SII. If you create invoices with a system that fits the SIF definition, you're in scope.
Who's out. Those who only invoice manually. SII taxpayers. Taxpayers under the Basque Country and Navarra regional regimes.
What a compliant SIF produces. Each invoice creates a record with a hash that links to the previous record, so any change becomes visible. The record carries a timestamp, a digital signature and is dropped into an event log that captures every action: creation, void, export or edit attempt.
The AEAT provides the rulebook and the connection point. In Verifactu mode, your system sends invoice records to the AEAT following its rules. The QR on the invoice points to an AEAT page where anyone can verify the record.
Non-Verifactu mode keeps the data locally. You still need the same integrity controls and the QR, plus the legend when applicable. The AEAT can request a secure export during a check or inspection.
The AEAT offers a simple web form for micro-businesses and autónomos that issue few invoices. It produces compatible records without needing full software and isn't designed for most SMBs.
More on Verifactu AEAT.
You can comply at zero cost using a compatible tool with a free plan. Recipients get free verification when they scan the AEAT QR.
See the complete free Verifactu guide.
Invoicing software. Since 29 July 2025, software vendors have had to ship adapted SIFs. The deadline has passed: if your vendor isn't compliant, switch now.
Companies paying corporate tax (IS). Mandatory from 1 January 2026. If you pay IS and haven't adapted your software yet, you're out of time.
Autónomos and other obliged taxpayers. Deadline: 1 July 2026. A few months left.
SII taxpayers. Excluded because they already report invoices in near real time.
Verifactu bans "dual use." Your software can't allow hidden deletions, untraceable later edits, parallel series that bypass the record book or divergent exports.
Mandatory SIF features:
Vendor obligations. Manufacturers must include a signed declaración responsable and provide it to their customers. They must keep version control and secure updates and keys. No setting can disable the integrity controls.
Read our full anti-fraud law guide.
They solve different problems. Verifactu, led by the AEAT, is a compliance framework for invoice records and optional submission. It applies to any invoice, B2B and B2C, when you use software.
The electronic invoice under Crea y Crece is about B2B exchange. It requires companies to swap invoices in structured formats (Facturae or UBL) and to track delivery and status through interoperable networks. It doesn't send invoice content to the AEAT.
Coexistence. If you do B2B, you'll likely need both. First issue a compliant Verifactu record with a SIF. Then send and receive the e-invoice in your chosen structured format.
International angle. The e-invoice connects with cross-border standards and networks. Verifactu is Spain-only.
Read more about the difference here.
In scope: anyone using invoicing software who isn't in SII. If you issue with a SIF, you're under Verifactu rules, including for simplified invoices and POS tickets.
Out of scope. Those who only invoice manually. SII taxpayers. Taxpayers in the Basque Country or Navarra under their regional regimes.
POS and cash registers. If your POS issues invoices or tickets, it has to be SIF-compliant. E-commerce, ERP and mobile issuance fall under the same rules.
The penalties are real. Using non-compliant software: up to 50,000 € per year for the user. Developing or selling non-compliant software: up to 150,000 € per year per product type for the vendor. Missing the QR or the mandatory legend also triggers fines.
The AEAT can cross-check Verifactu records against your VAT returns and request record sets when something doesn't add up. Keep your keys, time source and export flows in order.
Treat Verifactu as a process, not a sticker. It's much more than printing a QR.
Common mistakes to avoid:
Imagine you run a café with a POS and some B2B catering services.
Before Verifactu. You print tickets and issue catering invoices in a separate system. Staff can void a ticket and re-enter it, and the trail is messy.
After Verifactu. Your POS becomes a SIF. Every ticket or invoice produces a chained, signed record. A void creates a cancellation record linked to the original. Your invoices show a QR and the mandatory legend. If you opt for Verifactu mode, records also reach the AEAT in real time.
Team training. Show them where the QR lives on the ticket. Explain that "deleting" now means "void and link." Run a mock audit by exporting a week of records.
Verifactu isn't just a QR. It's a shift to unalterable invoicing across all your channels. The dates are here: IS obliged from January, autónomos by July 2026. Pick a compliant tool, map your ERP, POS and e-commerce flows so every invoice leaves a secure, auditable trail. If you sell B2B, run your e-invoice plan in parallel. Verifactu will keep showing up in audits and vendor checks, so solving it now saves you time and fines.
Worried about what non-compliance actually costs? Read our breakdown of Verifactu penalties: what happens if you don't comply.
Want the QR code part explained simply? See what the Verifactu QR code is and how it works.
