Briefing document & Podcast: Spain’s VeriFactu Verified Billing System

Legal Framework and Objectives

Who Must Comply (and Who Is Exempt)

• Large companies under SII – Businesses already using Spain’s SII (Suministro Inmediato de Información) system for real-time VAT reporting are largely exempt from VeriFactu. The rationale is that these companies (typically large taxpayers or those in monthly VAT refund regimes) are already reporting invoice data in near-real-time to AEAT, so they won’t be required to duplicate efforts under VeriFactu. (Important nuance: If an SII-subject company issues invoices on behalf of a third party by agreement, it must still comply with VeriFactu requirements for those invoices; conversely, truly self-billed invoices to an SII company are excluded).* [conesalegal.com], [lextax.es] [marosavat.com], [marosavat.com]
• Businesses not obligated to invoice – If a taxpayer’s operations do not legally require issuing invoices, or if they fall under special regimes that waive standard invoicing rules, VeriFactu does not impose new obligations on them. [conesalegal.com]
• Those invoicing entirely without software – Not explicitly carved out in the law, but in practice entities that still issue invoices manually (on paper or with basic tools) are not forced to adopt an e-invoicing system. VeriFactu is mandatory once you use billing software; it does not (yet) force a business to abandon manual invoicing. In other words, a small shop issuing handwritten invoices can continue to do so without violating the VeriFactu rules – but if it opts to use software, that software must comply. (Of course, Spain’s policy direction is toward digital invoicing across the board, so purely manual invoicing is likely to become rarer over time.) [euroweeklynews.com]
• Non-established foreign businesses – Companies with a Spanish VAT number but no permanent establishment in Spain (e.g. foreign businesses registered only for VAT) are not required to comply with VeriFactu. The obligation targets resident taxpayers and those with Spanish establishments. [marosavat.com]

Implementation Timeline and Recent Updates

• Initial Law and Draft Timeline (2021–2023): The anti-fraud Law 11/2021 set the mandate to develop secure invoicing systems, but required further regulation to define technical details. By late 2023, Royal Decree 1007/2023 was approved, and initially July 2025 was set as the start date for mandatory use (with phased introduction). [hacienda.gob.es], [ceconsulting.es]
• First Deadline Extension (April 2025): In response to industry feedback, the government extended the deadlines via Royal Decree 254/2025. A Council of Ministers press release on 1 April 2025 announced that the new requirements would not take effect in July 2025 as first planned. Instead, the mandatory compliance dates were pushed to 1 January 2026 for corporate taxpayers (entities subject to Corporate Tax) and 1 July 2026 for all other affected taxpayers (e.g. self-employed and partnerships). This six-month staggered schedule recognized that smaller businesses might need extra time to prepare. The same decree also gave software developers until 29 July 2025 to update their products in line with official technical specifications (published in October 2024). In fact, as of July 30, 2025, it became illegal to market non-compliant invoicing software in Spain – software vendors had a 9-month adaptation window after the specs were released, and after that date only VeriFactu-compliant systems can be sold or distributed. This measure pushed software companies to rapidly issue updates or new versions so that businesses could acquire compliant solutions well before the 2026 deadline. [hacienda.gob.es] [hacienda.gob.es], [hacienda.gob.es] [conesalegal.com], [conesalegal.com] [conesalegal.com], [lextax.es]
• Latest Postponement to 2027 (announced Nov/Dec 2025): As the 2026 deadline neared, business groups and autonomous worker associations raised concerns that many firms were still unprepared. In late 2025, the Spanish Government decided to delay VeriFactu’s mandatory enforcement by another year. This change was approved by the Cabinet via a Decreto-ley (decree-law) and publicly announced in early December 2025. The new mandatory dates are: January 1, 2027 for companies subject to Corporate Tax, and July 1, 2027 for SMEs, self-employed professionals and others. These revised deadlines (pushed from 2026 to 2027) give businesses extra “breathing room” to implement compliant systems. The government acknowledged that adoption had been slower than hoped – very few businesses had voluntarily switched to VeriFactu in 2025 – and that enforcing it by 2026 could have caused widespread non-compliance due to lack of readiness. In short, VeriFactu is coming, but now with a bit more leeway: large companies have until the start of 2027, and smaller issuers until mid-2027, to get on board. [euroweeklynews.com], [euroweeklynews.com] [euroweeklynews.com]

Key Compliance Requirements of VeriFactu

• Integrity & Inalterability: Once an invoice is issued, it cannot be edited or deleted within the system without creating an auditable trace. If an error occurs, a corrective credit note or cancellation record must be issued rather than simply modifying the original invoice. To enforce this, each invoice record is cryptographically chained to the previous one (using hash functions) to establish a secure sequence. Any attempt to alter an earlier record would break the chain, alerting to potential tampering. Similarly, unique identifiers and timestamps are assigned so that no two invoices can share the same number or hash link. [lextax.es], [lextax.es] [lextax.es], [conesalegal.com] [conesalegal.com]
• Traceable Records (Invoice Logs): The software must generate a standardized Invoice Record (Registro de Facturación) for each invoice and any cancellation. This record contains all essential invoice data (buyer/seller tax IDs, date, amount, VAT details, etc.) plus the security elements (hash of prior invoice, software ID, user, time of issue). The record acts as a digital “fingerprint” of the invoice. All such records must be stored securely by the company, in a format that can be exported and read by inspectors or uploaded to the tax office if needed. If using non-VeriFactu mode (see below), additional safeguards apply: each record must be electronically signed by the system and an internal event log must audit any action (like an attempted deletion, system time change, etc.). In short, no invoice can disappear or be changed “off the books” – the system will always either report it or document the attempt, closing loopholes used for parallel accounts. [conesalegal.com], [conesalegal.com] [conesalegal.com] [sede.agenc…ria.gob.es], [conesalegal.com]
• Real-Time Reporting (VeriFactu Mode): One compliance option – strongly encouraged by AEAT – is to configure the software in VeriFactu mode, meaning it automatically transmits each invoice record to Agencia Tributaria at the moment of issuance. The software connects to AEAT’s servers over the internet and submits the invoice record (all its data and metadata) within seconds of creating the invoice. The Tax Agency’s system immediately validates the submission. If everything is correct, AEAT issues a unique CSV (Secure Verification Code) as an acknowledgment for that invoice. (If there’s an error – e.g., an invalid tax ID number – AEAT returns a rejection, and the software is required to retry sending periodically until the record is accepted.) All of this happens in the background, so from the user’s perspective it’s almost invisible: you generate an invoice and move on, with the system taking care of the transmission automatically. AEAT’s goal is for businesses to “hardly notice any difference” in their routine aside from the new outputs on the invoice. Choosing VeriFactu mode simplifies compliance because if you successfully transmit all records, you are relieved from implementing some of the heavier security features locally (like you don’t need to keep an exhaustive event log or individually sign each record). Moreover, AEAT takes on the responsibility for long-term data storage – your invoices are safely stored in the cloud on AEAT’s database, reducing your burden of safeguarding records for the full retention period. In other words, real-time submission is the “easy mode” to comply with the law, trading off a constant internet connection and up-front integration work for a lighter load in auditing and IT controls. (AEAT even plans a free last-resort web invoicing application that businesses without any software can use, which would inherently operate in VeriFactu mode.) [sede.agenc…ria.gob.es], [conesalegal.com] [conesalegal.com] [sede.agenc…ria.gob.es]
• Verifiable Invoice Output (QR Codes and AEAT Stamp): Whether or not you send records to AEAT in real time, every invoice issued after VeriFactu’s start date must include a special QR code and a “verifiable invoice” legend. In practice, compliant software will print on each invoice a QR code containing a URL and summary info that links to the AEAT’s system. If the invoice was sent via VeriFactu mode, the invoice will also be marked with a phrase like “Verifiable invoice on the AEAT Electronic Office” (often realized as a line stating “Factura verificable en la Sede Electrónica de la AEAT”) or a “VERI*FACTU” stamp. This tells the recipient that the invoice data is already on file with the tax authorities. The customer (or an inspector) can scan the QR code using the Agencia Tributaria’s app or web portal and instantly check that the invoice is registered with AEAT. If the issuer used VeriFactu mode, the query will show the invoice details as recorded by the tax office, confirming its authenticity. If the issuer did not transmit the invoice (i.e. using non-VeriFactu mode), the QR code still provides a mechanism for the recipient to report/verify the invoice themselves. Upon scanning, a customer can send the invoice data to AEAT (using the info encoded in the QR) to ensure it gets logged. In either case, the presence of the QR and verification system means no invoice can remain “hidden” off the tax radar: an honest client or the tax authority can cross-check any invoice. This feature not only deters sellers from concealing sales, but also gives buyers confidence that the invoices they receive are valid for claiming VAT deductions (since they can prove to AEAT that the invoice exists). Essentially, every invoice will carry a “digital tax stamp” linking it to the AEAT’s records. [conesalegal.com]
• Secure Archiving and Export: Businesses must retain the electronic records of invoices (and any associated cancellation records) for the full statutory period (typically 4-6 years) in a readable, standard format. The software should be able to export all records (with their security hashes, etc.) in a format specified by AEAT, upon request or for auditing. In VeriFactu mode, because records are already at AEAT, this is mainly a backup measure. In non-connected mode, this becomes critical: if the tax inspector comes knocking, the company must provide the complete tamper-evident invoice log. Notably, compliant systems must also generate a “responsible declaration” (as mentioned earlier) – essentially a certificate by the vendor confirming the system meets RRSIF standards – which the business should keep on file in case of inspection. [sede.agenc…ria.gob.es] [sede.agenc…ria.gob.es], [conesalegal.com] [marosavat.com]

Impact on Businesses: Changes, Challenges, and Benefits

• Reduced Fraud Risk and Stronger Controls: By using software that locks down invoice data, companies protect themselves from internal fraud or accidental record alterations. Each invoice is locked in with a digital fingerprint, providing a reliable audit trail. This can improve the accuracy of financial records and reduce the chance of “missing” invoices. It also means a rogue employee would find it hard to delete a sale or alter an amount without detection. In sectors where cash sales are common, adopting VeriFactu demonstrates a commitment to transparency, which could improve the business’s credibility (e.g., during tax inspections or even when seeking financing, showing robust controls is a plus). [lextax.es], [conesalegal.com]
• Fewer Tax Inspections and Penalties: A business diligently complying with VeriFactu – especially in real time – inherently provides the tax authority with oversight of its operations. This transparency may lead to fewer audits, as there is less suspicion of undeclared revenues. Moreover, by following the new rules, the company avoids the steep fines associated with non-compliance. In fact, Agencia Tributaria officials have indicated that one aim is to make compliance so automated that “penalties become unnecessary” – in other words, the system itself prevents the common infractions (like using unapproved software or backdating invoices) that would trigger fines. [conesalegal.com]
• Efficiency in Tax Filing: As mentioned, having all sales data structured and potentially pre-reported can make compiling VAT returns and other tax statements faster and less error-prone. Many software solutions will likely integrate these features, so that generating a VAT return or informative report is semi-automated, pulling from the verified records. This frees up time for finance departments or accountants to focus on analysis rather than data entry. Also, real-time validation by AEAT means mistakes (like an invalid client NIF or a date issue) are caught immediately when the invoice is issued, rather than months later during an audit or filing process. Fixing issues in “real time” is easier than untangling them long after the fact. [conesalegal.com]
• Modernization and Business Insights: Implementing a new invoicing system can be an opportunity to upgrade broader accounting or ERP systems, leading to better overall management. Companies may find that digital invoicing improves their cash flow monitoring and accounts receivable tracking. With all invoices digitized, it becomes easier to analyze sales patterns, ensure all billable work is invoiced, and integrate with other systems (like inventory or CRM). For many small businesses, VeriFactu might be the push needed to ditch paper and fully embrace digital accounting, which in turn can drive efficiency beyond tax compliance.
• Customer Trust and Payment Speed: Especially in B2B contexts, the ability for a customer to verify an invoice’s authenticity can build trust. A client who can scan the QR and see the invoice in the tax portal knows that the invoice is legitimate and recorded – this may make them more comfortable that the transaction is transparent. While this is primarily a tax measure, it could have side benefits like encouraging faster payments (since the invoice is clearly “official”). Also, as Spain rolls out mandatory B2B e-invoicing under the Crea y Crece law, having digital-savvy customers and suppliers all on modern systems will smooth those commercial interactions as well.

• Cost and IT Resources: Upgrading to VeriFactu-compliant software can involve costs – purchasing new systems or paying for updates, and possibly subscribing to services (many compliant solutions might be cloud-based or subscription-based). While larger companies likely already use sophisticated billing systems (many of which will incorporate VeriFactu features in updates), microenterprises and freelancers might feel the pinch. There could be resistance from the smallest businesses that currently might do fine with basic invoices; they now have to invest time and money into a more complex system or hire advisors to handle invoicing for them. The government has recognized this by phasing the dates and even providing a free AEAT web tool, but the practical burden is not zero. [euroweeklynews.com], [euroweeklynews.com]
• Training and Process Changes: Staff need to learn the new compliance steps (e.g. always use the system for every sale, how to issue corrections properly, how to handle downtime). Mistakes during the learning period – like forgetting to send an invoice or trying to circumvent the system – could cause issues. Businesses will need clear internal policies to ensure everyone follows the VeriFactu procedures. There might also be integration work if the invoicing software must connect with other systems (like connecting your billing system with your inventory management, etc.).
• Initial Technical Bugs: As with any new nationwide IT initiative, there could be technical hiccups. Early adopters in 2025 reported some minor issues in the testing phase – e.g., handling of certain invoice types or occasional downtimes of the AEAT service. The Tax Agency has been updating its FAQs and technical guides to resolve these. By the time of full rollout, the system should be stable, but businesses should still monitor updates from AEAT or their software provider to ensure continuous compliance (for instance, if any changes in formats or endpoints occur).
• Parallel Obligations: As noted, until Spain possibly streamlines forms, businesses in 2027 might find themselves both submitting all invoices via VeriFactu and still filing traditional VAT returns and annual listings. This dual reporting could feel burdensome unless the software automates much of it. Over time, one can expect Spain to leverage VeriFactu data to simplify other declarations (the long-term vision is likely a pre-prepared VAT return akin to how personal income tax drafts are provided). But in the transitional period, companies must be diligent not to neglect conventional compliance while focusing on VeriFactu.

Conclusion

• Molly Grace, Euro Weekly News – “Hacienda delays Verifactu by one year” (Dec 2025) [euroweeklynews.com], [euroweeklynews.com], [euroweeklynews.com]
• Conesa Legal – “VeriFactu in Spain: what it is, how it works and implementation deadlines (2025 Guide)” [conesalegal.com], [conesalegal.com], [conesalegal.com]
• Marosa VAT – “Verifactu in Spain: Complete Guide” (2025) [marosavat.com], [marosavat.com]
• Lextax – “Spain’s Digital Tax Revolution: 2026 Compliance Guide” [lextax.es], [lextax.es], [lextax.es]
• Agencia Tributaria (AEAT) – FAQ on VERI*FACTU Systems and April 2025 release notes [sede.agenc…ria.gob.es], [sede.agenc…ria.gob.es] [marosavat.com], [marosavat.com]
• Spanish Ministry of Hacienda – Press release (1 Apr 2025) on deadline extension [hacienda.gob.es], [hacienda.gob.es]
• CE Consulting – “Sanciones por no cumplir con Verifactu” (Oct 2025) [ceconsulting.es], [ceconsulting.es]