What Is Verifactu? Spain's 2027 E-Invoicing Law Explained

A Spanish customer forwards you a note from their accountant. From 2027, it says, every invoice you send has to carry a QR code and reach the Spanish tax authorities as it is issued. The regulation is called Verifactu. Your company is not Spanish, your billing runs from somewhere else, and nobody can tell you whether any of this actually reaches you.

The regulation is Royal Decree 1007/2023, built on anti-fraud Law 11/2021 and developed technically by Order HAC/1177/2024. What follows is the standing answer to the four questions a business outside Spain actually has:

• Does Verifactu reach you at all?
• Which of the 2027 dates is yours?
• What does your invoicing system have to do differently?
• Where does this sit among the other e-invoicing regimes you already handle?

What is Verifactu?

Verifactu is a set of requirements that billing systems have to meet, plus a channel for sending what they produce to the Agencia Tributaria, Spain's tax agency. That framing matters, because the most common misreading is that Verifactu changes the invoice. It does not. Your invoice can stay a PDF and keep its current layout, apart from one QR code.

What changes is what happens underneath. Every time a covered business issues an invoice, its system generates a billing record, known as a registro de facturación de alta. The record holds the tax ID, the date, the amounts and a security fingerprint. Billing records are then chained to each other by a hash, so deleting or editing anything breaks the chain in a way an inspector can see.

There are two ways to satisfy the regulation. In Verifactu mode the billing records go to the AEAT automatically as invoices are issued. In no Verifactu mode they stay with you under stricter conditions. More on that fork below, because it is the decision most readers have not realized they need to make.

When does Verifactu become mandatory in Spain?

Three deadlines, one per group. The deadline for software makers has already passed, which is why any invoicing product you evaluate today should already handle this.

Who	Mandatory from	What it means in practice
Producers and sellers of billing systems	29 July 2025	Already in force. Compliant products have been on the market for over a year
Taxpayers subject to Spanish corporate income tax	1 January 2027	Systems must meet the requirements before this date, not on it
Everyone else in scope, including the self-employed and non-residents with a permanent establishment	1 July 2027	Six months of extra runway, and the group most non-Spanish businesses fall into if they fall in at all

Those dates are the current text of the law, and they got there in two steps. Royal Decree 254/2025 amended the original calendar, and Royal Decree-law 15/2025 amended it again with effect from 4 December 2025.

The vendor deadline has already passed, so for most businesses the real question is not when the rule starts but when their own provider is ready.

Who has to comply with Verifactu in Spain?

This is where non-Spanish businesses most often get the wrong answer, usually by assuming that a Spanish VAT number puts them in scope. It does not, on its own.

The four groups the regulation covers

Article 3 of the regulation names them precisely:

• Taxpayers subject to corporate income tax (Impuesto sobre Sociedades), on income that is taxable and not exempt
• Taxpayers subject to personal income tax (IRPF) who carry on an economic activity, which covers most Spanish freelancers
• Taxpayers subject to non-resident income tax (IRNR) who earn income through a permanent establishment in Spain
• Income-attribution entities (entidades en régimen de atribución de rentas) carrying on an economic activity

Producers and sellers of billing software have a separate obligation of their own, covering what they build and sell rather than how they invoice.

Note what the list keys off: income tax categories. Not VAT registration, not invoice volume, not turnover. And the obligation attaches to the software, so using a computerized billing system for even part of your activity brings that part into scope.

Does Verifactu apply if your business is not established in Spain?

A Spanish VAT registration does not put you in Verifactu. The third group above is the one that matters, and its trigger is the permanent establishment. A foreign company registered for Spanish VAT with no permanent establishment in Spain stays outside. Those who do have one are required to comply from 1 July 2027.

The confusion is understandable. A Spanish VAT number does pull you into plenty of other Spanish obligations, and it can pull you into the SII. Verifactu simply draws its boundary somewhere else.

Two things follow. First, establishment is a facts-and-circumstances question, and a warehouse, a local team or a fixed place of business can create one where you did not expect it. If your Spanish footprint is anything more than a registration, get that assessed properly rather than reading it off a blog post.

Second, plan for the question even if you are clearly out of scope. During 2027 your Spanish customers will start receiving QR-coded, verifiable invoices from their local suppliers. Some of them will ask why yours look different. That is a commercial conversation rather than a legal one, but it is worth being ready for.

Who is outside Verifactu

• Taxpayers whose tax domicile is in the Basque Country or Navarre. The foral territories run their own regimes, TicketBAI and its Navarrese equivalent. The regulation applies in those territories only to taxpayers domiciled in the common territory
• Businesses already reporting through the SII, since their invoice data reaches the tax authorities in near real time already. One wrinkle: issuing invoices on behalf of a third party can still bring an SII business into Verifactu for those invoices
• Anyone with no obligation to issue invoices at all

One correction worth making, because almost every English explainer either omits it or implies the opposite. The Canary Islands, Ceuta and Melilla are in scope. The regulation applies across Spanish territory and says so explicitly, subject to the specialties in their own rules. Their special status is an exclusion from Spanish VAT, not from the invoicing regime.

What a Verifactu-compliant billing system has to do

Treat this as a buying checklist rather than a process diagram, because the decision in front of you is whether your current tool qualifies.

• Generate a billing record at the moment of issue, carrying the tax ID, the date, the VAT amounts and a security fingerprint
• Chain billing records by hash, each one referencing the last, so an edit or a deletion is visible
• Add a QR code to every invoice, alongside either the phrase "Factura verificable en la sede electrónica de la AEAT" or the mark VERI*FACTU. Scanning it lets the recipient confirm the invoice with the tax agency
• Refuse to alter or delete records. Corrections go through credit notes, which generate billing records of their own
• Keep an event log and prevent any user from switching the compliance features off

Then the fork. Both columns below are legal; they are just very different amounts of work.

Obligation	Verifactu mode	No Verifactu mode
Billing records sent to the AEAT	Automatically, as each invoice is issued	No. Only on request
Electronic signature on each record	Not required	Required
Retaining the records yourself	Not required	Required
Event log	Not required	Required
Producing records for an inspection	The AEAT already has them	You produce them, in the prescribed format

The choice does not go the other way. Every compliant system has to be capable of submitting to the AEAT, so a billing system that only works in no Verifactu mode does not exist.

Products are therefore either Verifactu-only or dual. A dual product leaves the choice to you. A Verifactu-only product has already made it, which is worth knowing before you buy.

Sending automatically is the lower-maintenance option by some distance, which is why most cloud invoicing tools default to it. The technical specifications sit on the AEAT's site if you need the detail.

What are the penalties for non-compliance?

The fines live in article 201 bis of Spain's General Tax Law, inserted by anti-fraud Law 11/2021. They are fixed amounts rather than percentages.

• €50,000 per financial year for holding billing systems that do not meet the requirements
• €150,000 per financial year and per distinct type of system for producing or selling billing systems that do not comply
• €1,000 per product sold without the declaration the regulation requires

Read the first one again, because it is the one that catches buyers. The penalty attaches to using the wrong software, not to any mistake you make with it. That makes Verifactu a procurement decision before it is a compliance project.

"Verifactu certified" software: who actually does the certifying

So the claim to watch is a precise one. A vendor saying its product is certified is describing something that exists. A vendor saying it is certified, approved or homologated by the Agencia Tributaria is describing something that does not.

Article 13 of the regulation works like this, and the AEAT sets it out plainly in its FAQ on certification and the declaración responsable:

• Certification is compulsory. Every billing system inside the rules must carry one, including software a company builds for its own use and systems that only ever run in Verifactu mode
• The producer certifies its own product, by issuing a declaración responsable: a written declaration that the system meets the General Tax Law, the regulation and the ministerial order
• No external body is involved. The AEAT states that certification requires no independent person, entity or organisation outside the producer
• There is no register. Prior registration of a product is not required of anyone, producer, reseller or user alike, so there is no official list to check a vendor against
• Every version needs its own. A minor release counts as a different product and needs a fresh declaration
• It has to be readable in two places: inside the software, for the version you are running, and outside it, so a buyer can read it before purchasing
• A reseller is on the hook too. A company selling someone else's product has to satisfy itself that the manufacturer certified it, or it carries the article 201 bis liability itself

Two things make the confusion reasonable. The law's own section heading is Certificación de los sistemas informáticos and the text says the producer "certifies", so the word is genuinely there.

The other is TicketBAI. Anyone who met the Basque regime first will have seen its real registry of software garante. One Spanish system has an official list. Verifactu is not it.

The practical upside is that second location. You are entitled to read a product's declaración responsable before you install anything, so ask for it. Three better questions than "are you certified":

• Can I see your declaración responsable for the version I would be running?
• Does the product run in Verifactu mode or no Verifactu mode?
• Does it cover credit notes and simplified invoices, or only full invoices?

If you have never seen one, ours is published in full, field by field.

How Verifactu fits with Spain's other rules, and with the EU

If Spain were your only market this section would be optional. It is here because most readers of this page are running three or four regimes at once and need to know which box this one goes in.

Verifactu and B2B e-invoicing under the Crea y Crece law

Two obligations, two different problems.

• Verifactu is about reporting and integrity. It makes sure a trustworthy record of each invoice reaches the tax authorities
• Crea y Crece B2B e-invoicing is about exchange. It makes sure a structured invoice moves between two businesses in a machine-readable format, with its payment status tracked

They have separate timetables and they will coexist. Complying with one does not discharge the other. Our guide to e-invoicing in Spain covers the B2B mandate in the detail it deserves.

Verifactu, the SII and TicketBAI

Three Spanish systems that get confused with each other constantly, doing three different jobs:

• SII is real-time VAT ledger reporting, mandatory for large taxpayers and optional for everyone else. It is a reporting obligation, not a set of requirements on your billing system
• TicketBAI is the Basque fiscalization regime, with its own registry and its own technical rules
• Verifactu covers the common territory and everyone the other two do not

Being inside one of the first two generally keeps you out of Verifactu. One exception nobody writes for. A business with activity in both Basque and common territory can end up inside two regimes at once, on two sets of technical requirements.

Where Verifactu sits in the EU picture

Verifactu is Spain's version of a pattern now running right across Europe. Tax authorities are moving from periodic returns to transaction-level data, and each of them is imposing its own technical requirements to get there. Italy built SdI, Hungary built RTIR, Portugal uses ATCUD, France is in the middle of its own reform.

VAT in the Digital Age, the EU package known as ViDA, was adopted on 11 March 2025 and entered into force that April. It matters here mostly for what it does not do. Three points settle the relationship:

• Its digital reporting requirements apply to cross-border B2B supplies, from 1 July 2030
• Its new Article 271a says Member States may require domestic transaction reporting. It does not oblige them to
• Member States that already ran domestic real-time reporting before 2024 have until 1 January 2035 to converge, which is why Spain's SII is not being rebuilt next year

Verifactu is a domestic system. ViDA harmonizes how such a system has to work rather than replacing it, so a Spanish requirement stays a Spanish requirement.

The honest takeaway for a business selling into several countries: there is no single European mandate to comply with, and there will not be one this decade. The work stays per country. The leverage is in choosing tooling that absorbs each new regime as it lands, instead of onboarding a local vendor in every market. Our guide to digital reporting requirements across the EU maps the whole field.

How to get ready

Four steps, in this order.

1. Settle which group you are in, and therefore which date. For a non-Spanish business that means answering the permanent establishment question first, with an adviser if the answer is not obvious. Everything else depends on it.
2. Ask your provider the three questions above. "Are you certified?" is the wrong question, because every compliant product is, and it certified itself. If the answer about the declaración responsable is vague, that tells you something.
3. Choose Verifactu or no Verifactu mode. For most businesses selling online, automatic submission is meaningfully less work than signing, retaining and logging records yourself.
4. Test before the deadline rather than on it. Invoice numbering, credit notes and the customer-detail requirements are the parts that surprise people, and they tend to do it in production.

There is an upside beyond not being fined. Return data arrives pre-filled, customers verify an invoice themselves instead of emailing you, and an inspection becomes a shorter conversation.

How Quaderno handles Verifactu

Quaderno complies with the Verifactu regulation, and its declaración responsable is published in full rather than summarised as a badge. That document declares Quaderno a Verifactu-only system: it cannot be run in no Verifactu mode at all. Invoices, receipts and credit notes go to the AEAT automatically as they are issued, and every document carries a QR code so your customer can verify it.

Setting it up takes two steps. Upload an electronic certificate whose tax ID and legal name match the account. Then connect Verifactu from the Integrations page and authorize submission. If you are building on the API, it returns a verification_code and a verification_url for each document, and delivery webhooks fire on delivery.succeeded, delivery.failed and delivery.rejected.

Three limitations you should know before you switch it on, because they surprise people otherwise:

• Invoice numbers and issue dates are assigned automatically. Custom numbering is not available while Verifactu is active
• Full invoices to Spanish customers get validated against the AEAT's registry, on both name and NIF, so a mismatch will stop the invoice rather than send it
• The integration cannot be switched off by you. Submission is not a toggle, because the product is certified as Verifactu-only. Stopping it means contacting support

Here is the part that matters for the reader this page was written for. Every other product competing on this topic is a Spain-only compliance tool. Quaderno is not. Alongside Verifactu it also:

• Works out and applies the right tax in every country you sell in
• Validates EU VAT numbers
• Tracks your registration thresholds as you approach them

It does all of that across Stripe, Shopify, WooCommerce, Amazon FBA, PayPal, Square and the rest of your stack. If you bill through Stripe, that matters more than it sounds. Stripe issues the charge, but the billing record, the QR code and the submission to the AEAT are your obligation, not Stripe's. Quaderno picks up each Stripe transaction and does that part for you.

For a business selling into Spain from somewhere else, Verifactu is one requirement out of many, and the many is the actual problem.

See how Quaderno connects to your stack, and what it does with the tax once it is there.