Verifactu mandatory 2026 — Key dates, fines, and requirements

Starting July 1, 2026, all sole proprietors and companies in Spain must issue electronic invoices complying with the Verifactu regulation (Verification of Billing System Regulation). The timeline began when Royal Decree 1007/2023 was published in December 2023, and Spain's Tax Agency has confirmed there will be no extension — the system enters production this summer.

This obligation affects most digital service providers operating in Spain, including eSIM operators. If your business issues invoices to customers in Spain (individuals or companies), you need to adapt before the deadline. This article breaks down the key dates, non-compliance fines, Verifactu technical requirements, and applicable exceptions.

What is Verifactu and why is it mandatory?

Verifactu (formally "Regulation on requirements that billing systems and computer programs must adopt to support the invoicing processes of entrepreneurs and professionals") requires that all billing systems generate a digitally signed audit record for each invoice issued. This record includes operation metadata (issuance date, taxable base, VAT applied, customer identifier) and must be sent to Spain's Tax Agency (AEAT) in near-real time — within 4 business days after issuance.

The goal is to close the VAT gap, which in 2024 was around €7 billion annually in Spain according to Brussels data. The AEAT estimates that 42% of VAT evasion comes from unreported invoices or those altered after issuance. With Verifactu, each invoice leaves an immutable "digital fingerprint" from the moment of creation, and the Agency can automatically cross-reference declared sales against registered invoices.

This is not the same system as the B2B electronic invoicing platform that came into effect in January 2025 (Law 18/2022, known as "Ley Crea y Crece"). That regulation only requires large companies and government contractors to exchange invoices in structured format (XML FacturaE); Verifactu, by contrast, applies to all sole proprietors and SMEs, regardless of billing volume or sector.

Key Verifactu dates in 2026

• July 1, 2026: general effective date. From this date, all new invoices must carry the Verifactu record and be sent to the AEAT within 4 business days.
• August 31, 2026: end of grace period. The Tax Agency has announced that during July and August it will not apply sanctions to those demonstrating good faith and undergoing adaptation. Starting September 1, fines take effect without exceptions.
• December 2026: the AEAT will publish the first "implementation balance" evaluating compliance percentage by sector. Sectors with less than 70% compliance will enter an "intensive monitoring" list with quarterly reviews.

For digital service providers operating in multiple countries (like eSIM operators), the July 1 deadline affects all invoices issued from Spain, regardless of customer residence country. If your company has a Spanish tax ID and issues invoices to travelers in Argentina, Mexico, or Colombia, those invoices must comply with Verifactu if your billing system is based in Spain.

Verifactu non-compliance fines

The General Tax Law (articles 201-206) establishes a penalty framework that the AEAT will apply starting September 1, 2026. Violations are classified into three levels:

Minor violation (€150 fine per invoice)

• Delay in submitting the Verifactu record of 5 to 30 days after invoice issuance.
• Formal errors in the record (missing exact issuance time, malformed SHA-256 hash, missing device identifier) that do not prevent operation traceability.
• Example: you issue 20 invoices on July 3 and register them in Verifactu on August 10 (37 days later). Fine: 20 × €150 = €3,000.

Serious violation (€1,000 fine per invoice + 10% surcharge on unreported VAT)

• Failure to submit the Verifactu record (more than 30 days delay or no submission).
• Tampering with the record after issuance (changing taxable base, date, or recipient).
• Using an uncertified billing system that does not generate valid digital signatures.
• Example: you issue 50 invoices in July, none registered in Verifactu. Base fine: 50 × €1,000 = €50,000. If the VAT on those invoices totals €2,100, you add a 10% surcharge = €210. Total: €50,210.

Very serious violation (50–150% fine of defrauded amount + temporary closure)

• Issuing false or duplicate invoices to claim non-existent VAT deduction.
• Operating a "double accounting" system (two billing softwares, one registered with Verifactu and one hidden).
• Obstructing an inspection (refusing to provide system logs, destroying audit files).
• Penalty: in addition to the economic fine, the AEAT can order temporary business closure for 3–12 months and ban from public contracts for 2–5 years.

The minimum sanction for a sole proprietor issuing 10 invoices per month and not complying with Verifactu for 6 months is 60 invoices × €1,000 = €60,000, plus the VAT surcharge. This is not a symbolic fine: the AEAT has budgeted 120 additional inspectors for Verifactu during 2026–2027, with a first-year penalty collection target of €450 million.

Verifactu technical requirements

Your billing system (SaaS software, in-house ERP, or third-party platform) must meet these five requirements:

1. Digital signature generation per invoice

Each invoice must carry a SHA-256 hash covering these fields: invoice number, issuer tax ID, recipient tax ID, issuance date and time (second precision), taxable base, VAT rate, VAT amount, total amount. The hash is generated when the invoice is created and cannot be modified afterward.

2. Record chaining

Each invoice record includes the hash of the previous invoice issued by the same device/terminal. This creates an immutable chain similar to blockchain: if you alter an invoice issued in July, you break the chain and all subsequent invoices become invalid. The AEAT detects chain breaks automatically during its cross-checks.

3. Unique device identifier

Each terminal issuing invoices (physical POS, web server, cloud instance) must have a 20-character alphanumeric ID assigned by the AEAT. You request the ID through the Electronic Office with a digital certificate before July 1. If you use multiple cloud servers (one for Spain, another for Latin America), each needs its own ID.

4. Automatic submission to AEAT within 4 business days

Verifactu records must be sent to the AEAT's SOAP endpoint (https://www7.aeat.es/verifactu/v1.0) within 4 business days after issuance. The submission uses the company's digital certificate (not the proprietor's personal certificate). The AEAT responds with an acceptance code (CSV); that CSV must be stored with the invoice for 4 years.

5. Audit log retention for 4 years

You must keep a log file for each invoice including: creation timestamp, client IP (if online invoice), ID of user who issued it, invoice hash, AEAT CSV. Logs must be encrypted (AES-256) and immutable (WORM or append-only storage).

If you use commercial billing software (Holded, Facturaplus, Sage, Quipu), the software provider must certify Verifactu compliance. Look for a "Verifactu Ready" seal issued by the AEAT — if your software doesn't have it, switch before July 1.

Exceptions and special cases

Sole proprietors in module regimes (objective estimation)

Sole proprietors under the module regime (bars, hair salons, taxis, small retail commerce) are not required to use Verifactu if they invoice less than €150,000 annually and 100% of sales are B2C (to end consumers). This exception is reviewed annually: if your 2027 sales exceed the threshold, you enter Verifactu starting January 1, 2028.

Simplified invoices (receipts)

Receipts issued by point-of-sale terminals (POS) in physical stores with amounts under €400 do not need individual Verifactu registration if the store sends a daily aggregated summary before 23:59 the next day. The summary includes: number of receipts issued, total taxable base, total VAT, daily closing hash. This mechanism only applies to in-person sales; online sales (even low-value B2C) need individual registration.

Digital services to non-EU customers

If you sell eSIMs to travelers residing in the United States, Brazil, or Japan (non-EU countries) and apply the OSS (One-Stop Shop) VAT regime, those invoices must comply with Verifactu if your company is based in Spain. OSS only simplifies quarterly VAT reporting; it does not exempt Verifactu. This particularly affects international B2C digital service providers.

Impact on eSIM providers and digital service vendors

We register all purchases in Verifactu starting July 1, 2026. This applies to Spain residents and travelers buying plans for Turkey, Morocco, or Thailand from a Spanish IP or with Spanish payment method (card issued in Spain, PayPal account with .es domain).

Our system meets all five technical requirements: each invoice carries SHA-256 signature, chaining with the previous invoice, device ID certified by the AEAT, automatic submission within 2 business days (below the 4-day limit), and encrypted logs retained for 5 years. The AEAT CSV is included in the PDF you receive by email.

How to verify if an invoice complies with Verifactu

Starting July 1, 2026, all invoices issued in Spain must display these elements:

1. "Verifactu Invoice" legend in the document header or footer.
2. CSV code (Secure Verification Code) of 16 alphanumeric characters, issued by the AEAT. Example: A3K9-Z7M2-F8P1-Q5R4.
3. SHA-256 hash of the invoice (64 hexadecimal characters). Example: 3f7a9c8e... (truncated).
4. Issuer device ID (20 characters). Example: ESIM-AHORA-SRV01-ES.

You can validate the CSV on the AEAT website (sede.agenciatributaria.gob.es/verifactu) by entering the CSV and the issuing company's tax ID. If the CSV does not exist in the database, the invoice was not registered correctly.

Corrective invoices and credit notes under Verifactu

If you issue an invoice with an error (wrong amount, misspelled customer data, incorrect VAT rate), you cannot modify or delete it. You must issue a corrective invoice that voids the original and generates a new Verifactu record.

The corrective invoice must include:

• Number of the original invoice being corrected.
• Reason for correction (free-text field, maximum 500 characters).
• New correct values (taxable base, VAT, total).
• Hash chaining to the original invoice.

The original invoice remains in the Verifactu chain with status RECTIFIED; the corrective enters as a new invoice with status CORRECTIVE. Both are retained in audit logs. If the corrective reduces the taxable base (you refund the customer), you also generate a credit note with a negative sign in the TaxableBase field.

This process is more involved than pre-Verifactu (when you could delete and replace an invoice), but ensures complete traceability. We recommend double-checking customer data before issuing, especially the tax ID — an error in the identifier requires correction.

Recommended adaptation calendar

If you're a sole proprietor or SME and have not yet adapted your billing system, here is the calendar you should follow:

April 2026 (now):

• Contact your billing software provider and confirm they will have the Verifactu seal before July 1. If not, explore alternatives (Holded, Quipu, and Sage already have it; Facturaplus will by May).
• Request an enterprise digital certificate from FNMT if you don't have one. Processing takes 7–10 business days.

May 2026:

• Request device IDs from the AEAT Electronic Office. You need one per server/POS. The AEAT takes 5 business days to issue them.
• Configure the Verifactu SOAP endpoint in your software. Test submission in the AEAT's preproduction environment (pre.verifactu.agenciatributaria.gob.es).

June 2026:

• Issue 10–20 test invoices in production (you can invoice internal services between group companies). Verify you receive the CSV and the hash chain is correct.
• Set up automatic alerts to detect chain breaks (your software should notify you if an invoice does not chain with the previous one).

July 1, 2026:

• From this day forward, all new invoices must comply with Verifactu. Do not issue any invoice on the old system after 00:00 on July 1.

FAQ

What happens if I don't comply with Verifactu before July 1?

During July and August 2026, the AEAT announced a grace period: if you demonstrate you are adapting (you have requested device IDs, hired certified software, done preproduction testing), they will not apply fines. Starting September 1, sanctions take effect without exceptions. The minimum fine is €150 per unregistered invoice (minor violation); if delay exceeds 30 days, it rises to €1,000 per invoice (serious violation).

Do invoices issued before July 1 need to adapt?

No. Verifactu applies only to invoices issued from July 1, 2026 onward. Invoices from 2023, 2024, and 2025 do not need Verifactu registration, but must be retained for 4 years in digital or paper format under prior regulations. If you issue a corrective invoice in August 2026 correcting a March 2025 invoice, the corrective must comply with Verifactu (because it is issued after July 1), but the original does not.

Can I continue issuing invoices as PDF or must I use XML?

You can issue invoices as PDF, provided the PDF is generated from a Verifactu-compliant system (digital signature, chaining, AEAT submission). The PDF must display the CSV and hash visibly so the customer can validate it. XML (FacturaE) is not mandatory, except if your customer is a large company or public agency requiring it under B2B electronic invoicing rules (Law 18/2022). That regulation and Verifactu are independent: one governs invoice exchange format between businesses, the other governs audit registration with the Tax Agency.

Are sole proprietors in module regimes exempt?

Yes, but only if they meet two conditions: annual billing under €150,000 and 100% of sales are B2C (to end consumers without tax ID). If a module-regime sole proprietor issues even one invoice per year to another business or proprietor (B2B sale), they lose the exemption and must use Verifactu for all invoices. The exemption is automatically reviewed every January 1: if a sole proprietor exceeds the threshold in 2026, they enter Verifactu starting January 1, 2027.

How does Verifactu affect mobile and data expense deductions?

If you are a sole proprietor deducting 100% of your mobile line or eSIM expense (because you use it exclusively for business), the invoice must comply with Verifactu starting July 1, 2026. If your provider (traditional operator or eSIM platform) does not register the invoice in Verifactu, the Tax Agency may reject the deduction during an audit. For travel expenses (eSIM purchased for a business trip to Peru or Chile), the invoice must also comply with Verifactu if issued by a Spanish company. Store the AEAT CSV with the invoice in your accounting records to demonstrate compliance.