Royal Decree 1007/2023 establishes the regulatory framework for Invoicing IT Systems (SIF), more commonly known as the Verifactu Regulation. Its purpose is to standardize the generation, preservation, and traceability of invoicing records in the business environment, guaranteeing their integrity, security, and accessibility in compliance with current tax regulations in Spain.
Although the VAT Law (Law 37/1992) and the Invoicing Obligations Regulation (Royal Decree 1619/2012) remain the legal foundation of invoicing, Verifactu introduces key modifications:
- Not all transactions are subject to this regulation, although its adoption is voluntary for any taxpayer.
- Special invoicing authorizations granted by the Tax Agency remain valid.
- A QR code is mandatory on all issued invoices, along with the possible inclusion of the legend "verifiable invoice" or Verifactu.
What are the objectives of Verifactu?
The invoicing system must comply with the following essential principles:
- Integrity: Prevention of undocumented alterations.
- Preservation: Secure and accessible storage for auditing.
- Legibility and Traceability: Ability to track and understand records.
- Immutability: Any modification must be recorded in a verifiable manner.
When does Verifactu come into effect?
The regulation establishing the requirements for invoicing IT systems (SIF) will be mandatory on different dates, depending on the affected group:
Entrepreneurs and professionals who issue invoices: must have their invoicing IT systems adapted to the regulation requirements operational before July 1, 2025.
SIF producers and marketers: must ensure their products comply with the regulation within a maximum period of nine months from the entry into force of the ministerial order that develops the technical specifications.
- For SIF included in multi-year maintenance contracts signed before this deadline, adaptation must be completed before July 1, 2025.
Those obligated who have adapted systems before the established deadlines may begin using them. Additionally, the Tax Agency will have means to facilitate the submission of invoicing records from VeriFactu SIF before the deadline.
What is an Invoicing Record according to Verifactu?
The regulation distinguishes between two fundamental types of records:
- Registration Invoicing Record: Automatically generated with the issuance of an invoice.
- Cancellation Invoicing Record: Documents the modification or cancellation of a previously issued invoice.
These records include advanced security measures, such as the use of Hash codes, which guarantee the sequential linking between records, preventing unregistered manipulations.
Can Paper Invoices Be Issued with Verifactu?
Yes. Although Verifactu regulates the digitalization of records, invoices can continue to be issued both on paper and in structured electronic format, as long as the records meet the established technical requirements.
How can you comply with Verifactu?
Companies can comply with the regulation through two main options:
- Verifactu modality: Invoicing records are generated and stored directly at the Tax Agency.
- Non-Verifactu modality: Records are kept in the issuer's IT system and are only transmitted to the Tax Agency upon request.
Additionally, the Tax Agency has developed a form on its electronic headquarters so that small taxpayers without invoicing software can generate invoices adapted to Verifactu.
What does the QR code in Verifactu consist of?
Since the implementation of Verifactu, all issued invoices, both complete and simplified, must include a QR code with the following elements:
- Key invoice data.
- Direct link to the Tax Agency's electronic headquarters.
- Ability to validate or communicate the invoice depending on the modality used (Verifactu or Non-Verifactu).
To ensure the reliability of verification, the Tax Agency recommends using its official APP for invoice validation.
What complementary services does the Tax Agency offer for Verifactu?
To facilitate the implementation of Verifactu, the Tax Agency provides the following services:
- Online Invoicing Form: Aimed at small taxpayers without their own invoicing systems.
- Issued and Received Invoice Consultation: Access at the electronic headquarters for users operating under the Verifactu modality.
Who is obligated to comply with Verifactu?
Verifactu regulations establish a broad and precise compliance framework, applicable to various tax subjects and economic operations in Spanish territory. According to Royal Decree 1007/2023, individual entrepreneurs and companies, as well as entities without legal personality, that pay taxes under Personal Income Tax (IRPF) for economic activities, Corporate Tax, or Non-Resident Income Tax, are required to comply with this regulation, provided they operate through a permanent establishment in Spain. This regulation applies to taxpayers with tax domicile under the common Spanish regime, excluding residents of the Basque Country and Navarra, which have differentiated tax regulations.
All obligated subjects must ensure that their invoicing systems are aligned with Verifactu requirements, ensuring the issuance of invoices (whether complete or simplified) in accordance with the required standards. The main objective is to improve tax transparency, facilitate the traceability of commercial operations, and prevent fraud through immutable and verifiable records by the Tax Agency.
What are the penalties for non-compliance with Verifactu?
Article 201 bis of Law 58/2003, of December 17, the General Tax Law (LGT), establishes two types of penalties considered serious:
Penalties for manufacturing, producing, and marketing non-compliant IT systems:
- A fixed fine of 150,000 euros for each fiscal year in which sales of these systems have occurred and for each distinct type that is the subject of the infringement.
- When such systems are not certified despite being required to do so, the penalty will be 1,000 euros per IT system marketed without certification.
Penalties for possession of non-compliant IT systems:
- A fine of 50,000 euros per fiscal year for possessing IT systems that do not comply with the provisions of Article 29.2.j) of the LGT, when they are not properly certified (if required by regulations) or when certified devices have been altered or modified.
Are there exceptions and exclusions to Verifactu?
Not all taxpayers are required to comply with Verifactu. There are certain cases that are exempt from this regulation:
- Companies adhered to the Immediate Supply of Information (SII): Entities that already comply with the obligation to submit their VAT register books to the Tax Agency through the SII are exempt from Verifactu requirements.
- Transactions not subject to mandatory invoicing: According to the Invoicing Obligations Regulation (RD 1619/2012), some transactions do not require the issuance of an invoice and are therefore not subject to this regulation.
- Specific authorizations: The Tax Agency may grant exceptions for certain operations or sectors under justified circumstances.
What is the Non-Verifactu modality?
Compliance with the regulation can be carried out through two clearly differentiated modalities:
Verifactu: In this modality, invoicing records must be transmitted to the Tax Agency in real time, which guarantees their immutability and proper preservation. As an additional security measure, generated invoices include a QR code that allows customers to verify their authenticity directly at the Tax Agency's electronic headquarters. This system is designed to offer a high degree of transparency and reduce the possibility of fraudulent manipulations.
Non-Verifactu: Unlike the previous option, this modality does not require the immediate submission of invoicing records to the Tax Agency. However, it requires greater security requirements, such as the electronic signature of the issuing system and the management of an "Event Log" that documents all system interactions. Although invoices also include a QR code, they cannot be verified at the Tax Agency's electronic headquarters.
Each company can choose the modality that best suits its operational needs, as long as it guarantees compliance with the requirements established in the regulation.
What are the mandatory elements in the Verifactu invoicing record?
The invoicing IT record in Verifactu is not equivalent to an electronic invoice, but it must contain certain essential elements to guarantee its validity and traceability:
- Identification of the issuer and the recipient (name, tax ID number, company name).
- Invoice issuance date and date of the transaction performed.
- Type of invoice issued (complete or simplified).
- Condition of corrective or replacement invoice.
- Total amount broken down with the corresponding VAT.
- Identification code of the IT system that generated the invoice.
- Timestamp with the exact date and time of issuance.
- Cryptographic relationship with previous records using the hash function.
- Identification of the invoicing software provider used.
These requirements guarantee that each invoice complies with the principles of integrity, authenticity, and traceability required by the Tax Agency, minimizing the risks of fraud and accounting errors.
What does the Verifactu responsible declaration consist of?
One of the fundamental pillars of Verifactu is the certification of invoicing IT systems. Software providers must issue a responsible declaration certifying that their systems comply with the requirements established in Article 29.2.j) of the General Tax Law (LGT) and in Royal Decree 1007/2023.
The certification must contain detailed information about:
- Software identification and its version.
- Functionalities and technical specifications.
- Installation and maintenance procedure.
- Data of the software development company.
A key aspect is that taxpayers who use properly certified invoicing software will not be responsible for technical failures or non-compliance arising from the system. This responsibility falls exclusively on the software provider, in accordance with the provisions of Article 201 bis of the LGT.
Glossary of key terms in Verifactu
- Verifactu: Compliance modality in which invoicing records are transmitted in real time to the Tax Agency, ensuring their immutability and traceability.
- ROF (Invoicing Obligations Regulation): Regulation governing invoice issuance requirements in Spain (RD 1619/2012).
- RRSIF: Regulation governing invoicing IT systems (RD 1007/2023).
- QR Code: Graphic element that allows invoice verification at the Tax Agency's electronic headquarters.
- Hash: Cryptographic algorithm that chains invoicing records, ensuring their immutability and preventing data manipulation.