Spain's VeriFactu Mandate Explained: Deadlines, Fines, and How to Prepare
VeriFactu is mandatory for Spanish companies from January 2027 and for self-employed workers from July 2027. What it is, what your software needs to do, and how Frihet handles it automatically.
TL;DR: VeriFactu is mandatory for Spanish companies from 1 January 2027 and for self-employed workers from 1 July 2027. Your invoicing software must implement SHA-256 hash chains, AEAT QR codes, and sequential numbering. The fine for non-compliance is €50,000 per tax year. Frihet already complies across all 4 phases. This is also part of the broader EU push toward e-invoicing standardisation under EN16931 and Peppol.
Key takeaways
- Deadline for self-employed workers: 1 July 2027. For companies: 1 January 2027. These deadlines have already been extended once and are not expected to move again
- The fine for using non-compliant software is €50,000 per tax year — no fraud required, purely technical non-compliance is enough
- Most popular invoicing software in Spain still lacks full certification. Ask your provider now, not in Q4 2026
Contents
If you run a business in Spain and issue invoices, 1 July 2027 is a date you need to know.
That is when VeriFactu becomes mandatory for self-employed workers. For companies, the deadline is six months earlier: 1 January 2027. If your invoicing software does not meet the technical requirements by that date, Spain›s Anti-Fraud Law sets a fine of €50,000 per tax year. Not as a maximum. As a fixed minimum.
And yet, in early 2026, most freelancers and small business owners in Spain do not know exactly what VeriFactu is, what their software needs to do to comply, or whether the programme they are using today will be ready in time.
This guide answers all three questions.
What VeriFactu is and why it exists
The Spanish tax authority (AEAT) has known for years that tax fraud in Spain does not only happen through false declarations. It also happens because invoicing software can be manipulated: deleting invoices, changing amounts, maintaining two versions of the accounts. The technology allowed it and no regulation prevented it.
VeriFactu is the regulatory response to that problem. The name comes from «verificación de facturación» (invoice verification), and its purpose is technical: make issued invoices immutable, traceable, and verifiable by the AEAT.
It does not regulate how much you invoice or who you invoice. It regulates how your software manages billing records internally.
The legal framework sits across four instruments:
- Law 11/2021 (Anti-Fraud Law): establishes the penalties and the core obligation
- Royal Decree 1007/2023 (RRSIF Regulation): defines the technical requirements
- Order HAC/1177/2024: specific requirements for hash, QR, XML, and data schemas
- Royal Decree-Law 15/2025: extended the deadlines by one year (from 2026 to 2027)
How this fits the broader EU e-invoicing push
VeriFactu is Spain›s answer to a problem the entire European Union is tackling. Belgium›s Peppol-based e-invoicing mandate is already live. Poland›s goes into effect in 2026. France›s follows in September 2026. The EU›s ViDA (VAT in the Digital Age) initiative is pushing all member states toward real-time digital transaction reporting.
The technical standards vary by country, but the direction is uniform: paper and spreadsheet invoicing is ending. VeriFactu specifically implements invoice immutability and audit-chain requirements. The EN16931 standard that underpins Peppol-based invoicing across the EU covers structured electronic invoice formats. They are complementary: one governs the audit trail, the other governs the document format.
If your invoicing software is already compliant with one, it is almost certainly further along on the other.
The definitive deadlines
Royal Decree-Law 15/2025 extended the original deadlines by twelve months. These are the current ones:
| Group | Deadline |
|---|---|
| Software developers | 29 July 2025 (already passed) |
| Companies (corporate income tax) | 1 January 2027 |
| Self-employed workers and other taxpayers | 1 July 2027 |
Software developers should have had compliant products since July 2025. If the programme you use has not communicated anything about VeriFactu, there are two possibilities: they are behind, or they are not going to do it.
What your software must do to comply
VeriFactu does not require you to submit everything to the tax authority in real time (though you can if you want). What it does require is that your software meets four technical requirements for every billing record:
1. SHA-256 hash chain
Every invoice generates a cryptographic code (hash) that includes the data from that invoice and the hash from the previous invoice. It is a chain: if anyone modifies or deletes an invoice from the middle, the subsequent hashes no longer match, and evidence of the manipulation remains.
The eight mandatory fields that feed the hash calculation include: invoice number, date, issuer tax ID, total amount, VAT type, taxable base, tax rate, and tax amount.
2. Verifiable QR code
Every issued invoice must include a QR code that links to the AEAT›s electronic office, where anyone can verify that the invoice exists in the system. A customer, an inspector, or you yourself can scan it and confirm its authenticity.
3. Sequential numbering without gaps
Invoice numbering must be continuous and uninterrupted. You cannot delete invoice 2027-045 and pretend it never existed. If an invoice is cancelled, a cancellation record stays in the chain. The number does not disappear.
4. Immutability
Issued invoices cannot be edited or deleted. Only cancelled, with a cancellation record that also forms part of the chain. Drafts are editable, but the moment an invoice is issued, it is immutable.
There are two valid compliance modes:
VeriFactu mode (active submission): The software sends billing records to the AEAT in real time or near real time. Invoices can include the legend «Invoice verifiable at the AEAT electronic office.» The tax authority has your data before they ever ask for it.
Non-VeriFactu mode (local storage): The software stores all records with the technical guarantees (hash, QR, sequence) but does not submit them automatically. The AEAT can request them at any time. The taxpayer must be able to deliver them in full and verifiable form.
Both modes comply. The difference is operational, not legal.
The penalties no one wants to discover
Article 201 bis of the General Tax Law (introduced by Law 11/2021) sets the penalty framework:
| Violation | Penalty |
|---|---|
| Using non-certified software | €50,000 per tax year |
| Software that enables double bookkeeping | €150,000 |
| Manufacturer selling non-compliant software | €150,000 per tax year |
| Altering or destroying billing records | €1,000–€100,000 |
What makes these figures particularly serious: no fraudulent intent is required. If your software does not meet the technical requirements by the deadline, the penalty applies. It does not matter that all your invoices are accurate. It does not matter that you have paid all your taxes. Non-compliance is objective.
Reductions are available: 30% for agreeing to the penalty, 25% additional for immediate payment. But even with the maximum reductions applied, we are talking about €26,250 for the base penalty. For a self-employed worker billing €40,000 per year, that is nearly a full quarter of gross revenue.
The real state of invoicing software in Spain
In early 2026, this is where the major invoicing programmes stand on VeriFactu:
| Software | Status |
|---|---|
| Holded | Certified as AEAT social collaborator |
| Sage | Adapted |
| Contasimple | Adapted |
| Quipu | Adapted |
| Billin | Adapted |
| Frihet | All 4 phases implemented (hash, QR, sequence, XML) |
| Anfix | In progress |
| Excel / Word | Does not comply. Will not comply. |
If your invoicing software does not appear on this list or has not published an official communication about its adaptation, the next step is to ask them directly: when will you comply with VeriFactu? Do you have the AEAT sandbox working? What certification do you have?
If the answer is vague, you have time to switch before July 2027. But that time is not unlimited.
What you need to do if you use Excel or Word
This is straightforward: Excel and Word do not comply with VeriFactu and never will. They cannot generate hash chains, cannot include verifiable QR codes, and cannot guarantee sequential numbering.
If you are issuing invoices from a spreadsheet or word processor, you need to switch to certified invoicing software before the deadline. Not as an optimization. As a legal obligation.
The good news is that compliant software exists, is accessible, and has free plans that cover the needs of a freelancer just starting out.
How Frihet handles compliance
Frihet has implemented all four VeriFactu compliance phases. Users do not need to do anything: the system handles everything automatically on every issued invoice.
Phase 0 — Immutability: Issued invoices cannot be deleted or edited. Only cancelled, with a cancellation record that stays in the chain. Drafts are editable until the invoice is issued.
Phase 1 — SHA-256 hash chain: Every invoice automatically generates its cryptographic hash with the eight mandatory fields from Order HAC/1177/2024, plus the hash from the previous invoice. The chain is continuous and verifiable.
Phase 2 — QR and numbering: All invoices include a verifiable QR code linked to the AEAT. Numbering counters are atomic on the server: no gaps, no duplicates, no possibility of interference.
Phase 3 — XML and AEAT submission: XML generation conforming to the official XSD schemas. SOAP submission with XAdES signature. Registration records (RegistroAlta) and cancellation records (RegistroAnulacion) per the specification.
For the user, the result is simple: issue your invoice, and it already complies with VeriFactu. The hash is calculated on the server, the QR appears on the PDF, the sequence is maintained without intervention. No configuration required, no module to activate, no certificate to manage if you use Frihet›s submission channel as a social collaborator.
Checklist for being ready before 2027
If you are a freelancer or small business manager who wants to make sure you are covered:
The short version
VeriFactu is mandatory. The deadlines are real: January 2027 for companies, July 2027 for self-employed workers. The fine for non-compliance is €50,000 per tax year, no fraud required.
Your software needs to meet four requirements: SHA-256 hash chain, verifiable QR code linked to the AEAT, sequential numbering without gaps, and immutability of issued invoices.
If your invoicing software already meets them, you are covered. If not, you have time to switch. But that window shrinks every month.
Frihet meets them. If you want to verify it, issue a test invoice and check the QR. It works.
Was this article helpful?
FAQ
When does VeriFactu become mandatory for self-employed workers?
1 July 2027. For corporate income taxpayers (companies), the deadline is 1 January 2027. The deadlines were extended by one year under Royal Decree-Law 15/2025.
What happens if my software is not VeriFactu-compliant by the deadline?
The Anti-Fraud Law (Art. 201 bis LGT) sets a fine of €50,000 per tax year. No fraudulent intent is required: using technically non-compliant software is enough to trigger the penalty.
How do I know if my current software complies with VeriFactu?
Ask your provider whether they have implemented: SHA-256 hash chains, QR codes on invoices, sequential numbering without gaps, and (for active VeriFactu mode) XML submission to the AEAT. If the answer is vague, treat that as a warning sign.
Can I keep using Excel to issue invoices?
No. Excel, Word, and any programme that cannot generate cryptographic hash chains or verifiable QR codes will not comply with VeriFactu. Eliminating invoice records without an audit trail is precisely what the regulation is designed to prevent.
Is VeriFactu the same as the B2B electronic invoicing mandate?
No. They are separate regulations. VeriFactu governs how invoicing software stores billing records internally. The B2B electronic invoice mandate (Ley Crea y Crece) governs the electronic format for business-to-business invoice exchange. They are complementary obligations with different deadlines.
Does Frihet already comply with VeriFactu?
Yes. Frihet has implemented all four phases: invoice immutability, SHA-256 hash chain, verifiable QR code at the AEAT, and XML generation and submission following the XSD schemas of Order HAC/1177/2024.
