Verifactu Requirements: Hash-Chained Records, QR Codes, and the SIF Checklist
Verifactu is a software law: your billing system must produce immutable, hash-chained records and print a QR code on every invoice. Here is exactly what a compliant SIF must do, and what it costs to ignore it.
Verifactu Requirements: Hash-Chained Records, QR Codes, and the SIF Checklist
Verifactu is not about the invoice your customer sees. It is about what your billing software does the moment an invoice is created. Royal Decree 1007/2023 defines the technical requirements for every Sistema Informático de Facturación (SIF) used in Spain. If your software fails them, you are the one who pays: up to 50,000 EUR per fiscal year for using a non-compliant system.
What a Compliant SIF Must Do
1. Generate an immutable registration record per invoice
Every invoice issued must produce a registration record (registro de facturación) at the moment of issuance. The record contains the invoice data: issuer, recipient, number, date, amounts, tax breakdown. Once written, the record cannot be altered. Corrections happen through new records, never by editing the original.
2. Chain records with a cryptographic hash
Each registration record incorporates the hash of the previous record. The chain makes tampering detectable: altering any historical record breaks every subsequent hash. This is the same anti-fraud principle used in Portugal's ATCUD and Italy's receipt lottery chains.
3. Guarantee the five properties
RD 1007/2023 names them: integrity, conservation, accessibility, legibility, and traceability (integridad, conservación, accesibilidad, legibilidad, trazabilidad). Records must be stored unaltered, retrievable on demand, human-readable, and traceable end to end.
4. Print a QR code on every invoice
Every invoice must carry a QR code linking to the AEAT verification service. Scanning it lets the customer (or an inspector) verify the invoice against the tax authority's data. The QR requirement applies to the printed or PDF visualisation, including simplified invoices and tickets.
5. Keep an event log
The SIF must log significant system events: startups, shutdowns, errors, configuration changes. The log is part of what an inspector can demand.
6. Support the AEAT query service
Records must be exportable and queryable in the format AEAT specifies. An inspection request is not the moment to discover your export does not work.
Verifactu Mode vs Non-Verifactu Mode
A SIF can operate in two modes:
- Verifactu mode (sending): each registration record is transmitted to AEAT in near real time. Invoices issued in this mode are marked "VERI*FACTU" and are presumed correct before the tax authority.
- Non-Verifactu mode (record only): records are kept locally, chained and immutable, available on demand.
Transmission is optional. Immutability, chaining, and the QR are not.
The Incident Mode
Verifactu includes a formalised incident mode: if connectivity fails, the SIF may continue issuing invoices offline and synchronise the pending records when the connection returns. This distinguishes it from TicketBAI, whose design assumes constant connectivity for real-time transmission to the provincial authority.
Who Must Comply
- All companies (corporate income tax payers) issuing invoices in the common territory of Spain: from 1 January 2027
- Self-employed professionals (IRPF), income-attribution entities, and non-residents with a permanent establishment: from 1 July 2027
- Software vendors: compliant versions had to be available from 29 July 2025
Exempt: taxpayers enrolled in SII (they already report near-real-time), and businesses under TicketBAI in the Basque Country. NaTicket will govern Navarra.
The In-House Software Trap
The obligation covers in-house systems, spreadsheets with invoicing macros, and unmaintained legacy programs. There is no grandfather clause for software your company wrote itself. If you invoice through a ten-year-old internal tool, that tool must be rebuilt or replaced before your deadline. A corporate group sharing one internal system across entities needs one certification strategy, not five parallel fixes.
The Penalties
| Infraction | Fine |
|---|---|
| Using non-compliant invoicing software | Up to 50,000 EUR per fiscal year |
| Software vendor selling non-compliant software | Up to 150,000 EUR per fiscal year and per software type |
Compliance Checklist
- Identify your SIF. Every system that can issue an invoice counts, including the secondary tool nobody remembers.
- Get the vendor's certification status in writing. Certified, on roadmap, or silent. Silence is a decision to migrate.
- Test the QR end to end. Print an invoice, scan the code, verify it resolves against AEAT's service.
- Test the export. Produce the record export an inspector would demand. Check it opens.
- Check the chain. Confirm your software hashes and chains records; ask the vendor how alteration is detected.
- Document the event log. Know where it is and who can read it.
- Decide your mode. Verifactu mode (sending) or record-only. Record-only still requires everything above.
This material is information of a general nature and does not constitute legal or tax advice. For a specific situation, verify the current rules or consult a qualified adviser.