Verifactu — Spanish Billing Software Regulation

"Verifactu" is the official nickname of the Reglamento de los Sistemas Informaticos de Facturacion: a national regime that compels every billing software running in Spain to chain its invoices with SHA-256 hashes and to print a public verification QR code. It extends the Basque TicketBAI experiment to the whole Spanish territory.

Legal framework and scope

Verifactu is not an e-invoicing mandate per se: it is a mandate on the billing software itself. Real Decreto 1007/2023 transposes into Spanish law the anti-fraud spirit of EU directive DAC 7 and AEAT's national strategy against off-the-books invoicing.

• Real Decreto 1007/2023 (5 December 2023) — founding text, sets scope and principles (chaining, integrity, traceability, accessibility). Published in BOE n. 291 of 6 December 2023.
• Orden HAC/1177/2024 (17 October 2024) — implementing order: detailed technical specifications (XML format, XSD schema, hashing algorithm, QR contents, AEAT SOAP web service). Published in BOE n. 254 of 22 October 2024.
• EU Regulation 904/2010 art. 13 — European basis for VAT administrative cooperation, justifying Verifactu data sharing with foreign tax authorities through VIES.

Technical architecture: hash chain and QR

Every invoice issued by a Verifactu-compliant software must produce two cryptographic artefacts: a huella (SHA-256 hash, 64 hexadecimal characters) and a public-verification QR code.

The huella of an invoice is computed by concatenating its canonical fields (issuer NIF, serial number, issue date, invoice type, total amount) with the huella of the previous invoice in the same series. This unbroken chain makes the deletion or modification of any intermediate invoice detectable at inspection.

# Computing the Verifactu invoice hash (Orden HAC/1177/2024 excerpt)
# Concatenate the canonical fields + previous hash + timestamp
huella = SHA-256(
  IssuerTaxId +
  InvoiceSerialNumber +
  IssueDate +
  InvoiceType +
  TotalAmount +
  PreviousRecordHash +     # hash of the previous invoice in the series
  RecordGenerationDateTime
)

# Encoding: uppercase hex, 64 characters
# XML field: <Huella>9C1185A5C5E9FC54612808977EE8F548B2258D31AABBCCDDEEFF...0042</Huella>

# First invoice in a series:
PreviousRecordHash = ""   # empty string at chain initialisation
huella_001 = SHA-256("B12345678" + "F-2026-0001" + "2026-07-15" + "F1" + "1210.00" + "" + "2026-07-15T09:32:14+02:00")

The QR code, in turn, encodes the AEAT public verification URL. Any customer (or tax inspector) can scan the QR and obtain the invoice status from AEAT: present / absent / cancelled. This mechanism makes double-bookkeeping fraud virtually impossible.

# Verifactu QR specification (Orden HAC/1177/2024 annex II)
# Public AEAT verification URL encoded in the QR
https://prewww2.aeat.es/wlpl/TIKE-CONT/ValidarQR
  ?nif=B12345678
  &numserie=F-2026-0001
  &fecha=15-07-2026
  &importe=1210.00

# Graphic requirements:
#  - QR version: 1 to 10 (auto-fit to content)
#  - Error correction: level M (15%)
#  - Minimum print size: 30 x 30 mm
#  - Visible caption below the QR: "VERI*FACTU"
#  - Position: invoice footer, on every copy (paper + electronic)

AEAT web service and operating modes

Orden HAC/1177/2024 defines two operating modes, mutually exclusive per invoice series:

1. VERI*FACTU mode — every invoice is submitted to AEAT in near-real time through the SOAP web service RegFactuSistemaFacturacion. AEAT stores the record, and the QR points directly to the AEAT lookup endpoint. The "VERI*FACTU" caption appears on the printed invoice.
2. No VERI*FACTU mode — invoices are kept locally in a tamper-evident register for 4 years (statute of limitations period). AEAT can subpoena the register during an audit. The QR points to the verification URL but AEAT answers "not registered": the customer must then contact the issuer. This mode is reserved for SMBs that do not want systematic transmission.

POST /wlpl/SUMI-CONT/RegFactSistInf HTTP/1.1
Host: www1.agenciatributaria.gob.es
Content-Type: application/soap+xml; charset=utf-8
SOAPAction: ""

<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
                  xmlns:sum="https://www2.agenciatributaria.gob.es/static_files/common/internet/dep/aplicaciones/es/aeat/tike/cont/ws/SuministroInformacion.xsd">
  <soapenv:Header/>
  <soapenv:Body>
    <sum:RegFactuSistemaFacturacion>
      <sum:Cabecera>
        <sum:ObligadoEmision>
          <sum:NombreRazon>Atelier Iberica SL</sum:NombreRazon>
          <sum:NIF>B12345678</sum:NIF>
        </sum:ObligadoEmision>
      </sum:Cabecera>
      <sum:RegistroFactura>
        <sum:RegistroAlta>
          <sum:IDFactura>
            <sum:IDEmisorFactura>B12345678</sum:IDEmisorFactura>
            <sum:NumSerieFactura>F-2026-0001</sum:NumSerieFactura>
            <sum:FechaExpedicionFactura>15-07-2026</sum:FechaExpedicionFactura>
          </sum:IDFactura>
          <sum:TipoFactura>F1</sum:TipoFactura>
          <sum:ImporteTotal>1210.00</sum:ImporteTotal>
          <sum:Huella>9C1185A5C5E9FC54...</sum:Huella>
          <sum:HuellaRegistroAnterior></sum:HuellaRegistroAnterior>
          <sum:FechaHoraHusoGenRegistro>2026-07-15T09:32:14+02:00</sum:FechaHoraHusoGenRegistro>
        </sum:RegistroAlta>
      </sum:RegistroFactura>
    </sum:RegFactuSistemaFacturacion>
  </soapenv:Body>
</soapenv:Envelope>

2025-2026 rollout timeline

The definitive timeline was set by the implementing decree published in the BOE in February 2025, after two successive postponements. It rolls out in two waves:

Taxpayers already enrolled in SII (Suministro Inmediato de Informacion — large taxpayers and VAT groups since 1 July 2017) are exempt from Verifactu: their reporting continues through SII, which is more detailed.

Coexistence with TicketBAI and SII

Three regimes coexist in Spain for invoice traceability, depending on the taxpayer and the territory:

• TicketBAI (Basque Country: Bizkaia, Gipuzkoa, Araba) — foral regime, universal since 1 January 2024. Same principle of hash chaining and QR, but competent authority is local (Hacienda Foral). Basque taxpayers remain under TicketBAI, not Verifactu.
• SII (Suministro Inmediato de Informacion) — national regime for large taxpayers (annual turnover > EUR 6.01 M), VAT groups, special regimes. VAT books submitted within 4 days. Exempt from Verifactu.
• Verifactu — national regime for everyone else (SMBs, liberal professions, self-employed individuals).

A Spanish group can therefore fall simultaneously under SII (for its nationwide large-account operations) AND TicketBAI (for its Basque Country operations) without ever using Verifactu — which only applies to non-SII activities outside foral territories.

Penalties and evidentiary regime

Real Decreto 1007/2023 art. 7 and Spain's General Tax Law (LGT) art. 201 bis ground a dedicated penalty regime:

• Non-compliant software: the vendor faces a penalty of EUR 150,000 per calendar year per non-compliant function (missing chaining, missing QR, missing web service). Administrative penalty, repeated each year.
• User (taxpayer): issuing an invoice without QR or chaining triggers a penalty of EUR 50,000 per fiscal year, plus potential reclassification as tax fraud (criminal offence) on recurrence.
• Register tampering: altering or erasing an already generated huella constitutes forgery and may lead to criminal prosecution under article 305 of the Spanish Penal Code.

Cross-links

• Spain hub — full e-invoicing mandate overview
• Law 18/2022 Crea y Crece — B2B Facturae XML mandate
• TicketBAI — Basque foral territories
• SII — large taxpayer near-real-time reporting
• Facturae — Spanish XML format, XAdES signature
• Real Decreto 1007/2023 (BOE)
• Orden HAC/1177/2024 (BOE)
• AEAT — Verifactu portal