Verifactu for paying companies: what to do when you receive an invoice with a Verifactu QR

Last updated: 13 May 2026. This page is kept current with the official AEAT calendar and the corresponding Royal Decree-Law available in the BOE.

What Verifactu means from the receiver's point of view

Most blogs and advisory content on Verifactu cover a single angle: how to issue a Verifactu invoice, how to certify the invoicing software, how to comply with the vendor regulation (Royal Decree 1007/2023). That narrative is legitimate but leaves uncovered 100% of receivers, which is everyone: any company that receives supplier invoices automatically enters the "passive side" of Verifactu.

From the payer / receiver position, Verifactu is a mechanism that raises the traceability of invoices entering your accounts payable workflow. Each Verifactu invoice arrives with three verifiable elements:

1. A QR code on the visual representation of the invoice (PDF, printed, HTML email).
2. A cryptographic hash that chains that record with the previous one issued by the same supplier. The chaining is done via SHA-256 over the relevant invoice fields + the hash of the previous invoice.
3. A literal "VERIFACTU" mark on the invoice itself (when the issuer chose the AEAT-submission mode, not the "non-verifiable" mode of the same Regulation).

As receiver, your nominal interaction with Verifactu is limited to three potential actions:

• Scan the QR to confirm the invoice exists in AEAT records (when the issuer chose the submitted Verifactu mode).
• Retain the QR and the hash field in your digital invoice archive (the same way you already retain the rest of the invoice: article 165 LIVA + Invoicing Regulation).
• Detect discrepancies between what you scan and what the supplier sent (amount, issuer tax ID, date).

None of these three actions is required for the receiver under Royal Decree 1007/2023 or the corresponding Royal Decree-Law in the BOE. But all three are defensible at audit and deter supplier fraud - the typical case is a supplier that issues a "Verifactu-like" invoice with an apparent QR but never registered the document at the AEAT, leaving you with an invoice the tax authority does not recognize.

Anti-panic. You will not have a tax problem for not validating the QR of your suppliers' invoices in 2026 or 2027. The Verifactu system splits responsibilities: the issuer answers for correct issuance, you answer for booking the corresponding deductible expense. But you will have an operational problem if you discover too late (at close, at audit) that a supplier issued you invalid or duplicate invoices.

What obligations does the payer have legally?

Short answer: strictly, no new obligations stemming from Verifactu. Royal Decree 1007/2023 (Regulation of invoicing IT systems) applies to the issuer and to the vendor of the issuing software. The receiver keeps exactly the same obligations they had before Verifactu:

Receiver obligation	Origin	Changes with Verifactu?
Receive and retain the invoice (paper or electronic) for 4 years	Art. 165 LIVA + Invoicing Regulation RD 1619/2012	No
Verify the invoice meets formal requirements (issuer tax ID, number, date, base, VAT)	Invoicing Regulation	No, but the QR makes verification easier
Keep integrity and legibility of the e-invoice	RD 1619/2012 art. 8 + 21	No, but archiving the QR with the invoice is recommended
Detect duplicates and correctly register in the received-invoices ledger	LIVA + Regulation	No, but the Verifactu hash works as a natural unique key
Report the received invoice in SII (if your company is in SII)	Royal Decree 596/2016	No: SII and Verifactu are parallel systems, not chained

Where there are indirect interactions with Verifactu:

• If your supplier issues Verifactu but the invoice does not appear at the AEAT when validated, you may be looking at an invoice the issuer did not submit correctly. As payer, you are not responsible, but your VAT deduction right is at risk if the tax authority cross-checks data. Best practice: validate on reception, not at close.
• If your supplier issues with "non-verifiable invoice" (the other RD 1007/2023 mode, without real-time submission to the AEAT), you will not be able to scan the QR against the central system. That invoice is still legal, but you lose the instant validation benefit.
• Once mandatory B2B e-invoicing kicks in (Crea y Crece Law, Law 18/2022, still pending its implementing Regulation per the Ministry of Finance's updated calendar), the receiver will have additional obligations: delivery confirmation, payment status, etc. But that is B2B e-invoicing, not Verifactu. They are different systems that coexist - for more depth, read the e-invoice reception 2026 guide.

Summary of the legal framework: Verifactu adds no load on the payer. B2B e-invoicing will. Do not mix the two in your adaptation plan.

How to validate a Verifactu QR step by step

Below is the manual procedure to validate the QR on a received Verifactu invoice. It is designed so a finance team can run it without specialized software; further down you will see how to automate it inside an AP workflow.

1. Identify that the invoice is Verifactu. Look on the received invoice (PDF, HTML email, printed) for two signals: the literal caption "VERIFACTU" or "Invoice verifiable at the AEAT electronic office" (usually near the footer or next to the QR) and a QR code, distinct from the payment QR or the TicketBAI QR (if the issuer is in the Basque Country). The Verifactu QR points to a URL on the aeat.es domain in the AEAT definitive system. If you cannot find those signals, the invoice is not Verifactu: it can be a perfectly valid regular invoice from a supplier that has not joined the system yet.
2. Scan the QR with your phone or reader. Use any standard QR reader (native mobile camera, code-reading app, the document management module of your system). You do not need an official AEAT app; the QR contains a public URL. On scan, the QR redirects to an AEAT site page that shows the cross-referenced invoice data: issuer tax ID, invoice number, date, taxable base and total.
3. Compare the cross-referenced data with the received invoice. On the AEAT page that appears, check one by one: issuer tax ID matches; invoice number matches letter by letter (watch alphanumeric series); issue date matches; total amount matches to the cent. If any of the four fields fails to match, flag the invoice as suspicious and open an incident with the supplier before booking.
4. Confirm the invoice is marked "submitted". The AEAT page indicates whether the invoice has been correctly submitted to the central system. If it appears as "not found" or "pending", contact the supplier: either they use "non-verifiable" mode (legal but not queryable) or there was a communication failure in their invoicing software.
5. Retain the QR with the invoice. Your 4-year retention obligation applies to the entire invoice, including the QR if it is part of the original visual representation. When archiving the invoice in your document manager, do not crop the QR: archive the full PDF or, if you extract data to JSON, keep at least the QR URL and the hash that appears on the invoice.
6. Record the validation result in your system. In your ERP or AP module, add a field (boolean or status) verifactu_validated with one of three values: ok, mismatch, not_submitted. This lets you filter and audit at month-end. With ininvoice or another AP automation tool, this step happens automatically - see the next section.
7. Repeat the control on a sample for non-Verifactu suppliers. For suppliers not yet issuing Verifactu (during the transition), add compensating controls: periodic tax-ID checks in the AEAT register, SII cross-check if applicable, and manual review of high-value invoices. QR validation does not replace the rest of AP controls; it complements them.

How to integrate QR validation into the AP automation workflow

Validating QRs invoice by invoice is viable when you receive 20 invoices a month. With 200, 2,000 or 20,000, the manual process breaks. Good news: QR validation is mechanical - extract the QR from the PDF, fire an HTTP request to the URL, parse the response, compare with the data already extracted by your OCR. Five automatable steps with no human intervention.

A good touchless accounts payable system already runs OCR on the invoice when it arrives in the supplier inbox. Adding Verifactu validation is a natural extension of the same pipeline. In the ininvoice case, the flow is:

1. Capture: the invoice arrives at a unified mailbox (supplier email, upload portal, ERP connectors).
2. OCR + structured extraction: the 12 key fields of the invoice are extracted (issuer, number, date, base, VAT, total, lines, IBAN, etc.).
3. Verifactu detection: the system detects whether the invoice contains a Verifactu QR. If so, it extracts the QR URL.
4. Validation against the AEAT: the system queries the QR URL, parses the response, compares with the OCR data. If everything matches, the invoice is flagged verifactu_ok. If there is a mismatch, an exception is opened.
5. Three-way matching + workflow: the invoice goes to standard three-way matching (PO + delivery note + invoice). A verifactu_ok invoice is a more reliable input for automatic matching.

The real value of integrating Verifactu into AP automation is not "compliance" (the receiver has no obligation) but three concrete operational gains:

• Early detection of suppliers in transition. You know which percentage of your supplier base already issues Verifactu and which does not, and you can prioritize electronic onboarding conversations with the laggards.
• Reduced manual exceptions. An invoice validated against the AEAT is less likely to have capture errors. Your finance team handles only genuine exceptions.
• Audit-ready in real time. When an inspection comes, you do not recompose validation after the fact: you have it recorded on each invoice, with timestamp and outcome.

ininvoice includes Verifactu validation in its standard AP pipeline from the base plan. If you want to see how it integrates with your current ERP and what the real cost is, see our pricing page. You can also see how it fits into the impact of Verifactu on touchless AP with a numerical pipeline example.

2026/2027 calendar for receivers

Verifactu dates changed in late 2025 with the corresponding Royal Decree-Law in the BOE, which delayed entry into force for most of the business sector. The consolidated calendar from the receiver's perspective - that is, when you will start receiving Verifactu-QR invoices from your suppliers based on each supplier's size:

Issuer supplier size	Verifactu issuer obligation date	When will you start receiving Verifactu from them?
Large companies (>6M EUR revenue or in SII)	1 January 2026	From Q1 2026 (some already issue voluntarily since July 2025)
Mid-market (between 6M EUR and SME threshold)	1 July 2026	From Q3 2026 (check the Ministry of Finance's current calendar)
SMEs (other non-SII companies)	1 January 2027	From Q1 2027
Individual freelancers	1 July 2027	From Q3 2027
Exempt companies (no revenue or only relevant exempt operations)	Not applicable	May never issue Verifactu

Sources: Royal Decree 1007/2023 (BOE-A-2023-24840), Ministerial Order HAC/1177/2024 and the corresponding Royal Decree-Law in the BOE, per the Ministry of Finance's updated calendar.

Read for the receiver: throughout 2026 you will receive a mix of Verifactu invoices and traditional invoices. That mix is the worst operational scenario: two parallel circuits coexisting. The recommendation is not to wait for the mix to end in 2027/2028: set up the Verifactu validation circuit now, leave it active for suppliers that already issue, and for the rest the regular OCR flow keeps working with no changes. If your volume is SME-sized, complement this guide with the SME-specific Verifactu reception comparison.

Common mistakes when validating received Verifactu

Patterns that repeat in companies that started processing Verifactu invoices from large suppliers during the first half of 2026.

Mistake 1: validating the QR only at month-end close

Symptom: the finance team piles up invoices during the month and at close tries to validate every QR at once. Mismatches surface late, when there is no margin to ask the supplier for correction.

Fix: validate on reception. QR validation costs 200 ms; integrating it at capture time has no operational impact.

Mistake 2: confusing the Verifactu QR with a TicketBAI QR

Symptom: a Basque Country supplier issues under TicketBAI and the team tries to validate against the AEAT central system. Validation always fails because TicketBAI has its own system (BATUZ).

Fix: the detector must distinguish by URL domain. TicketBAI points to bizkaia.eus, gipuzkoa.eus or araba.eus. Verifactu points to aeat.es.

Mistake 3: rejecting invoices without QR as "invalid"

Symptom: an invoice without a Verifactu QR is treated as defective. Returned to the supplier. Unnecessary friction.

Fix: until 2027/2028 many legitimate suppliers will not issue Verifactu. The absence of a QR is not a defect. It is only relevant if the supplier has confirmed they are already on Verifactu and still issues without QR: then ask for correction.

Mistake 4: archiving the invoice without the QR

Symptom: OCR extracts the data to JSON and discards the original PDF. Months later, at an inspection, there is no way to revalidate.

Fix: always archive the original PDF together with the extracted data. 4-year retention, like any invoice.

Mistake 5: treating Verifactu as a substitute for three-way matching

Symptom: the finance team assumes "Verifactu invoice = correct invoice" and lowers the rigor of PO and delivery note control.

Fix: Verifactu certifies valid issuance, not correct amount. An invoice can be perfectly Verifactu and still be duplicated, wrongly billed or not match what was delivered. Three-way matching remains the control that catches price or quantity variance: Verifactu is an upstream layer, not a substitute.

Mistake 6: regulatory panic at 2025 close

Symptom: AP teams hold payments to suppliers that "have not implemented Verifactu" believing it was in force from 2025.

Fix: Verifactu issuer mode was not mandatory in 2025 for anyone. The obligation starts in tiers from 2026. Any invoice received before 1 January 2026 without Verifactu is fully valid and should be processed normally.

FAQ

Is the receiver of a Verifactu invoice required to validate the QR?

No. Royal Decree 1007/2023 and the corresponding Royal Decree-Law in the BOE place obligations on the issuer and on the invoicing software vendor, not on the receiver. Validating the QR is best practice for traceability and early detection of supplier errors, but it is not legally required.

What if I receive a Verifactu invoice whose QR does not validate against the AEAT?

The invoice is still formally valid if it meets the Invoicing Regulation requirements (tax ID, number, date, base, VAT). A QR that does not validate indicates the issuer did not correctly submit the record to the AEAT - it is the issuer's problem, not yours. Best practice: notify the supplier to regularize and retain the invoice as received. Your VAT deduction right is not lost because of an issuer submission failure.

Does Verifactu replace SII?

No. Verifactu and SII are parallel systems. SII is the immediate information supply on VAT ledgers and applies to large companies (>6M EUR) and voluntaries. Verifactu is the verifiable invoicing system. A company can be subject to both, only one, or neither depending on size and activity.

How do you tell a Verifactu QR from a TicketBAI QR?

By the URL domain. Verifactu points to aeat.es (national electronic office). TicketBAI points to bizkaia.eus, gipuzkoa.eus or araba.eus depending on the Basque historical territory. They look identical (square QR codes), functionally equivalent, but the central systems are different.

Do I have to retain the Verifactu QR for 4 years?

Yes, as an integral part of the invoice. The 4-year retention obligation (art. 165 LIVA + RD 1619/2012) applies to the full visual representation. If you archive as PDF, do not crop the QR. If you extract to JSON, keep the QR URL and hash.

What if my supplier issues under "non-verifiable invoice" (non-Verifactu mode)?

It is fully legal. RD 1007/2023 contemplates two modes: Verifactu (with AEAT submission) and non-verifiable (no submission, but with the same cryptographic integrity and immutability requirements). Under non-verifiable mode you cannot scan the QR against the central system, but the invoice is still valid. As receiver, archive normally.

Does Verifactu QR validation work offline?

No. Validation requires querying the AEAT electronic office in real time. With no connection, you cannot validate. This is expected: the value of validation lies in matching against the central record that lives at the AEAT.

Can ininvoice validate the Verifactu QR automatically on every invoice I receive?

Yes. ininvoice integrates Verifactu QR detection and validation against the AEAT as a standard part of the invoice capture and extraction pipeline. Every invoice enters the system, is OCR-ed, the Verifactu QR is detected, validated against the AEAT, compared with the OCR data, and the result is flagged. The finance team only handles exceptions, not the 95% of invoices that validate clean. See pricing or read how it fits into a touchless AP flow.

Next steps for your receiving company

Three concrete actions you can start this week, in order of impact:

1. Inventory your suppliers by size. Identify which will start issuing Verifactu in 2026 (large, >6M EUR) and which will wait until 2027 (SMEs). That segmentation tells you what percentage of your monthly volume will arrive with a Verifactu QR this year.
2. Decide on the validation mode: manual (the 7-step procedure above, viable up to ~50 invoices/month), or automated (integrated in your AP system). The decision is not ideological, it is cost/finance-hour.
3. Adjust your digital archive. Verify that your document manager retains full PDFs with the QR, not just extracted data. If you work with a system that crops or normalizes the PDF, ask them to keep the original version.

If you want to see how the Verifactu QR validation looks in a real AP workflow, read the e-invoice reception 2026 guide, review the SME-specific Verifactu reception comparison, or dig into the impact of Verifactu on touchless AP.

Official sources

• Royal Decree 1007/2023, of 5 December, approving the Regulation that establishes the requirements for invoicing IT systems and programs. BOE-A-2023-24840.
• Royal Decree-Law deferring Verifactu: check the corresponding Royal Decree-Law in the BOE.
• Ministerial Order HAC/1177/2024, developing Verifactu technical specifications (check the Ministry of Finance's updated calendar).
• AEAT electronic office: invoicing IT systems and Verifactu: sede.agenciatributaria.gob.es.
• Law 18/2022, "Crea y Crece" (B2B e-invoicing, independent of Verifactu): BOE-A-2022-15818.