Verifactu from the receiver side: what happens when your suppliers start issuing

What Verifactu is and why it matters to the receiver

Verifactu is the Spanish tax authority's invoicing-software control system, regulated by Royal Decree 1007/2023 and developed by ministerial order. The stated goal is to prevent tax fraud by requiring every invoice issued by software to be recorded with integrity, traceability and, in its main mode, immediate submission to the AEAT.

For the issuer, Verifactu imposes three technical obligations on the software:

• Each invoice generates an electronic record with a SHA-256 cryptographic hash that chains it with the previous one.
• Each printed or PDF invoice carries a QR code that lets the recipient verify its existence at the AEAT.
• If the issuer picks the Verifactu mode (immediate submission), the record is transmitted to the AEAT in near-real time.

For the receiver (i.e. your SME, once your suppliers start) the practical consequences are three:

1. The invoices you receive will carry a QR at the header or footer. That QR is a direct bridge to the AEAT.
2. You can validate that the invoice is actually issued and registered, not fabricated by a dodgy supplier.
3. The invoice number can no longer be skipped arbitrarily: the hash chain locks it down.

The market gap is that almost no one in Spain is talking about how to use this information from the receiver side. And that is where it shows the most.

Real calendar (Royal Decree 1007/2023)

The updated calendar after the 2024 and 2025 amendments:

Who issues	Mandatory from
Companies subject to Corporate Income Tax	1 January 2027
Freelancers and other obligated parties	1 July 2027

Dates may be adjusted by ministerial order. Verify the applicable calendar for your case with your tax adviser. The AEAT publishes rollout updates on its electronic office.

Practical read: if your company is a corporation and you work with corporations as suppliers, in January 2027 most of your received invoices will carry a Verifactu QR. Before that, some large companies are likely to adopt Verifactu voluntarily to differentiate themselves.

The two modes: Verifactu vs No Verifactu

RD 1007/2023 allows two compliance paths:

Verifactu mode (immediate submission)

The software submits every invoice record to the AEAT electronic office at the moment it is issued. The invoice is validated instantly. This is the option the AEAT incentivizes: it simplifies compliance, reduces audits and removes the need to keep local records.

No Verifactu mode (local custody)

The software does not send to the AEAT in real time but guarantees integrity and immutability of the records. It stores them with a chained hash and they are handed to the AEAT only on inspection. It complies with the law but requires more local infrastructure on the issuer side.

As a receiver, the difference is:

• If your supplier is on Verifactu mode, the invoice QR takes you to the AEAT and you verify live.
• If on No Verifactu, the QR tells you the system complies, but real-time AEAT verification does not apply.

In practice, most SMEs and freelancers will pick Verifactu mode because it has the lowest operational friction.

What information you will receive from your suppliers

An invoice issued under Verifactu reaches you with extra elements compared to a traditional invoice:

• QR code. Visible at header or footer. It encodes a URL to the AEAT electronic office with unique identifiers of the record.
• Record identifier. A unique code assigned by the invoicing system when registering the invoice.
• Cryptographic hash. SHA-256 derived from the invoice content and chained to the previous one. Lets you detect tampering.
• Verifactu or No Verifactu mark. Indicates the mode under which it was issued.

If the invoice is also a mandatory B2B e-invoice (Royal Decree 238/2026), the structured XML will contain those same data in formal fields. Here we explain how to process B2B e-invoice reception.

How to validate the integrity of a Verifactu invoice you receive

The QR is the receiver's key tool. Three practical uses:

1. Verify the existence of the record

Scanning the QR (mobile or reader) opens the AEAT electronic office with the public consultation of the record. If the invoice was issued correctly, it comes back validated. If the QR points to a non-existent record, bad sign.

2. Compare QR data with visible invoice data

The QR encodes the critical fields: issuer tax ID, invoice number, date, amounts. If what the QR shows does not match what the paper or PDF shows, someone has tampered with one of the two.

3. Verify the hash chain

Each invoice's hash is calculated from the previous invoice's hash. This blocks the insertion of fake invoices into the stream. Validating it programmatically requires access to the issuer's record chain, but the system already guarantees integrity by design.

For an SME, the biggest immediate value is the first point: being able to verify with a single scan that the invoice is real. This reduces two classic risks: phantom invoices from fictitious suppliers and duplicate invoices from real suppliers with skipped numbers.

Verifactu vs mandatory e-invoicing: NOT the same thing

This confusion is the most widespread. The two regulations apply in parallel and complementarily, but they regulate different things.

Question	Verifactu	Mandatory B2B e-invoicing
What it regulates	The invoicing software: how it records, retains and reports	The format and channel of the invoice: structured XML through an accredited platform
Underlying rule	Royal Decree 1007/2023	Royal Decree 238/2026 (develops Law 18/2022 "Crea y Crece")
Timeline	1 Jan 2027 companies · 1 Jul 2027 freelancers	Sept 2026 issuers >8M EUR · Sept 2027 everyone else
What you receive as recipient	Invoice with QR, hash, AEAT record (if Verifactu mode)	Invoice in structured XML: Factur-X, UBL, CII or FacturaE 3.2.x

One invoice can comply with both regulations at the same time. An invoice issued in FacturaE 3.2.x format (mandatory e-invoicing) can also contain the Verifactu block with QR, hash and AEAT record identifier. This is what will happen in practice with almost every supplier subject to both.

How Verifactu fits with your three-way matching

Verifactu adds a validation layer on top of the three-way matching flow:

1. Source validation. The QR confirms the invoice is registered at the AEAT. If your AP system verifies it automatically on reception, you discard phantom invoices before matching even begins.
2. Data immutability. The cryptographic hash makes it unfeasible to tamper with an invoice already issued. What you receive is what was registered.
3. Audit traceability. If SII audits you, Verifactu gives you additional proof that the invoice is intact and official.

Line-by-line reconciliation against PO and delivery note remains just as necessary. Verifactu validates the integrity of the invoice, not that quantities and prices match your commercial agreement. Three-way matching is still what detects overpayments, errors and real discrepancies.

How ininvoice automates Verifactu reception

When your suppliers start to issue under Verifactu, ininvoice does this:

1. Detection of the Verifactu block in the received invoice (PDF, FacturaE, Factur-X, UBL or CII).
2. QR reading and extraction of the record identifier, hash and AEAT URL.
3. Optional verification against the AEAT to confirm the invoice is registered.
4. Cross-checking the QR data with the visible invoice data to detect tampering.
5. Standard three-way matching against the PO and the delivery note, line by line, pre-tax.
6. Risk score enriched with the Verifactu signal: invoices with a valid QR weight less in the score, invoices without an expected QR or with a broken QR weight more.

Common receiver-side mistakes with Verifactu

What goes wrong most often when an SME starts to receive Verifactu invoices without a ready system:

• Ignoring the QR. The most common. The invoice is treated as a regular PDF and the QR is decoration. You lose the free verification.
• Confusing Verifactu with e-invoicing. Different things. An invoice can be Verifactu and still be a PDF. Mandatory e-invoicing is a separate layer.
• Assuming your ERP handles it. Most ERPs do not yet automatically validate the Verifactu QR on received invoices.
• Not updating your system before 2027. When your suppliers start issuing Verifactu, your system has to be ready to read the extra block.

Frequently asked questions

When will my suppliers start to issue under Verifactu?

Companies subject to Corporate Income Tax from 1 January 2027. Freelancers from 1 July 2027. Some large companies may adopt it earlier voluntarily.

What changes for my SME when I receive Verifactu invoices?

Invoices will carry a QR code, a record identifier and a cryptographic hash. You can verify they are registered at the AEAT and detect tampering. The reconciliation with your PO and delivery note remains the same.

Is it the same as mandatory e-invoicing?

No. Verifactu regulates the invoicing software. Mandatory B2B e-invoicing regulates the format and transmission channel. They coexist and many invoices will comply with both at the same time.

Can I verify the QR myself without software?

Yes, by scanning with any QR reader. It takes you to the AEAT electronic office with the verification result. Useful occasionally, but verifying 500 invoices a month by hand does not scale.

What happens if an invoice does not carry a QR when it should?

A red flag. It means the supplier is not using Verifactu-compliant software despite being obligated. Ask them to regularize before paying.

How much does automating Verifactu reception with ininvoice cost?

Plan: 249 EUR per month up to 300 invoices/month. No implementation fee, no commitment, instant activation. See full pricing.