Spain: Three months left until VeriFactu/SIF becomes mandatory for corporate income taxpayers

From 1 January 2027, VeriFactu becomes mandatory for corporate income taxpayers in most of Spain, while the Basque Country keeps its own TicketBAI system. The two models differ in signature, chaining, invoice markings and data, and the taxpayer's tax domicile decides which one applies.

With three months left until 1 January 2027, Spain is about to have two fully operational fiscalization models running side by side. In the common tax territory, administered by the State Tax Agency (AEAT), invoicing software must comply with the requirements for invoicing computer systems (SIF), commonly known as VeriFactu. In the Basque Country, the provincial treasuries of Álava, Gipuzkoa and Bizkaia have required TicketBAI for several years. Both aim to make invoice records tamper-evident, but technically they differ.

Deadlines confirmed: 2027 for the common territory

According to the AEAT information note on the extension of deadlines (updated 26 March 2026) and the VeriFactu FAQ (updated 22 July 2026), the obligation applies:

• from 1 January 2027 to corporate income taxpayers (Impuesto sobre Sociedades);
• from 1 July 2027 to all other taxpayers in scope: self-employed persons (IRPF), non-residents with a permanent establishment (IRNR) and entities under the income attribution regime.

The legal basis is Article 29.2.j of the General Tax Law (Ley 58/2003), implemented by Royal Decree 1007/2023 (RRSIF) and the technical specifications in Order HAC/1177/2024. The original deadlines were extended first by Royal Decree 254/2025 and then by Royal Decree-law 15/2025, which moved them to 2027.

A taxpayer is in scope if it does not issue invoices exclusively by hand, is not registered in the SII system, is not tax-domiciled in the Basque Country or Navarra, and has no exemption decision. The Canary Islands, Ceuta and Melilla are in scope, with IGIC and IPSI reported in place of VAT.

What a VeriFactu system must do

For each invoice, the system creates a registration record (RegistroAlta), and for each cancellation a cancellation record (RegistroAnulacion). Records are chained with a SHA-256 hash (huella): each record carries the hash of the previous one. The invoice must show a QR code of 30–40 mm on the first page, labelled "QR tributario:". The QR code encodes a URL with the issuer's tax ID, invoice series and number, date and amount.

Systems operate in one of two modes. The taxpayer chooses the mode, but software must support VeriFactu mode:

•  VERI*FACTU mode: records are sent to AEAT in real time via SOAP web service, in batches of up to 1,000 records. AEAT controls the sending pace. No electronic signature of records is required, and the invoice carries the phrase "VERI*FACTU" or "Factura verificable en la sede electrónica de la AEAT".
• NO VERI*FACTU mode: records are stored and sent only at AEAT's request. Each record must be signed with XAdES, and the system must keep an event log with a summary record at least every six hours.

There is no software certification. Instead, the software producer issues a responsible declaration (Declaración Responsable) for each version of the system.

The Basque Country: already fiscalized

In the Basque Country, TicketBAI has been mandatory in Álava since 2022 and in Gipuzkoa since its phased introduction in 2022–2023. In both provinces, the invoice file is sent immediately after the invoice is issued. Bizkaia applies TicketBAI within its broader Batuz system, which also includes the electronic ledger of operations (LROE). According to the official Batuz FAQ, large companies have been obliged since 1 January 2024. SMEs and self-employed persons joined in six-month windows: 1 July 2024, 1 January 2025, 1 July 2025 and 1 January 2026. Since 1 January 2026, Batuz has been mandatory for all taxpayers in Bizkaia.

Batuz has also announced a technical change: on 24 November 2026, the SSL/TLS certificate chain on the TicketBAI servers will change.

Two models, different technical requirements

The main technical differences are:

• Signature: TicketBAI always requires an XAdES signature. VeriFactu requires one only in NO VERI*FACTU mode.
• Chaining: TicketBAI chains invoices using the first 100 characters of the previous signature value. VeriFactu uses a 64-character SHA-256 hash.
• Invoice markings: TicketBAI requires a 39-character TBAI identifier and a QR code. VeriFactu requires only a QR code.
• Data content: TicketBAI requires invoice line details (quantity, unit price, discounts). VeriFactu requires only the tax breakdown (Desglose).
• Certificates and registration: TicketBAI requires a certificate per device, a code-signing certificate for the software and registration in the developer register. VeriFactu does not.

Which regime applies?

The applicable system depends on the taxpayer's tax domicile and on the rules for allocating tax administration between the State and the Basque provinces (including turnover thresholds), not on where the store or point of sale is located. Navarra, which also has its own foral tax regime, is outside the scope of VeriFactu.

In our view

For businesses operating across Spain, 2027 will not bring a single national standard. A retailer with stores in Madrid and Bilbao may fall under one regime or the other depending on its tax domicile, and the difference goes beyond configuration. Signing, chaining, receipt layout and the level of invoice detail all differ, so supporting both models means two distinct implementations. Also, unlike TicketBAI, VeriFactu has no certification step: compliance rests on the producer's own responsible declaration.

What should businesses do?

Taxpayers in the common territory, especially corporate income taxpayers, should treat the next three months as their final preparation window. In practice:

• Confirm, based on tax domicile, whether VeriFactu or TicketBAI applies to each legal entity.
• Check with software providers that the system supports VERI*FACTU mode and obtain their Declaración Responsable.
• Decide which mode (VERI*FACTU or NO VERI*FACTU) to use and plan for its requirements.
• Update invoice and receipt layouts to include the QR code and, where applicable, the VERI*FACTU phrase.
• Use the current voluntary period to test record submission with AEAT.
• For TicketBAI users: check with technical teams whether the SSL/TLS chain change on 24 November 2026 affects connections, in particular where certificates are pinned.

This article is based on information published by the State Tax Agency (AEAT information note on the extension of deadlines and VeriFactu FAQ) and by the Provincial Treasury of Bizkaia (Batuz FAQ and announcements on batuz.eus). Source Source Source

Aleksandra Vukić, Business Analyst at Fiscal Solutions

Linkedin profile