Spain's tax agency rolls out mandatory QR codes on invoices from July 2025

New European invoicing rules will require invoicing software to include a QR code so customers can check whether an invoice has been reported to the AEAT (Spain's tax agency). Systems must be ready by 1 July 2025, and reporting by the recipient will be voluntary.

## What the European invoicing regulation changes

The **European Union** is pressing ahead with legislation against late payments with a regulation that will require payment within a maximum of **30 days**. The idea is to tackle one of the problems that most squeezes small and medium-sized businesses, which in Spain account for more than **90%** of the business fabric. For many small businesses, getting paid late is not an administrative nuisance: it is the difference between staying open or closing for lack of liquidity. The European package does not stop at payment deadlines. The European invoicing regulation is also coming, seeking to ensure that the software used to issue invoices includes a QR code. Through that code, the customer will be able to verify whether the invoice is properly accounted for, whether the company meets its obligations with the tax authorities, and whether the transaction has been correctly reported to the **Tax Agency**.

The detail matters. This is not about the tax authorities spying on every loaf-of-bread receipt in real time, at least not under this rule. What is being established is a verification system: the issuer reports the invoice to the AEAT and the recipient can check that the report has been made. The measure is based on Royal Decree 1007/2023 of 5 December, which approves the regulation setting out the requirements that the computer or electronic systems and programs supporting the invoicing processes of businesses and professionals must meet. That text also standardises the formats of invoicing records. The AEAT may use the information provided in exercising its powers in the application of taxes. The legal mechanism is greyer and more bureaucratic than it sounds.

There is wariness in tax advisory circles and taxpayer associations. And not without reason: any change that brings day-to-day invoicing closer to the Tax Agency raises suspicions. The key difference is that reporting by the recipient will be voluntary. The customer, whether a business or a final consumer, may voluntarily provide the data contained in the QR code to the AEAT using a device capable of reading and transmitting it. The tax authorities will use that information to act as appropriate. If the invoice includes the phrase "Factura verificable en la sede electrónica de la Aeat" or "Veri*Factu", the reporting will make it possible to verify that the invoice received has been sent to the AEAT by its issuer. In other words, the system does not force the customer to snitch: it gives them a tool to check.

## The QR is not decoration: what data it carries and who can read it

The QR code will have specific specifications. The invoice, whether printed on paper or a digital image, must include a QR code. On invoices issued by Veri*Factu systems, the phrase "Factura verificable en la sede electrónica de la Aeat" or "Veri*Factu" must appear, in a clearly visible typeface, similar to that of the other data. If the invoice is issued in digital format with an image equivalent to the printed format and sent by electronic means, the text of the encoded URL must be included next to the QR code. That URL must be a hyperlink: when tapped on an electronic device, it must open the indicated destination. On electronic invoices not intended for printing but for exchange between computer systems, the URL contained in the QR code will be included as a separate field, so it will not be necessary to include the code itself.

The code will measure between **30x30 and 40x40 millimetres** and trinc the **ISO/IEC 18004** standard. Level M error correction will be used to generate it, offering **15%** character recovery. It will include the URL of the verification or reporting service used by the recipient, invoice information that will form part of the URL, the NIF (tax ID) of the party obliged to issue it, the serial number and invoice number, the date of issue and the total amount. The detailed format of that URL may differ depending on whether the system issuing the invoice and generating the QR is a Veri*Factu system or not. The encoding and format will be specified in a technical document to be published on the AEAT's electronic office. All of this is in the draft Ministerial Order that develops the technical and functional specifications, a text the finance ministry is finalising and which is in the public consultation phase.

That level of detail explains why this is not just a sticker. The QR does not carry the company's entire books. It carries the basic data of the transaction and a URL that allows it to be cross-checked. But those basic data are enough for a customer—or the AEAT itself if the customer forwards them—to check whether the issuer has complied. Verification relies on the invoice's digital fingerprint, not on an on-site inspection. For a self-employed worker, the practical change is that their invoicing software will have to generate that QR and that their invoices will have to be consistent with what is reported. For the customer, the change is having a mechanism to know whether the paper or PDF in hand matches what the tax authorities have received.

## Veri*Factu, double bookkeeping and the end of software for hiding data

The rules are not only targeting late payment. They also aim to close the door to double bookkeeping. The ultimate purpose of the new formal tax obligation is to prevent or hinder the manufacture, production, import and possession of computer systems and programs that allow accounting, invoicing or management data to be manipulated or hidden from the tax authorities. Article 29.2.j) of the **General Tax Law** has incorporated that obligation: the producers, distributors and users of computer or electronic accounting, invoicing or management systems used by those carrying out economic activities must guarantee the integrity, preservation, accessibility, legibility, traceability and unalterability of the records. Omissions or alterations without a corresponding record cannot be allowed. Systems must be duly certified and use standard formats for legibility.

The fine print adds an interesting rule for shared programs. A single invoicing system can support two or more taxpayers, but it must behave as if they were separate computer systems for each taxpayer. It will have to manage the invoicing records and, where applicable, events of each taxpayer separately. It will have to generate independent chains of invoicing records for each of them and allow operation as a **Veri*Factu** system independently for each taxpayer. On connected terminals from which invoicing or administration can be carried out, the total number of taxpayers it manages must be clearly displayed at all times, as well as the identification of the taxpayer to whom the current operation corresponds.

The integrity and unalterability of the records are guaranteed by two technical mechanisms. Each invoicing record generated by the system must calculate its own fingerprint or **hash** and electronically sign all the individual records generated. This allows on-demand verification quickly and easily. The system must also sign the invoicing it generates and check its correctness. When it detects a circumstance that prevents—or could breach—the integrity and unalterability of the records, or of their chaining, it must display a visible alarm on all connected terminals from which invoicing or administration can be carried out. The alarm must not be deactivated until integrity is guaranteed again. In other words: the software will have to warn if someone tries to tamper with it.

## Deadlines, census forms and the email for the courts

The invoicing systems of all companies must be ready to start invoicing under the new requirements from **1 July 2025**. They can do so through private paid production systems duly accredited by the AEAT or with the application that the Agency itself will launch. The AEAT acknowledges in the Regulatory Analysis Memorandum of the Order that, in addition to preventing tax fraud, the new measures aim to foster the technological development of the business fabric, which is highly atomised. More than **3.6 million self-employed workers and SMEs** file VAT compared with just **30,000 large companies**. The vast majority do not carry out complex operations requiring all the information of the Immediate Information Supply system (SII). With the basic information contained in their invoicing documents, received automatically, the AEAT hopes to advance simplification through its own software application.

The stated goal is to address the fact that small business size comes with a technology deficit that hinders the professionalisation of management. According to the AEAT, this hampers business growth, job creation, innovation, expansion abroad and compliance with administrative obligations. Also the justification of investments and expenses linked to receiving public aid. It is a technological argument, not just a revenue one. The AEAT's application is intended to be an alternative for those who do not want to or cannot pay for an accredited private system. It remains to be seen whether that development arrives on time and whether it can handle the invoice volume of millions of small taxpayers.

In parallel, the email address for receiving communications from the AEAT will also be used by the economic-administrative courts (TEA). On 1 January, a ministerial order from the finance ministry came into force amending the section on telephone and email data for receiving notices from the Tax Agency. From 1 February it will include authorisation for that data to be used by the TEA as well. Order HFP/1397/2023 of 26 December, published on 29 December 2023, introduces amendments to the census forms 030, 036 and 037. Those amendments will apply for the first time to filings made from 1 February 2024. In those forms, the wording and notice of the telephone and electronic address section for receiving AEAT notices is amended. Providing the telephone number and email address implies granting authorisation for them to be used for purely informational notices, not only by the AEAT but also by the economic-administrative bodies provided for in sections 2 and 3 of Article 228 of the General Tax Law.

Amendments are also introduced to the informational forms 289, 345 and 390, applicable to filings relating to 2023. In the procedure and conditions for direct debit of payment of certain debts through the credit institutions that provide the collaboration service in the AEAT's collection management, direct debit is extended to accounts held at a non-collaborating entity belonging to the Single Euro Payments Area, the SEPA zone. It will apply to direct debits of self-assessments filed from 1 February 2024. In form 390, the amendment stems from the need to allow the different "recargo de equivalencia" rates in force in 2023 to be entered. These are technical changes, but they affect the daily life of advisers and small business owners.

The full picture is this: the EU wants 30-day payments and QR-coded invoicing; Spain is developing the regulation and the technical order; the AEAT will have more information and the recipient will be able to cross-check it; software will have to certify it cannot be tampered with; and the deadlines fall between 1 February 2024 and 1 July 2025. Those with simple invoicing will notice the change mainly in the software. Those with an old or unaccredited system will have to upgrade it. And anyone who thought an invoice was just a piece of paper for getting paid will have to get used to that paper carrying a code that talks to the tax authorities. As with any measure touching money and legal obligations, it is advisable to check the specific case with a tax adviser before making decisions.