Holded and Verifactu: how to receive QR-Verifactu invoices in your Holded

If you run Holded as your ERP, accounting and billing are already covered. What changes with Verifactu going into production is not what you issue: it's what you receive. More and more suppliers are sending you invoices with a Verifactu QR, which opens three new questions in the AP flow.

First: does the QR on that invoice match what AEAT says? Second: is the incoming hash the first occurrence or has it landed before? Third: do the lines the supplier is claiming match your PO and delivery note?

This article explains how a Verifactu invoice shows up in Holded, what the ERP solves by design and where an upstream layer like ininvoice fits in to close three-way matching, duplicate and tax checks.

What is Verifactu and why is there a QR on your received invoices?

Verifactu is the verifiable invoicing system defined by Spanish Royal Decree 1007/2023 and developed in Order HAC/1177/2024. It requires invoicing software to generate, for each issued invoice, a signed invoicing record, chained to the previous one via a hash and reportable to AEAT.

In practice this means two visible things on the invoice you receive:

• A QR code printed on the PDF or attached to the XML. The QR encodes the URL of the AEAT verification service plus the key record fields: issuer tax ID, invoice number, date and total.
• A "Verifactu" mention or "Invoice verifiable on the AEAT electronic site" next to the QR when the issuer reports records in real time.

As recipient you are not required to issue under Verifactu, but you are required to accept these invoices, keep the signed document and, if you want to exercise the control the system enables, validate the QR against AEAT before paying.

How Holded shows a received Verifactu invoice

Holded integrated Verifactu in 2025 for issuance: if you issue with Holded, the system generates the QR, chains the hash and sends the record to AEAT. For receipt the logic is different because the QR is already generated by the supplier's system.

Typical flow when a Verifactu invoice enters your Holded:

1. You upload the document (PDF with QR or signed XML) from the supplier invoices tab, or you receive it via a configured mailbox.
2. Holded extracts the basic fields: issuer, tax ID, number, date, base, VAT, total. If the document carries structured XML, data is exact. If only a PDF, it depends on OCR.
3. The QR is anchored to the entry as an attachment. On the received invoice detail you can see the code and the original document.
4. The Verifactu hash is stored if the document is signed XML. For visual PDF, Holded keeps the attachment but doesn't decompose the chain hash.

Up to here, Holded does its ERP part: capture, post and keep. What it does not do by design is what follows.

What Holded does automatically

To avoid the opposite mistake — underestimating the ERP — first list what Holded already solves well without an extra layer:

• Accounting entry for the received invoice, with journal entry, operation date and calculated due date.
• Automatic VAT breakdown by applicable rate (21%, 10%, 4%, exempt, reverse charge) per the document data.
• Posting by date in the right period, aligned with your monthly close and Spanish forms 303/390.
• Attachment storage (PDF and XML) on supplier card and entry, with basic upload trace.
• Due-date alerts and payment management from the Holded treasury module.
• Reports for advisor or accountant with consolidated entries.

For an SME receiving 30 invoices a month with low formal PO volume, this is usually enough. The question changes when volume grows and Verifactu-QR suppliers appear where you want real control.

What Holded does NOT do (and you should)

Holded is an ERP. It is not an AEAT verification platform or a three-way matching engine. Four tasks fall outside the ERP and should be covered upstream:

• Validate the QR against AEAT. The Verifactu QR is validated by calling the AEAT invoice verification service with the encoded fields. Holded does not systematically make this call for every incoming invoice. It is a separate integrity control, manual or with a dedicated verification tool.
• Reconcile line by line against PO and delivery note. The ERP stores the total. If a supplier invoices you a unit price different from the agreed one or a quantity above what was received, this isn't visible in the total — it's visible in the lines. matching invoices against POs and receipts is a discipline upstream of posting.
• Detect duplicates before approval. Holded checks basic duplicates by number and supplier. An upstream AP control also compares issuer, amount and date, holds the possible duplicate for a person to decide before it is approved and shows it side by side with the original.
• Check tax consistency. Total = base + VAT − withholding, the invoice tax ID against the PO supplier, dates and intra-EU VAT (reverse charge). An ERP posts the entry; it does not validate these relationships before posting.

This is where ininvoice fits as a complement to Holded, not a replacement. Holded remains your ERP. ininvoice operates upstream of the entry, on the purchase control layer: email intake, AI reading of the invoice as PDF or image, line-by-line three-way matching, duplicate detection and tax checks (VAT, withholding, tax ID, dates). It does not verify the QR against the AEAT: that control stays with the recipient. When the invoice is reconciled, ininvoice leaves it ready for a person to approve, with an audit trail, and exports approved invoices as a CSV or Excel file you import into Holded.

Three-way matching for Verifactu invoices in Holded

Three-way matching cross-checks three documents per expense:

1. Purchase order (PO): what you ordered, at what price, in what quantity.
2. Goods receipt / delivery note: what actually arrived at the warehouse.
3. Supplier invoice — now with Verifactu QR as proof of existence vs AEAT.

The cross-check is not at header level. The total never lies, but the lines do. ininvoice compares each line of the invoice against the corresponding PO and delivery note line, with a configurable tolerance (default 2% or EUR 1.50 in OR mode per line). Matching invoices are marked matched, ready for a person to approve; once approved, they are exported for import into Holded. Invoices breaking tolerance are held with the exact deviation context for a person to decide.

What the Verifactu QR adds to this flow is an extra guarantee: if the AEAT check confirms the record exists in the issuer's system, you rule out an invented or accidentally duplicated invoice. The subsequent reconciliation validates that it also matches what you ordered and received.

Recommended workflow: Holded + ininvoice

Concrete workflow for an SME or company with Holded already operational and growing Verifactu invoice volume:

1. Intake at ininvoice. You connect Gmail (read-only access), or upload invoices manually. Every incoming invoice — with or without Verifactu QR — is processed at ininvoice before touching Holded.
2. AI reading. ininvoice reads the invoice as PDF or image and extracts header and lines. If a field is unclear, the invoice goes to human review; a doubtful figure is never posted.
3. Duplicate detection. ininvoice compares issuer, number, amount and date; if the invoice has already come in, it is held for a person to decide and shown side by side with the original.
4. Tax checks and line-by-line three-way matching. ininvoice checks total = base + VAT − withholding, tax ID and dates, and cross-checks invoice against PO and delivery note. Matched: ready for approval. Variance: held with the reason visible until a person decides.
5. Export for Holded. Only when the invoice is reconciled (not duplicated, matched or with justified variance) and approved by a person is it exported, with an audit trail, as a CSV or Excel file to import into Holded: supplier, VAT breakdown and withholding tax if applicable.
6. Accounting close in Holded. The Holded team keeps working as before: the entry appears in the ledger, computes in the close and is visible to the advisor, with the difference that it arrives reconciled line by line, free of duplicates and with its tax data checked.

Step by step: how to export from ininvoice to Holded.

Quick comparison: Holded alone vs Holded + ininvoice

Task on received Verifactu invoice	Holded alone	Holded + ininvoice
PDF/XML capture and accounting entry	Yes	ininvoice reads the PDF or image (XML in development); Holded posts the entry with the reconciled, approved data
VAT breakdown and due date	Yes	Yes
QR stored on the attachment	Yes	Yes
QR check against AEAT service	Not automatic	Separate control (manual)
Multi-criteria duplicate detection, held for a person to decide	Basic (number + supplier)	Yes (issuer, number, amount, date)
Line-by-line match with PO and delivery note	No	Yes with 2% / EUR 1.50 tolerance
Tax checks (VAT, withholding, tax ID, dates)	No	Yes
Auditable trail matching → entry + CSV/Excel export	Partial	Complete

Verifactu recipient checklist for Holded

1. Holded supplier master with correct tax IDs and Verifactu issuer flagged when known.
2. Clear policy on what to do if the QR doesn't validate against AEAT (hold payment, open supplier ticket).
3. Conservation of the original signed document (XML or PDF with QR) linked to the Holded entry.
4. Documented chart of accounts so the automatic account suggestion doesn't need manual correction.
5. Matching tolerance agreed by the organisation (default 2% or EUR 1.50 per line, OR mode).
6. Single email mailbox for received invoices (shared or alias) connected to the AP layer.
7. Approvers assigned by amount limit and expense family.
8. Monthly close calendar with cutoff date for final entries in Holded.
9. Duplicate policy: how the supplier is notified when resending an already-registered invoice.
10. Internal contact point for critical exceptions (QR doesn't validate, high variance, new supplier).

Frequently asked questions

Does Holded automatically validate the Verifactu QR of a received invoice?

Holded stores the QR and document but does not systematically query the AEAT verification service per incoming invoice. QR verification is a separate control for the recipient — manual or with a dedicated verification tool — and is not part of what ininvoice does; ininvoice handles matching, duplicates and tax checks.

What information does a Verifactu QR contain?

The URL of the AEAT verification service plus issuer tax ID, invoice number, issue date and total. Reading it redirects to the AEAT portal that confirms whether the record is registered.

Is Verifactu mandatory for me as recipient?

You don't need to issue under Verifactu just because you receive them, but you do need to accept and keep them. Recommended: validate the QR, archive the hash and keep the signed document tied to the entry.

Does Holded detect duplicated Verifactu invoices?

The ERP controls basic duplicates by number and supplier. For strong control, the logic lives in the upstream AP layer, which compares issuer, number, amount and date and holds the possible duplicate for a person to decide before approval.

Do I need to change Holded to reconcile Verifactu invoices line by line?

No. Holded remains the ERP and accounting source. Line-by-line reconciliation is done in an upstream layer that cross-checks invoice, PO and delivery note and exports the result as a CSV or Excel file to import into Holded.

How are Verifactu invoices archived for an AEAT inspection?

The original signed document and the Verifactu chain hash are kept, linked to the entry. Holded stores the attachment; the upstream AP control adds the reconciliation and approval history to reconstruct the auditable chain.

Three takeaways

1. The Verifactu QR on a received invoice is useful information but doesn't validate itself. Holded stores it; verification against AEAT is the recipient's responsibility.
2. Holded handles the ERP. Line-by-line three-way matching, duplicate detection and tax checks are layers upstream of the entry; ininvoice covers that part and leaves the result ready for your Holded. Verifying the QR against the AEAT is a separate control for the recipient.
3. No implementation or consultant: up and running in 24–48 hours, with no historical migration. Only invoices entering from today flow through — with or without Verifactu QR.

Pricing is tailored: a written proposal within 48 hours.

Related content

• Three-way matching: cross-check invoice, PO and delivery note line by line
• Exporting approved invoices from ininvoice to Holded
• Verifactu impact on touchless AP
• Tailored pricing