Verifactu for paying companies: what you have to do when you receive an invoice with a Verifactu QR code

Last updated: 24 October 2026. Dates and rules linked to their source: Royal Decree 1007/2023 and Royal Decree-law 15/2025.

What is Verifactu from the point of view of whoever receives the invoice?

Most blogs and consultancies writing about Verifactu cover a single angle: how to issue a Verifactu invoice, how to certify the invoicing software, how to comply with the manufacturer's regulation (Royal Decree 1007/2023). That narrative is legitimate, but it leaves out 100% of recipients, which is all of us: any company that receives supplier invoices automatically falls on the "passive side" of Verifactu.

From the position of the payer / recipient, Verifactu is a mechanism that raises the traceability of the invoices entering your accounts payable (AP) workflow. Each Verifactu invoice arrives with three verifiable elements:

1. A QR code on the visual representation of the invoice (PDF, printed, HTML e-mail).
2. A cryptographic fingerprint (hash) that chains that record to the previous one issued by the same supplier. The chaining is done with SHA-256 over the relevant fields of each invoice plus the hash of the previous invoice.
3. The literal wording "VERIFACTU" on the invoice itself (when the issuer has opted for the mode that sends records to the AEAT, not the "non-verifiable" mode of the same Regulation).

As a recipient, your nominal interaction with Verifactu is limited to three potential actions:

• Scanning the QR to confirm that the invoice exists in the AEAT's records (when the issuer opts for the Verifactu mode with records sent).
• Keeping the QR and the fingerprint field in your digital invoice archive (just as you already keep the rest of the invoice: article 165 of the VAT Law plus the Invoicing Regulation).
• Detecting discrepancies between what you scan and what the supplier has sent you (amount, issuer's tax ID, date).

None of these three actions is mandatory for the recipient under Royal Decree 1007/2023 or under Royal Decree-law 15/2025. But all three are defensible in an inspection and a deterrent against supplier fraud; the typical case is a supplier that issues you a "Verifactu-like" invoice with an apparent QR but never registered the document with the AEAT, leaving you with an invoice the tax authority does not recognise.

No need to panic. You are not going to have a tax problem for not checking the QR on your suppliers' invoices in 2026 or 2027. The Verifactu system splits responsibilities: the issuer answers for issuing correctly, you answer for booking the corresponding deductible expense. But you are going to have an operational problem if you find out late (at closing, at audit) that a supplier issued you invalid or duplicate invoices.

What legal obligations does the payer have?

Short answer: strictly, no new obligation derived from Verifactu. Royal Decree 1007/2023 (Regulation on invoicing computer systems) falls on the issuer and on the manufacturer of the software that issues. The recipient keeps exactly the same obligations it already had before Verifactu:

Recipient's obligation	Source	Does it change with Verifactu?
Receive and keep the invoice (paper or electronic) for 4 years	Art. 165 of the VAT Law + Invoicing Regulation RD 1619/2012	No
Check that the invoice meets the formal requirements (issuer's tax ID, number, date, tax base, VAT)	Invoicing Regulation	No, but the QR makes the check easier
Preserve the integrity and legibility of the electronic invoice	RD 1619/2012 arts. 8 + 21	No, but it is advisable to archive the QR with the invoice
Detect duplication and record correctly in the received invoices book	VAT Law + Regulation	No, but the Verifactu hash works as a natural unique key
Report the received invoice in the SII (if your company is included in the SII)	Royal Decree 596/2016	No: SII and Verifactu are parallel systems, not chained

Where there are indirect interactions with Verifactu:

• If your supplier issues you a Verifactu invoice but it does not appear in the AEAT when you check it, you may be looking at an invoice the issuer did not send correctly. As the payer, you are not responsible, but it is advisable to tell the supplier so that it can put it right. Best practice: check on receipt, not at closing.
• If your supplier issues you a "non-verifiable invoice" (the other mode of RD 1007/2023, without sending records to the AEAT in real time), you will not be able to scan the QR against the central system. That invoice is legal all the same, but you lose the benefit of instant checking.
• Once mandatory B2B e-invoicing comes into force (the Crea y Crece Law, Law 18/2022, implemented by Royal Decree 238/2026), the recipient will have additional obligations: reporting the acceptance or rejection and the payment of each invoice (articles 10 and 12). But that is B2B e-invoicing, not Verifactu. They are different systems that coexist; to go deeper, read the e-invoice reception guide.

Summary of the legal framework: Verifactu adds no burden on the payer. B2B e-invoicing will. Do not mix the two systems in your adaptation plan.

How to check a Verifactu QR step by step

Below is the manual procedure for checking the QR of a Verifactu invoice you have received. It is designed so that a finance team can carry it out without specialised software; further down you will see how to automate it within an AP workflow.

1. Identify that the invoice is a Verifactu invoice. Look on the invoice you received (PDF, HTML e-mail, printed) for two signs: the literal wording "VERIFACTU" or "Factura verificable en la sede electrónica de la AEAT" (usually near the footer or next to the QR) and a square QR code, different from a payment QR or a TicketBAI QR (if the issuer is in the Basque Country). The Verifactu QR points to a URL on the aeat.es domain in the AEAT's definitive system. If you do not find those signs, the invoice is not a Verifactu invoice: it may be a perfectly valid ordinary invoice, simply issued by a supplier that has not yet joined the system.
2. Scan the QR with your phone or a reader. Use any standard QR reader (your phone's built-in camera, a code-reading app, a module of your document management software). You do not need an official AEAT app; the QR contains a public URL. When scanned, the QR redirects to a page on the AEAT's electronic office that shows the checked data of the invoice: issuer's tax ID, invoice number, date, tax base and total amount.
3. Compare the checked data with the data on the invoice you received. On the AEAT page that appears after scanning, check one by one: the issuer's tax ID matches the one on the invoice; the invoice number matches character by character (watch out for alphanumeric series); the issue date matches; the total amount matches to the cent. If any of the four fields does not match, mark the invoice as suspicious and raise an issue with the supplier before booking it.
4. Confirm that the invoice appears as "sent". The AEAT page will show whether the invoice has been correctly sent to the central system. If it appears as "not found" or "pending", contact the supplier: either it uses the "non-verifiable" mode (legal but not searchable), or there was a communication failure in its invoicing software.
5. Keep the QR together with the invoice. Your obligation to keep records for 4 years applies to the whole invoice, including the QR if it is part of the original visual representation. When you archive the invoice in your document manager, do not crop the QR: archive the full PDF or, if you extract data to JSON, keep at least the QR URL and any hash shown on the invoice.
6. Record the result of the check in your system. In your ERP or accounts payable module, add a field (boolean or status) verifactu_validado with one of three values: ok, discrepancy, not sent. This lets you filter and audit at month end. Automating it requires a specific QR-checking tool: ininvoice does not do it (see the next section).
7. Repeat the control on a sample for non-Verifactu suppliers. For suppliers that do not yet issue Verifactu invoices (for as long as the transition lasts), add compensating controls: periodic checking of the tax ID in the AEAT census, cross-checking with the SII where applicable, and manual review of high-value invoices. The QR check does not replace the other AP controls; it complements them.

Where purchasing control fits into your AP automation workflow

Checking the QR invoice by invoice is feasible when you receive 20 invoices a month. When you receive 200, 2,000 or 20,000, manual checking against the AEAT becomes unmanageable and is automated with a specific QR-checking tool. But the recipient's operational bottleneck is not just the QR: it is controlling what you receive before paying it — that the invoice matches the purchase order and the delivery note, that it does not come in twice and that VAT and personal income tax withholding (IRPF) are right.

That is where ininvoice comes in. It does not check the QR against the AEAT; it takes care of purchasing control before the accounting entry. The flow is:

1. Capture: the invoice arrives through Gmail (OAuth connection, read-only) or by manual upload.
2. AI extraction: ininvoice reads the invoice as PDF or image and extracts issuer, number, date, tax base, VAT, IRPF, total and lines.
3. Duplicates: multi-criteria comparison with a block before approval, so the same invoice is not paid twice.
4. Tax validation: total = tax base + VAT − IRPF, the tax ID on the invoice against the supplier on the purchase order, dates and intra-EU VAT (reverse charge).
5. Three-way matching + workflow: the invoice moves on to three-way matching line by line (purchase order + delivery note + invoice), with configurable tolerances (by default, 2% or EUR 1.50 per line) and partial deliveries. Whatever does not match stays in the panel to be approved, rejected or queried.

The value of this control layer for the recipient is not "compliance" (remember that the recipient has no obligation) but three concrete operational gains:

• Fewer exceptions and less rework. Each invoice reaches the approver already matched against the purchase order and the delivery note; the finance team only looks at what does not match.
• Duplicates blocked before payment. The multi-criteria comparison with a block prevents double payment, the most expensive mistake in an invoice inbox.
• Audit ready. Each invoice keeps its approval history and is exported to Excel with an audit trail sheet. When an inspection comes, you do not reconstruct anything after the fact.

ininvoice covers this purchasing control and works alongside your ERP or your accounting as a prior layer, without replacing them. Pricing is tailored: how the proposal is prepared. You can also see how it fits into the impact of Verifactu on touchless AP, with a numerical example of a real pipeline.

Verifactu calendar for recipients

Verifactu binds the issuer, and its deadlines depend on who issues. Royal Decree-law 15/2025 set, in the fourth final provision of Royal Decree 1007/2023, these deadlines for having invoicing systems adapted (see also the AEAT note on the extension of the deadline):

On 5 October 2026 the Ministry of Finance announced that it intends to postpone these obligations until October 2028 (information note). It is only an announcement: until it is published in the BOE, the dates in force are those in the table. The details, with each date and its source, are in the e-invoicing and Verifactu calendar (in Spanish).

What it means for the recipient: during the transition you will receive invoices with a Verifactu QR and invoices without one at the same time. Both are valid. The control that does not change is the usual one: that the invoice matches the purchase order and the delivery note, that it is not a duplicate and that VAT and IRPF are correct.

B2B e-invoicing, which is a different obligation: Royal Decree 238/2026 implements mandatory e-invoicing between companies (Law 18/2022, “Crea y Crece”). According to the AEAT calendar, it starts on 6 October 2027 for those who invoice more than EUR 8 million and on 6 October 2028 for everyone else. It affects how invoices are exchanged, not how the issuer records them: see the guide to receiving e-invoices.

Typical mistakes when checking Verifactu invoices received

Mistakes worth avoiding when Verifactu invoices from your suppliers start to arrive.

Mistake 1: checking the QR only at month end

Symptom: the finance team accumulates invoices during the month and at closing tries to check all the QRs at once. It finds discrepancies late, when there is no longer time to ask the supplier for a correction.

Solution: check on receipt. Checking each invoice when it arrives avoids piling up the work at closing, when there is no longer time to ask for corrections.

Mistake 2: confusing a Verifactu QR with a TicketBAI QR

Symptom: a supplier in the Basque Country issues with TicketBAI and the team tries to check it against the AEAT's central system. The check always fails because TicketBAI has its own system (BATUZ).

Solution: the detector must distinguish by the domain of the QR URL. TicketBAI points to bizkaia.eus, gipuzkoa.eus or araba.eus. Verifactu points to aeat.es.

Mistake 3: rejecting invoices without a QR as "not valid"

Symptom: an invoice without a Verifactu QR is treated as a defective invoice. It is returned to the supplier. Unnecessary friction.

Solution: until 2027/2028 many legitimate suppliers do not issue Verifactu invoices. The absence of a QR is not a defect. It only matters if the supplier has confirmed to you that it is already on Verifactu and still issues without a QR: then do ask for a correction.

Mistake 4: archiving the invoice without the QR

Symptom: the OCR extracts the data to JSON and discards the original PDF. Months later, in an inspection, there is no way to check it again.

Solution: always archive the original PDF together with the extracted data. Keep it for 4 years, like any invoice.

Mistake 5: treating Verifactu as a substitute for three-way matching

Symptom: the finance team assumes that "Verifactu invoice = correct invoice" and lowers the rigour of the control against the purchase order and the delivery note.

Solution: Verifactu certifies valid issuance, not a correct amount. An invoice can be perfectly Verifactu-compliant and at the same time be a duplicate, wrongly invoiced or not match what was delivered. The three-way matching manual is still the control that detects price or quantity variance: Verifactu is an earlier layer, not a substitute.

Mistake 6: regulatory panic at the 2025 closing

Symptom: AP teams stop payments to suppliers that "have not implemented Verifactu", believing it has been in force since 2025.

Solution: Verifactu does not bind anyone yet: companies' invoicing systems have to be adapted before 1 January 2027 and everyone else's before 1 July 2027 (Royal Decree-law 15/2025), and those in the SII are left out. An invoice without a Verifactu QR is fully valid and is processed as normal.

FAQ

Is the recipient of a Verifactu invoice obliged to check the QR?

No. Royal Decree 1007/2023 and Royal Decree-law 15/2025 impose obligations on the issuer and on the manufacturer of the invoicing software, not on the recipient. Checking the QR is best practice for traceability and early detection of supplier errors, but it is not legally required.

What happens if I receive a Verifactu invoice whose QR does not check out against the AEAT?

The invoice is still formally valid if it meets the requirements of the Invoicing Regulation (tax ID, number, date, tax base, VAT). A QR that does not check out means the issuer did not send the record to the AEAT correctly; it is the issuer's problem, not yours. Best practice: tell the supplier so that it can put it right, and keep the invoice as received.

Does Verifactu replace the SII?

No. Verifactu and the SII are parallel systems. The SII is the immediate supply of information from the record books and applies to large companies (>EUR 6M) and those who join voluntarily. Verifactu is the verifiable invoicing system. A company may be bound by both, by only one, or by neither, depending on its size and activity.

How do you tell a Verifactu QR from a TicketBAI QR?

By the domain of the URL it points to. Verifactu points to aeat.es (the national electronic office). TicketBAI points to bizkaia.eus, gipuzkoa.eus or araba.eus depending on the Basque historical territory. Visually they are the same (square QR codes) and functionally equivalent, but the central systems are different.

Do I have to keep the Verifactu QR for 4 years?

Yes, as an integral part of the invoice. The obligation to keep records for 4 years (art. 165 of the VAT Law + RD 1619/2012) applies to the complete visual representation. If you archive as PDF, do not crop the QR. If you extract to JSON, keep the QR URL and the hash.

What if my supplier issues a "non-verifiable invoice" (the non-Verifactu mode)?

It is fully legal. RD 1007/2023 provides for two modes: Verifactu (with records sent to the AEAT) and non-verifiable (without sending, but with the same requirements of cryptographic integrity and unalterability). In the non-verifiable mode you will not be able to scan the QR against the central system, but the invoice is valid all the same. As a recipient, your only action is to archive it as normal.

Does the Verifactu QR check work offline?

No. The check requires querying the AEAT's electronic office in real time. If you have no connection, you cannot check. This is to be expected: the value of the check lies in comparing against the central register, which lives at the AEAT.

How does ininvoice help control the Verifactu invoices I receive?

ininvoice does not check the QR against the AEAT: that check is a manual control by the recipient or by a specific tool. What ininvoice does do on every invoice received, with or without a QR, is read it as PDF or image, match it against your purchase order and delivery note line by line, hold possible duplicates for a person to decide and validate VAT, IRPF, tax ID and dates. The finance team works on the exceptions, and a person approves every invoice. Read how it fits into a touchless AP flow.

Next steps for your receiving company

Three concrete actions you can start this week, in order of impact:

1. Inventory your suppliers by size. Separate those that keep the SII (left out of Verifactu as issuers), companies (deadline: before 1 January 2027) and the self-employed (before 1 July 2027). That segmentation tells you what part of your volume will arrive with a Verifactu QR and when.
2. Decide how you will check: manually (the 7-step procedure described above, feasible up to ~50 invoices a month), or automated (integrated into your AP system). The decision is not ideological; it is about the cost of finance hours.
3. Adjust your digital archive. Check that your document manager keeps the complete PDFs with the QR, not just the extracted data. If you work with a system that crops or normalises the PDF, ask them to keep the original version.

If you want to see how to control the Verifactu invoices you receive in a real AP workflow, read the e-invoice reception guide for recipients, review the specific comparison of Verifactu reception for SMEs, or go deeper into the impact of Verifactu on touchless AP.

Official sources

• Royal Decree 1007/2023, of 5 December, approving the Regulation that sets out the requirements for invoicing computer systems and programs. BOE-A-2023-24840.
• Royal Decree-law postponing Verifactu: see Royal Decree-law 15/2025.
• Ministerial Order HAC/1177/2024, implementing the technical specifications of Verifactu: BOE-A-2024-22138.
• AEAT electronic office: Invoicing computer systems and Verifactu: sede.agenciatributaria.gob.es.
• Law 18/2022, "Crea y Crece" (B2B e-invoicing, a system independent of Verifactu): BOE-A-2022-15818.