E-commerce in Spain: selling online under the VeriFactu rules

E-commerce in Spain: selling online under the VeriFactu rules

Every order in an online store is an invoice waiting to happen. If you sell through a Spanish business, those invoices are now regulated: Spain's invoicing systems regulation (Royal Decree 1007/2023) is fully in force — companies since 1 January 2026, self-employed sellers since 1 July 2026. Any software that issues invoices must be a compliant SIF (certified invoicing system). Here is what that means in practice for an e-commerce operation.

One order, one compliant invoicing record

Most B2C sales are documented with a simplified invoice (the Spanish equivalent of a receipt), and a full invoice when the customer requests one or the transaction requires it. Either way, the regulation demands the same technical guarantees:

• A billing record chained with SHA-256 hashes, linking each invoice to the previous one so tampering is detectable.
• A mandatory QR code on the invoice — including the PDF you email with the order confirmation.
• An event log recording start-ups, incidents and cancellations, plus full inalterability of issued records.

One point sellers often miss: it does not matter that a payment gateway (card, PayPal, local methods) collects the money. The gateway processes the payment; the invoicing obligation stays with you, and the gateway receipt is not an invoice.

VeriFactu vs. non-VeriFactu mode

A compliant system can run in VeriFactu mode, transmitting each billing record to the Spanish tax agency (AEAT) as invoices are issued, or in non-VeriFactu mode, keeping signed records and the event log locally, ready to hand over if the AEAT asks. For a store issuing invoices around the clock, VeriFactu mode is usually the simpler operational choice: issue, transmit, done.

Connect the store to the invoicing engine — once

The classic mistake is double issuance: the shop platform generates an invoice and so does the accounting tool. That breaks the record chain and creates duplicates. The clean architecture is:

• The store fires a webhook or API call to the invoicing software when an order is paid.
• The SIF issues the invoice, creates the chained record and the QR, and returns the PDF for the confirmation email.
• A single source of issuance: the store sells, the SIF invoices.

Handle the edge cases deliberately — cancelled orders, failed charges and payment retries must never produce phantom invoices.

Cross-border sales within the EU

Selling to consumers in other EU countries brings the distance selling rules and the OSS one-stop shop for declaring foreign VAT. This changes how VAT is reported, not your Spanish SIF duties: invoices still come out of your compliant system. If you pass the EU-wide threshold, align the per-country VAT setup with your tax advisor.

Returns mean credit notes, never deletions

Returns are routine in e-commerce, and the rule is strict: an issued invoice is never edited or deleted. Each refund is documented with a corrective invoice (rectificativa), which generates its own chained record. Automate it: approving a return in the store back office should trigger the corrective invoice in the SIF, matched to the original. Partial refund, partial corrective.

Who invoices when you sell via marketplaces?

It depends on the contractual model:

• If the marketplace is a pure intermediary and you sell in your own name, you invoice the end customer from your SIF.
• If the platform buys and resells, or issues invoices on your behalf under its terms, map out who issues what — you may invoice the platform while it invoices the buyer.

Check each platform's terms and mirror them in your invoicing flow. No sale can end up with zero invoices — or with two.

The bottom line

Compliance for an online store is an architecture decision: one compliant SIF as the single issuing source, API integration with the storefront, automated corrective invoices for returns, and clarity per sales channel. The stakes are real — using non-compliant software can be fined with up to €50,000 per tax year (art. 201 bis of the Spanish General Tax Law). And keep the timelines straight: Spain's separate B2B e-invoicing mandate (Crea y Crece law) is a different obligation, still being rolled out with a 2027 horizon. The SIF rules apply today.