I. The 4 Layers of Spanish Digital Invoice Reporting

1. SII - Suministro Inmediato de Informacion - Since 1 July 2017
Mandatory for large companies with turnover > €6m. All issued and received invoices must be reported to AEAT via SII feed within 4 calendar days. Covers both issued and received invoices. If you are in SII, you are exempt from VeriFactu.

2. B2G E-Invoicing - FACe - Facturae XML
Mandatory since 2015 for all suppliers to public administration. Format: Facturae XML with XAdES-EPES signing via FACe portal. Digital certificate required.

3. VeriFactu - Anti-Fraud Billing Software Law - Royal Decree 1007/2023
This is NOT invoice exchange, it is software integrity requirement. Starting 1 Jan 2026 for corporate taxpayers, 1 July 2026 for self-employed - now delayed by Council to 1 Jan 2027 corporate / 1 July 2027 self-employed per latest draft.

Requirements for compliant software:

• Tamper-proof, sequential chaining with hash/footprint of previous invoice
• Digital signature, digital stamp, QR code with phrase "VERIFACTU" and verifiable on AEAT website
• Integrity & inalterability - cannot edit/delete without auditable trace
• Real-time reporting: XML file automatically transmitted to AEAT upon issuance
  Non-compliant software banned from sale since 29 July 2025

4. Crea y Crece - B2B Mandatory E-Invoicing - Law 18/2022 + Royal Decree 238/2026
Approved 24 March 2026. Governs format, transmission and exchange between trading partners, plus mandatory status reporting: acceptance and effective payment must be communicated.

• Formats: EN 16931 semantic model - 4 syntaxes admitted: UBL (OASIS), CII (UN/CEFACT), EDIFACT, Facturae. UBL mandatory for public solution.
• Entry into force of Ministerial Order HAC/1028/2026 published 5 Oct 2026 in BOE, entry into force 6 Oct 2026 starts countdown
• Compliance: Businesses > €8m turnover 1 year after Order, i.e. 6 Oct 2027, all others 6 Oct 2028

A single business may be subject to all three simultaneously: Crea y Crece for how it exchanges, VeriFactu for how software generates, SII for how it reports VAT

II. Banking Compliance Angle

Banks in Spain have 3 obligations linked to invoicing:

1. VAT Fraud Detection: Under PSD2 and Law 58/2003, banks must monitor invoice-backed financing. AEAT cross-checks bank transfers/IP addresses; evasion penalties up to 150% of tax due.
2. SII as AML Tool: SII data is used to detect carousel fraud. If bank finances invoice that is fictitious, it can be liable for lack of due diligence.
3. Real-time Reporting for Factoring: If bank does confirming/factoring, invoice status (paid/accepted) must be reported to public platform SPFE.

III. Penalties - The Case Law

A. Administrative Penalties for SII:

Under Spanish rules:

• No SII reporting: 1% of annual Spanish turnover, minimum €600
• Late reporting: 0.5% of missed amounts, min €300 max €6,000 per quarter
• Under Art 201 Law 58/2003 General Tax Law: Failure to provide invoice when mandatory: 1% of total invoice amount
• VeriFactu software non-compliance: up to €50,000 per year for software provider, €10,000 for user.

Case 1: Spanish Supreme Court on Proportionality of VAT Penalties - STS 2023 BDO Case

Both parties agreed tax authorities must evaluate legal requirements for refund. Supreme Court held 10% penalty was not proportionate and annulled it. Establishes precedent: Even if invoice reporting fails, penalty must be proportionate.

Case 2: Ten Years Prison for Million-Euro VAT Fraud in Malaga - 2024

Court found "organized and ongoing operation, aimed at evading payment of VAT accrued in marketing of hydrocarbons, through appropriation of amounts charged and collected from end customers". Amount defrauded: €13,194,212. Relevant because SII was introduced specifically to catch this type of fraud.

Case 3: CJEU Case C-281/20 - Spanish Reference - Invoice Referring to Fictitious Supplier

Spanish court referred question on VAT Directive 2006/112/EC Art 168 and 199. Case concerns invoice referring to fictitious supplier and burden of proof in fraud. Principle: If invoice is from fictitious supplier, right to deduct VAT denied if taxpayer knew or should have known of fraud. Banks financing such invoices lose deduction.

Case 4: Banking Refund Obligation - Ibercaja €83,000 Scam Case - Spanish Supreme Court + EU Court

Spanish Supreme Court said banks must prove serious negligence, including case involving Ibercaja customer who lost more than €83,000 in one night. EU Court ruling 2024: Banks must refund unauthorised payments even if customers were careless. If bank has reasonable grounds to suspect customer is behind fraud, it must put reasons in writing to Banco de España.

Direct impact on invoice fraud: If corporate email is hacked and fake invoice payment instruction sent, bank must refund unless it proves gross negligence.

Case 5: Spanish Supreme Court Principle of Full Regularisation - Regularización Íntegra

Supreme Court states Tax Authorities must carry out thorough evaluation of taxpayer's VAT position during audit, including identifying incorrect input VAT deductions and determining if taxpayer eligible to reclaim overpaid VAT, within same audit. Means AEAT cannot penalize you for late SII reporting without also crediting you for VAT overpaid.

IV. What Banks Must Do Now - Compliance Checklist 2026-2027

1. Audit if client is SII or VeriFactu - determines reporting channel
2. For clients > €6m, require SII compliance certificate
3. For factoring/confirming, integrate with SPFE to report invoice status acceptance/payment
4. Software: Ensure internal billing software is certified VeriFactu with QR + hash chaining
5. Retain invoices: 6 years per Commercial Code, 4 years per General Tax Law, 5 years for investment gold