Electronic invoice in Mexico

he Complete Guide to Mexico’s CFDI 4.0 Mandate: Mastering PAC integration, strict SAT clearance rules, and ensuring seamless compliance across B2B, B2G, and B2C transactions.

Select a country

Overview

Mexico operates one of the most mature mandatory e-invoicing systems in the world — CFDI, the Comprobante Fiscal Digital por Internet — covering essentially every tax-relevant transaction in B2B, B2G and B2C alike.

Architecturally it is unusual, and the distinction matters for anyone planning a project. Certification is performed by competing licensed private intermediaries — a PCCFDI, traditionally called a PAC — while the tax administration SAT sets the single standard, issues the certificates for stamping, receives a copy of every invoice and supervises the providers. Not a central portal like Italy's SdI, and not an open four-corner network: regulated clearance through private fiscal intermediaries.

CFDI 4.0

the only valid version, under Anexo 20 and the SAT XSD — no CFDI 5.0 announced

72 hours

the usual window to obtain the Timbre Fiscal Digital after generating the document

RFC-driven

every document is addressed by tax number — with two generic values for the exceptions

Timeline

Mexico finished its rollout more than a decade ago. What moves now is the ruleset, not the scope — and the 2026 changes are worth knowing because they loosen two things that used to cause friction.

Already in force

1 April 2014

CFDI becomes universal

Every taxpayer required to invoice moved to CFDI, replacing the earlier paper and digital schemes. There is therefore no phased B2B mandate by company size in Mexico of the kind France, Germany or Poland are running — the obligation has been general for over a decade, and B2G came in on the same footing.

January 2022 — April 2023

CFDI 4.0 arrives and becomes the only version

Introduced on 1 January 2022 and the sole valid version from 1 April 2023.

1 January 2026

Resolución Miscelánea Fiscal 2026

Published in the Diario Oficial de la Federación on 28 December 2025 and in force from 1 January 2026. It retains CFDI 4.0 and adjusts three practical rules — see the note below.

What RMF 2026 changed

Payment complementUp to five calendar days of the following month to issue the complement for payments actually received

CancellationPossible without the recipient's acceptance until the next business day after issue, and also where the amount does not exceed MXN 1,000

RetentionReinforced retention of the XML and of the evidence supporting each transaction issued or received

The direction of travel is clear from the RMF: SAT is pursuing greater traceability, more documentary support and less tolerance for technical or substantive inconsistencies in tax receipts. Nothing in the reviewed SAT or DOF material announces a move to CFDI 5.0 or a replacement of CFDI by Peppol.

The PAC clearance model

The flow is supplier → PCCFDI/PAC → SAT, with the certified CFDI returning to the supplier for delivery to the buyer. Certification is the fiscal act; commercial delivery of the document is a separate matter that the PAC does not handle.

The sequence

01 The supplier builds the CFDI XML and signs it with its digital seal certificate — the Certificado de Sello Digital (CSD)

02 The CFDI goes to a PCCFDI/PAC

03 The provider validates the XML against the XSD, the validity of the CSD and its match to the taxpayer, the issuer's and recipient's RFC, the SAT catalogues and business rules, the requirements of Anexo 20 and Anexo 29, and any applicable complementos

04 On success it adds the UUID (folio fiscal), the certification date and time, SAT's digital seal and the Timbre Fiscal Digital

05 The certified CFDI returns to the issuer, and a copy goes to SAT, which retains copies of all certified CFDI

The CFDI counts as properly issued provided the Timbre Fiscal Digital is obtained within the prescribed period — as a rule no later than 72 hours after the document is generated.

Is this real-time reporting?

Effectively yes — but the description matters. There is no separate report sent after invoicing: transmission to the tax authority is built into certification. The PCCFDI must forward the CFDI to SAT as it certifies, and Anexo 29 requires immediate transmission of the copy with technical controls on timeliness. The accurate term is real-time or near-real-time clearance, not real-time reporting. The one timing exception is the B2C factura global.

Not a five-corner model

In a Peppol five-corner arrangement there is a supplier, both parties' Access Points, the buyer, and the tax authority. Mexico has no mandatory buyer-side Access Point and no AP-to-AP network. The PCCFDI performs tax validation and stamping; getting the document to the buyer happens separately.

B2G

There is no separate national B2G mandate, no distinct format and no dedicated transmission channel. Public bodies sit inside the general CFDI system: they require a CFDI when paying suppliers, and they issue CFDI for taxes, fees, government revenues, subsidies and the other prescribed operations — using the same document types as everyone else: ingreso, egreso, pago, traslado, nómina.

A public buyer may of course require contract and order numbers, budget references or departmental data. In Mexico these are normally carried in an addenda.

The addenda is a commercial part of the document, not a fiscal one. It does not replace the mandatory CFDI fields and is not normally validated by SAT as part of the fiscal standard. Treating it as if it were fiscal — or vice versa — is a common integration error.

B2C and the factura global

Consumer sales are inside the CFDI system too, but with a simplification designed for retail volumes. Where a consumer asks for an individual CFDI, one is issued. Where nobody asks, the seller aggregates the transactions into a factura global — a consolidated CFDI.

—The factura global may be prepared daily, weekly or monthly

—It must reach SAT or the PCCFDI no later than 24 hours after the close of the relevant period

—Where no RFC is provided, the generic XAXX010101000 is used

Retail receipts, till documents and other confirmations may be given to the customer, but they do not discharge the seller's obligation to produce the tax CFDI or the factura global. Handing over a receipt is not invoicing.

Formats and PDF

The mandatory tax format is the local CFDI 4.0 XML under Anexo 20 and the SAT XSD, with root element cfdi:Comprobante. SAT publishes its own XSDs, namespaces, XSLT for the cadena original, catalogues of tax regimes, currencies, payment methods, goods and services, error matrices and the complementos for particular scenarios.

CFDI is not an implementation of EN 16931 and is not a Mexican CIUS of the European standard. It has its own semantic structure, its own mandatory tax catalogues, the RFC and CSD, the UUID and Timbre Fiscal Digital, dedicated complementos, and considerably more fiscal and operational fields than the European core invoice model. SAT has made no statement of EN 16931 conformity. UBL 2.1, Peppol BIS Billing, PINT, UN/CEFACT CII and Factur-X/ZUGFeRD are not accepted as a lawful CFDI — they can be converted into one, but they cannot replace it.

Complementos

Depending on the transaction, additional XML components attach to the CFDI: the Timbre Fiscal Digital, the Complemento para Recepción de Pagos, Comercio Exterior, Carta Porte, payroll (nómina), taxes and withholdings, and industry-specific complementos. Where the Exportacion field carries the value 02, the CFDI must include the Complemento de Comercio Exterior — the current SAT technical documentation carries the ComercioExterior20 schema.

Where the PDF sits

For ordinary domestic transactions a PDF is not a tax original. It is only the representación impresa de un CFDI — the printed or visual rendering. The certified XML is what is used for accounting, verification and automated processing, and the issuer must give the recipient the XML.

One genuine PDF exception

A foreign supplier of digital services without a permanent establishment in Mexico must, at the Mexican customer's request, send an electronic document in PDF carrying prescribed particulars: issuer details, country and place of issue, the foreign tax number, a description and the price of the service, the IVA shown separately, the date and period, and the Mexican recipient's RFC. This is a special regime — it does not mean PDF is generally recognised as a CFDI.

Identifiers

The identifier throughout is the RFC — Registro Federal de Contribuyentes. Two generic values handle the cases where a real RFC does not exist, and using the wrong one is a frequent cause of rejection:

XAXX010101000The domestic generic RFC — used where a Mexican consumer does not provide an RFC or does not request an individual CFDI

XEXX010101000The foreign generic RFC — used for buyers not registered in the Mexican RFC, alongside the foreign tax identifier in the applicable field such as NumRegIdTrib

The RFC is not established as a Peppol participant identifier scheme for the national mandate, and should not be presented as an equivalent of the mandatory schemes such as 0208 in Belgium, 9930 in Germany or 0192 in Norway. Where a Mexican company voluntarily joins Peppol, its identifier follows the rules of the chosen Access Point or SMP and the general OpenPeppol rules — not Mexican tax law.

Peppol in Mexico

Peppol is not a mandatory channel, not the government's B2G channel, not a way of performing timbrado, not a way of transmitting a CFDI to SAT, and not a condition of an invoice's tax validity. Companies may use it voluntarily for commercial exchange — delivering a UBL or PINT document to a European buyer, for instance — but the Mexican supplier must satisfy the CFDI requirements in parallel.

No national Mexican Peppol Authority has been established

No mandatory national EAS code exists for Mexico

The OpenPeppol list does contain Mexican organisations providing Access Point and SMP services, but no competent state body appears in the Peppol Authority column for Mexico. Peppol is therefore developing in the country as a voluntary commercial network, not as regulated national infrastructure. In jurisdictions without their own Peppol Authority, a service provider agreement can be concluded directly with OpenPeppol acting as the Peppol Authority.

Export and import

Exporting from Mexico

The Mexican seller must issue a CFDI even if the foreign buyer has no RFC, does not use CFDI, and expects UBL, CII, a PDF or some other national format. The document normally carries the generic XEXX010101000, the foreign tax identifier in the applicable field, the country of tax residence, the value of the Exportacion field and — for a definitive export under code 02 — the Complemento de Comercio Exterior.

The supplier may additionally produce a European Peppol BIS or PINT document, or a commercial PDF, for the foreign customer. The Mexican CFDI remains a separate mandatory tax document alongside it.

Importing goods

A foreign supplier without a Mexican presence does not normally issue a CFDI. The principal document evidencing import IVA is the customs pedimento, which must be made out to the Mexican taxpayer and evidence payment of IVA on import. The foreign invoice remains a commercial source document — receiving it does not turn it into a CFDI.

Importing digital services

Foreign suppliers of digital services fall under a special regime and may be required to register in the RFC, appoint a legal representative, provide a Mexican address for notifications and tax supervision, issue the prescribed PDF document to Mexican customers and show IVA separately. These obligations bind the foreign digital services supplier — not a foreign Peppol Access Point as such.

ViDA

ViDA does not apply to Mexico. Trade between a Mexican and a European company is an export or import from the Mexican perspective, not an intra-EU transaction. ViDA can reach the European side of the deal, or a European establishment of a Mexican group — but it never substitutes for the Mexican CFDI on transactions accounted for in Mexico.

Becoming a PCCFDI

Two roles must be kept apart: a Peppol Access Point is a voluntary transport service, while a PCCFDI/PAC is a SAT-licensed provider of tax certification. A Peppol certificate, ISO 27001 or accreditation in another country confers no right whatsoever to certify Mexican CFDI.

What the authorisation involves

—Submission of the prescribed documentation to SAT, and granting SAT access to databases and controls

—Compliance with Anexo 20, Anexo 29, the control matrix and the service level requirements

—The authorisation runs for the two tax years following the year of notification, and may be renewed for a further two

Local presence

In substance, real local presence is required: a Mexican legal entity, an RFC, a registered tax address and operating offices, registration in the commercial register, and availability for SAT inspections. A foreign company without a Mexican structure cannot rely on foreign Peppol certification.

No dedicated mailbox comparable to the Slovak arrangement appears in the PCCFDI rules. Mexico does operate the Buzón Tributario for official communications between taxpayers and SAT — but it is not a channel for delivering a CFDI to a buyer, does not replace a PCCFDI, and is neither a Peppol SMP nor an Access Point.

What this means for a European provider

A foreign Access Point can support voluntary Peppol exchange with a Mexican company — an organisation may use a certified service provider located in another country. It cannot perform timbrado. The workable model is to generate or convert CFDI 4.0, support the SAT catalogues and complementos, manage the XML and the cancellation rules, and integrate with an existing Mexican PCCFDI/PAC for certification.

Archiving

Mexican tax law requires accounting and the documents supporting it to be retained for a general period of five years, with longer periods in defined cases — records tied to the existence of the company or to assets whose treatment continues over time can have to be kept for longer. Confirm the exact term for the specific documents and taxes with a Mexican adviser rather than applying a flat rule.

What is archived is the certified XML, not the printed representation. RMF 2026 specifically reinforces retention of the XML and of the evidence supporting each transaction

Cancellations, replacements and payment complements belong in the archive alongside the invoice — a cancelled CFDI does not stop being part of the record

SAT holds copies of all certified CFDI, but that is its archive, not yours — the retention obligation stays with the taxpayer

The UUID is what ties an archived document to the tax system, so it should stay retrievable — it is also the value used in SAT's public verification tool, linked under Resources.

Penalties

Breaches include failing to issue a CFDI, failing to give it to the customer, failing to provide access to it, issuing a CFDI that does not meet the mandatory requirements, and failing to comply with the factura global rules.

Article 83, section VII CFFOn the amounts updated for 2026, the fine for the principal breach can run from MXN 22,300 to MXN 127,530

Repeat offenceThe authority may additionally close the business temporarily for 3 to 15 days

What usually costs more than the fine

—Disallowance of the expense for income tax purposes

—Refusal of the input IVA credit

—Additional tax assessed, with indexation and interest

—Difficulties during a tax audit, and sanctions for using invalid or simulated invoices

—In serious cases, blocking or cancellation of the digital seal certificates — which stops the company invoicing at all

That last item is the one to plan around. Losing the CSD is not a fine — it is an operational shutdown of the ability to issue any tax document.

IVA deduction

For an ordinary domestic purchase the answer is effectively yes — the valid CFDI XML is a mandatory formal condition of the deduction. To credit input IVA the purchase must relate to taxable activity, the IVA must be shown expressly and separately, the transaction must be supported by a proper tax document, the remaining statutory conditions must be met, and the CFDI must be valid and not cancelled. For income tax, expenses generally also require the corresponding comprobante fiscal.

But CFDI is not literally the only admissible document in every scenario. Import IVA rests on the pedimento; certain foreign digital services are supported by the special PDF; and foreign transactions can be evidenced by a foreign invoice with supporting documentation, depending on the tax and the operation.

How we help

Mexico should not be planned as an ordinary Peppol rollout — nothing in a European Access Point transfers. What a platform actually needs:

Generation and conversion of CFDI 4.0 under Anexo 20 and the SAT XSD

Support for the SAT catalogues and the complementos — payments, Comercio Exterior, Carta Porte, nómina

Integration with an authorised PCCFDI/PAC for timbrado, with the 72-hour window respected

Cancellation and replacement handling under the current RMF rules

Factura global aggregation with the 24-hour transmission deadline

The European Peppol BIS or PINT document the EU buyer needs, alongside the CFDI

Connection by API, SFTP and CSV, with ERP and IDoc source data

Frequently asked questions

Is e-invoicing mandatory in Mexico?

Yes, universally and since 1 April 2014. CFDI covers essentially all tax-relevant transactions in B2B, B2G and B2C. There is no phased mandate by company size of the European kind — the obligation has been general for over a decade. CFDI 4.0 has been the only valid version since 1 April 2023, and RMF 2026 retains it.

Can I use my European Peppol Access Point in Mexico?

For voluntary commercial exchange, yes — a Mexican company may use a Peppol-certified provider located abroad. For the tax mandate, no. Peppol is not a mandatory channel, not the government's B2G channel, not a way of performing timbrado and not a way of sending a CFDI to SAT. Certification requires separate SAT authorisation as a PCCFDI, and a Peppol certificate or ISO 27001 confers no right to certify Mexican CFDI.

What does it take to become a PCCFDI?

Substantive local presence: a Mexican legal entity, an RFC, a registered tax address and operating offices, commercial register registration, and availability for SAT inspections — plus granting SAT access to databases and controls and complying with Anexo 20, Anexo 29, the control matrix and the service levels. The authorisation runs for the two tax years following notification and can be renewed for two more. A foreign company without a Mexican structure cannot do this on foreign credentials.

Does CFDI comply with EN 16931?

No, and it is not a Mexican CIUS of the European standard. CFDI has its own semantic structure, mandatory tax catalogues, the RFC and CSD, the UUID and Timbre Fiscal Digital, dedicated complementos and considerably more fiscal fields than the European core invoice model. SAT has issued no statement of EN 16931 conformity. UBL 2.1, Peppol BIS Billing, PINT, CII and Factur-X are not accepted as a lawful CFDI — they must be converted.

Is a PDF acceptable?

Not as the tax original for domestic transactions — it is only the representación impresa of the CFDI, and the issuer must give the recipient the certified XML. There is one real exception: a foreign supplier of digital services without a permanent establishment in Mexico must, on request, send a PDF with prescribed particulars including its foreign tax number, the IVA shown separately and the Mexican recipient's RFC. That is a special regime, not general recognition of PDF.

How do I invoice a foreign customer?

You still issue a CFDI, even though the buyer has no RFC and may expect a completely different format. Use the generic RFC XEXX010101000, carry the foreign tax identifier in the applicable field such as NumRegIdTrib, state the country of tax residence and the Exportacion value, and attach the Complemento de Comercio Exterior for a definitive export under code 02. You may additionally send a Peppol BIS, PINT or commercial PDF — but the CFDI remains a separate mandatory tax document.

What changed in 2026?

The Resolución Miscelánea Fiscal 2026, published in the DOF on 28 December 2025 and in force from 1 January 2026, kept CFDI 4.0 and adjusted three things: up to five calendar days of the following month to issue the payment complement for payments actually received; cancellation without the recipient's acceptance until the next business day after issue, and also where the amount does not exceed MXN 1,000; and reinforced retention of the XML and the supporting evidence. The overall direction is more traceability and less tolerance for inconsistencies.

Do I have to issue a CFDI for every retail sale?

An individual CFDI only where the consumer asks for one. Otherwise the transactions go into a factura global — a consolidated CFDI that may be prepared daily, weekly or monthly and must reach SAT or the PCCFDI within 24 hours of the close of the period, using the generic RFC XAXX010101000. Note that giving the customer a till receipt does not discharge the obligation: the tax CFDI or factura global still has to be produced.

Summary

Mexico is a settled clearance country with an architecture found almost nowhere else: competing private licensed intermediaries perform certification, while SAT sets the standard, issues the seals, takes a copy of every document and supervises the providers. Transmission to the tax authority is not a report bolted on afterwards — it happens inside certification, within a 72-hour window.

Technically nothing European transfers. CFDI 4.0 under Anexo 20 is the only lawful format, EN 16931 plays no part, UBL and CII are not accepted, and the PDF is a rendering rather than a document. The complementos — payments, Comercio Exterior, Carta Porte, nómina — carry as much implementation weight as the invoice itself.

For a European provider the route is clear and it is not a Peppol rollout. Build or convert CFDI 4.0, support the catalogues and complementos, manage the XML and the cancellation rules, and integrate with an existing Mexican PCCFDI for certification. Becoming a PCCFDI yourself means a Mexican entity, an RFC, offices and openness to SAT inspection — with the authorisation running only two tax years at a time.

Resources

SAT — Verificación de Comprobantes Fiscales Digitales por Internet Check whether a CFDI is valid and has not been cancelled — the tool a buyer uses before booking the document SAT — list of authorised certification providers (PAC) The official register of PCCFDI — where you find and verify the partner that will perform your timbrado Resolución Miscelánea Fiscal para 2026 The instrument published in the DOF on 28 December 2025 — the source of the 2026 cancellation, payment-complement and retention rules SAT — CFDI technical documentation Anexo 20, the XSD schemas, namespaces, the cadena original XSLT, catalogues and the complemento specifications SAT — becoming a certification provider The requirements and process for the PCCFDI authorisation, for anyone weighing the local-entity route Servicio de Administración Tributaria The tax administration itself — announcements, the Buzón Tributario and the wider fiscal rules around CFDI

Need support with e-invoicing compliance?

As a certified Peppol Access Point we provide solutions for sending and receiving electronic invoices securely across Europe — including format conversion, validation and integration with national systems.

Start your free trial