CFDI Electronic Invoicing in Mexico: Issuance and Penalties

CFDI electronic invoicing in Mexico is the mandatory system every business must use to document sales, services, payroll, freight movements, and refunds through digital records certified by the Servicio de Administración Tributaria (SAT). No paper invoice carries legal weight. If you operate in Mexico, compliance means getting three SAT credentials before you issue anything, transmitting every transaction through certified software as a stamped XML file that meets strict data requirements, and meeting a set of deadlines that carry real financial penalties when missed.1Servicio de Administración Tributaria. Factura Electrónica

The Comprobante Fiscal Digital por Internet (CFDI) is not a version of an invoice; it is the invoice. The current standard is version 4.0, and the SAT continues to update its supporting catalogs as recently as March 2026. Everything below assumes you are working with that version.

Three Credentials You Need Before You Invoice

You cannot issue a CFDI without three things from the SAT, and they have to be obtained in order.

The first is the Registro Federal de Contribuyentes (RFC), the taxpayer identification number assigned to every individual and business entity carrying out economic activity in Mexico.2Gob.mx. Inscription at the Federal Taxpayer Registry Your RFC links every invoice you issue or receive to your full tax profile.

The second is the e.firma, an advanced electronic signature that carries the same legal force as a handwritten signature under Mexico’s Advanced Electronic Signature Law. You obtain it in person at a SAT office, where biometric data ties the signature to your identity. The e.firma authenticates you across SAT platforms; it does not sign individual invoices.

That third job belongs to the Certificado de Sello Digital (CSD), or Digital Seal Certificate. You generate it through the SAT portal using your e.firma, and it is what actually stamps each invoice with your digital seal. The CSD expires every four years, and there is a detail worth knowing before you build a business around it: under Article 17-H Bis of the Federal Tax Code, the SAT can temporarily restrict or permanently revoke your CSD if it detects irregularities in your filings, unpaid debts, or signs of simulated operations.3Gob.mx. Aclaración de Acuerdo con el Artículo 17-H Bis del CFF Once your CSD is restricted, you cannot issue any invoices until you resolve the underlying issue. That effectively freezes the business.

How You Actually Issue an Invoice

The SAT licenses third-party companies called Proveedores Autorizados de Certificación (PACs) to validate and stamp CFDIs. Dozens operate in Mexico, and their fees run from a few cents to about a dollar per invoice depending on volume. The main things to weigh when choosing one are integration with your accounting system, monthly invoice volume, and whether you need specialized supplements such as Carta Porte for freight or Nómina for payroll.

If your volume is low, the SAT offers a free tool through its portal and a mobile app called SAT Factura Móvil that generates CFDI 4.0 invoices at no cost. It works for individual taxpayers and small businesses, but it lacks the automation of commercial software.

Whatever tool you use, the flow is the same. You enter the invoice data, and your PAC runs a process called timbrado (stamping) that checks field formats, catalog codes, RFC validity, and XML structure against the SAT’s specifications. If everything passes, the PAC assigns a Folio Fiscal, a 36-character Universal Unique Identifier (UUID) that serves as the invoice’s permanent fingerprint. The PAC then transmits the certified record to the SAT’s central database.

Stamping produces two files. The XML file is the legally binding record. The PDF version is a human-readable representation for sharing with clients, but it is not the legal document. Either party can verify authenticity at any time through the SAT’s online lookup by entering the issuer’s RFC and UUID. Doing that check on invoices from new suppliers is a habit worth keeping, because accepting a CFDI from a company on the SAT’s blacklist creates problems for you, not just the issuer.

What Every CFDI Must Contain

Article 29-A of the Federal Tax Code sets out the required fields, and validation software rejects invoices with even minor discrepancies.42026.bado.mx. Requirements to Be Contained in the Digital Tax Receipts For both issuer and recipient, every invoice needs:

  • The full legal name exactly as it appears on the taxpayer’s Constancia de Situación Fiscal. Adding or omitting a corporate suffix like “S.A. de C.V.” causes rejection.
  • The RFC for both parties.
  • The Régimen Fiscal tax regime code from the SAT catalog. A mismatch with the taxpayer’s actual registration triggers rejection.
  • The five-digit postal code tied to the recipient’s registered tax address.
  • The CFDI use code indicating how the recipient will treat the expense (general expenses, merchandise acquisitions, fixed-asset investments, and so on).

The invoice also needs a transaction date, itemized descriptions with unit values, the total amount, and the payment method. Errors in any of these produce an invoice the recipient cannot deduct, which is why most businesses verify client data against the SAT’s tax situation lookup before issuing anything.

Product and Service Classification

Every line item must be classified with an eight-digit code from the SAT’s ClaveProdServ catalog, which covers thousands of standardized products and services. The SAT cross-references what businesses report selling against what their clients report buying, so misclassification is an audit flag. A fallback code (01010101) labeled “no specific classification” exists for genuine edge cases; using it on all your line items signals either carelessness or an attempt to hide what you are actually selling. The technical rules live in Annex 20 of the Resolución Miscelánea Fiscal.5Servicio de Administración Tributaria. Anexo 20 de la Resolución Miscelánea Fiscal

PUE, PPD, and the Payment Supplement

Every CFDI has to indicate whether the transaction was paid in full or remains outstanding, and this choice determines when Value Added Tax (IVA) gets recognized.

Select PUE (Pago en Una sola Exhibición) if you received full payment at the time of the transaction or will receive it in the same calendar month. The invoice is self-contained. Select PPD (Pago en Parcialidades o Diferido) if payment will come later, whether in installments or as a deferred lump sum. PPD triggers an additional obligation: every time you receive a payment against that invoice, you must issue a Complemento de Pago (payment supplement) linking it back to the original document. The deadline is the tenth calendar day of the month following the month you received the payment.

This is one of the most common places compliance breaks down. Marking an invoice PUE when payment does not actually arrive that month overstates your taxable income. Marking it PPD and then forgetting the Complemento de Pago blocks your client from deducting the expense or crediting the IVA.

Document Types Beyond Sales Invoices

The CFDI system covers more than sales, and using the wrong classification is an infraction:

  • Ingreso (Income) is the standard sales invoice for goods or services.
  • Egreso (Credit note) records refunds, discounts, or rebates that offset previously reported income. Without one, the original Ingreso stays on your books at full value.
  • Traslado (Transfer) is required when moving merchandise between locations and proves legal possession during transit.
  • Nómina (Payroll) is the official record of salary payments and tax withholdings, issued per pay period.
  • Pago (Payment supplement) is issued each time a partial or deferred payment is received against a PPD invoice.

Each classification has its own code, and the SAT’s automated matching will surface discrepancies between what you file and what your counterparts file.

Carta Porte for Freight

If your business moves physical goods on federal highways, rail, air, or waterways, you need the Carta Porte supplement attached to either an Ingreso or Traslado CFDI. Version 3.1 has been mandatory since July 2024, and it applies to all freight on federal routes regardless of what you are shipping. Vehicles with three or more axles get no distance exemption.

Carta Porte requires shipment origin and destination, a description of the goods, vehicle information, operator details, and route specifics. Hazardous materials add UN classification numbers, packaging type, and proof the driver holds a current hazmat license.6International Trade Administration. Mexico Carta Porte Supplement Update

Enforcement is real. Moving freight without a valid Carta Porte can bring fines of roughly $97,330 MXN per document, cargo seizure, loss of tax deductibility for the transportation expense, and vehicle impoundment. A paper version is not legally valid; the supplement must be a stamped CFDI issued through an authorized PAC.

Foreign Clients and Public Sales

Not every buyer has a Mexican RFC. The SAT publishes two generic codes for these situations. Use XAXX010101000 in the receiver field when a domestic customer does not provide their RFC. Use XEXX010101000 for foreign clients with no Mexican tax registration.

For businesses making frequent small sales to the general public, issuing one CFDI per transaction is impractical. The SAT allows a Global Invoice that aggregates sales on a daily, weekly, monthly, or bimonthly basis. The CFDI must be issued within 24 hours of the close of the period it covers, must itemize the individual transaction amounts, and must separately break out IVA and any applicable special taxes (IEPS). The receiver field uses the generic RFC.

Cancelling a CFDI Correctly

Cancellations are formal. Every one requires a reason code:

  • Code 01: the invoice has errors and you are issuing a corrected replacement.
  • Code 02: the invoice has errors but no replacement is needed.
  • Code 03: the transaction never took place.
  • Code 04: the transaction was already included in a global invoice.

Most cancellations require the recipient’s approval through the Buzón Tributario (Tax Mailbox). The recipient has three business days to accept or reject the request, and silence counts as acceptance. Two exceptions let you cancel without the recipient’s involvement: invoices under $1,000 MXN, and invoices cancelled within 24 hours of issuance.

The 2026 tax reform extended the outer deadline. You can now cancel a CFDI up through the month in which you file your annual income tax return for that fiscal year, provided the recipient approves. Miss even that extended window and the penalty is 5% to 10% of the invoice’s total value. It is one of the more common fines the SAT assesses, and it adds up quickly across multiple invoices.

Penalties and the 2026 Veracity Rule

Failing to issue a CFDI at all, or issuing one that does not meet the mandatory requirements, triggers penalties under Articles 83 and 84 of the Federal Tax Code. The range runs from roughly $21,420 MXN to $122,440 MXN depending on the severity of the infraction.

A 2026 addition to Article 83 also makes it an infraction to condition CFDI issuance on the customer presenting a government-issued ID or Tax Situation Certificate. Refusing to invoice a customer who does not bring those documents now carries administrative penalties.

False Invoices Under Article 69-B

The heaviest consequences attach to simulated operations. Under Article 69-B of the Federal Tax Code, the SAT maintains a public blacklist of taxpayers it has determined lack the assets, personnel, or infrastructure to actually deliver what their invoices describe.7Servicio de Administración Tributaria. Contribuyentes Publicados y Acciones Contra la Delincuencia Once a taxpayer is on that list, the SAT presumes every operation covered by their invoices never happened.

The fallout hits both sides. The issuer’s name and RFC are published in the official gazette and on the SAT website. If you are the recipient and deducted those invoices, you have 30 days to correct your filings. Failing to do so means losing the deductions, forfeiting any IVA credits claimed, paying the resulting tax difference with surcharges and inflation adjustments, and potentially facing criminal prosecution of three months to six years in prison. The SAT has invested heavily here since 2026, including a new fast-track inspection process under Article 49 Bis that can suspend a taxpayer’s invoicing rights immediately upon opening an investigation and resolve the case within 24 business days.

The New Veracity Requirement

A 2026 provision added to Article 29-A explicitly requires that every CFDI reflect a real, truthful transaction. The SAT now has the authority to demand evidence that the operation actually occurred, including photographs, videos, or other digital documentation. You have five business days to respond. If the SAT concludes a CFDI is false, the consequences mirror Article 69-B: public listing, loss of deductions for counterparts, and potential criminal liability.

Record Retention and Monthly Accounting

You must keep all accounting records, including XML invoice files, for at least five years from the date you filed the corresponding tax return. If you fail to maintain records for that period, do not have an RFC, or never filed a return for the relevant year, the statute of limitations for the SAT to audit you stretches to ten years.

Beyond storage, businesses submit digital accounting records to the SAT electronically each month. Submissions include the chart of accounts (whenever it changes) and a trial balance showing opening balances, debits, credits, and closing balances. The SAT can also request detailed journal entries. Everything is delivered as XML files through the SAT portal, giving the tax authority a real-time view of your financial activity that goes well beyond invoice data.

Deadlines at a Glance

  • Complemento de Pago: issue by the 10th calendar day of the month after you receive a payment on a PPD invoice.
  • Global invoice: issue within 24 hours after the close of the aggregation period.
  • CFDI cancellation: no later than the month in which you file your annual income tax return for that fiscal year.
  • Cancellation recipient response: three business days from notification; silence counts as acceptance.
  • Record retention: five years from the filing date of the return (ten years if records were not properly maintained).
  • Monthly digital accounting: submitted through the SAT portal each month.

Missing any of these compounds. A late Complemento de Pago blocks your client’s deduction. A missed cancellation window costs you 5% to 10% of the invoice value. Inadequate record retention doubles the audit window the SAT has to come looking.