- Home
- Apps
- SaaS Tools
- Spain Veri*factu & SII
Illustrative previewA build-to-order Dynamics 365 Business Central extension that produces hash-chained Veri*factu invoice records
with QR at posting and submits SII ledgers to the AEAT on a job queue.
ECOSIRE builds it for your version and deployment model, then hands over the full AL source.
What is Spain Veri*factu & SII?
A build-to-order Dynamics 365 Business Central extension that produces hash-chained Veri*factu invoice records with QR at posting and submits SII ledgers to the AEAT on a job queue. ECOSIRE builds it for your version and deployment model, then hands over the full AL source. Built to order by ECOSIRE for Dynamics 365 BC (build-to-order) — indicative price from $999.00 USD; request a quote for a scoped proposal.
Key Features
Built to order, done for you
No DIY setup — a working app, built, installed and supported by ECOSIRE.
- 1
You order
Start with a one-time build price. We scope it with you at kickoff.
- 2
We build & install
ECOSIRE builds, configures and installs it on your Dynamics 365 Business Central.
- 3
Go live + support
You go live in about one working week, with two weeks of go-live support. Defects in the code we deliver are fixed free of charge.
About this Product
Spain has moved invoicing from a bookkeeping obligation into a software obligation. Verifactu, under the anti-fraud law and its invoicing-software regulation, requires that the system issuing the invoice produce an unalterable, hash-chained record at the moment of issue, carry a QR code on the printed or electronic document, and keep an event log that proves nothing was edited afterwards. SII, in force for large filers and VAT groups, requires the VAT ledgers themselves to be transmitted to the AEAT within days of issue or receipt. Dynamics 365 Business Central handles Spanish VAT posting, VAT statements and the 347/349 style reporting well, but it stops short of both of these: there is no Verifactu record, no chain hash, no QR, and no SII web-service client in the base application. Finance teams therefore either key ledgers into the AEAT portal by hand, or bolt on a bridge that lives outside the ERP and immediately drifts from the posted documents it is supposed to represent.\n\nECOSIRE builds a Business Central AL extension that puts both obligations inside the system that already posts the invoice. A table extension on the sales invoice, credit memo and posted equivalents carries the Verifactu fields — record hash, previous record hash, chain sequence, issue timestamp, QR payload — and a codeunit subscribed to the posting events (OnAfterPostSalesDoc and the equivalent service and finance-charge publishers) writes the record in the same transaction that creates the posted document. Because the record is created by an event subscriber rather than a scheduled sweep, there is no window in which a posted invoice exists without a compliant record. The QR is rendered into the report layout so the human-readable document and the machine record come from one posting, not two processes that can disagree.\n\nThe SII side is a separate codeunit set that assembles the issued-invoice, received-invoice and, where in scope, investment-goods and intra-community ledgers, signs the SOAP envelope with your AEAT-registered certificate, and posts to the AEAT endpoint on a job queue entry at whatever cadence your filing profile requires. Tax codes are not re-keyed: clave de régimen, exemption causes and operation types are derived from your existing VAT Posting Setup, VAT Clauses and customer or vendor master data, with a small mapping page for the AEAT-specific codes Business Central does not model. Every submission stores the request, the AEAT response, the CSV and the per-line status. Rejected or partially accepted lines land on a correction worklist page where a finance user sees the AEAT error code in plain language, edits the offending field, and resubmits — the chain and the audit trail record both attempts, which is what an inspection actually asks for. Permission sets separate the person who corrects a rejection from the person who can view the immutable log, and API pages (REST v2.0 / OData v4) expose submission status so Power BI, Power Automate or a Dataverse-connected app can watch the filing position without a database login.\n\nThis is a build-to-order product, not an AppSource download. After a short scoping call we confirm your Business Central version and release wave, SaaS or on-premises, your filing profile (Verifactu only, SII only, or both), which document types and companies are in scope, your certificate handling, and any posting customisations we must respect. We then build against that specification, test on your sandbox against the AEAT test service, and hand over the compiled extension together with the full AL source in your own git repository. Typical delivery is one working week from confirmed scope. You get installation, configuration, documentation, a training session, UAT with a rollback plan, and a post-go-live support window with a named engineer — and because you hold the source, no future change to your AEAT position is gated on our roadmap.
What you get
- Complete AL extension source for your Business Central version and deployment model (SaaS per-tenant extension or on-premises), compiled and signed as required
- Installation and configuration on your sandbox and production environments, including permission sets, job queue entries and AEAT certificate wiring
- Technical documentation: object ID ranges, table and page extensions, codeunit responsibilities, event subscribers, API pages and integration points
- End-user guide covering daily invoicing, SII batch submission, rejection correction and the Veri*factu audit report, plus one live training session for finance and IT
- User acceptance testing on a staging environment against the AEAT test service, with a documented test script and signed-off results
- Documented rollback plan and a tested uninstall path, so the extension can be removed without leaving orphaned data
- Post-go-live support window with a named engineer for defect fixes, AEAT rejection triage and configuration questions
- Git repository handover with full commit history, branch strategy and build instructions, transferred to your organisation
Who this is for
Financial Controller, Spanish operating entity
Owns the VAT position and signs the filings. Needs the Veri*factu record and the SII ledger to be produced by the same posting that creates the invoice, so the numbers filed with the AEAT reconcile to the general ledger without a spreadsheet in the middle. Wants rejections visible to their own team, not sitting in an IT mailbox.
Group Tax Manager, multi-entity group
Files for several Spanish legal entities with different régimen codes and, sometimes, different certificates. Needs per-company configuration inside one installation, a consistent mapping from the group chart of accounts to AEAT codes, and a defensible audit trail showing every submission and correction across all companies.
Business Central Solution Architect or IT Manager
Responsible for the environment and its extensions. Wants an additive per-tenant extension with agreed object ID ranges, no base-object modification, documented event subscribers, permission sets that fit existing role centres, and full AL source in the company git repository so the organisation is not locked to a vendor's release cadence.
Accounts Receivable / Billing Lead
Issues the invoices day to day. Needs the QR and record to appear without extra steps at posting, and needs a rejection worklist that explains the AEAT error in language a finance user can act on, correct in place and resubmit — rather than raising a ticket and waiting.
How Spain Veri*factu & SII Compares
| Criterion | ECOSIRE | Custom Build | Competitor | Dynamics 365 Business Central Native |
|---|---|---|---|---|
| Veri*factu record chain | Hash-chained invoice records generated at posting inside Business Central, with QR and chain fields stored on the posted document | Chain logic written from scratch; every AEAT spec revision is your own maintenance | Usually present, but the chain state lives in the vendor's cloud service rather than your tenant | No Veri*factu record, no hash chain, no QR generation |
| SII ledger submission | Job queue driven batches to AEAT SII SOAP endpoints with per-line CSV and response persistence | You build the SOAP client, certificate handling, and retry logic yourself | Included, but often only for the ledgers the vendor chose to support | No SII connectivity; ledgers must be keyed into AEAT portal or Excel |
| Tax mapping source | Derived from your existing VAT Posting Setup, VAT Clauses and customer/vendor master data, extended only where AEAT needs extra codes | Mapping tables designed per project, quality depends on the developer's Spanish VAT knowledge | Vendor's own mapping tables that you configure to match your chart of accounts | Spanish VAT posting exists; AEAT-specific régimen and clave codes do not |
| Rejection handling | Rejected submissions land in a correction worklist with AEAT error codes, editable fields and resubmission from the same page | Typically an error log; the correction workflow is extra scope nobody budgets | Error list provided; depth of guided correction varies by vendor | Nothing to reject, since nothing is submitted |
| Fit to your customisations | Built against your actual posting routines, dimensions and document flows before handover | Fits perfectly, at full cost and full ongoing ownership | Generic; your customisations are worked around, not designed for | Not applicable |
| Source code ownership | Full AL source in your git repository, buildable and modifiable by any AL developer | You own it because you paid to write it | Compiled AppSource app; source is not yours | Microsoft base application |
| Deployment target | Per-tenant extension for SaaS or on-premises deployment, current release waves supported | Whatever you build for | AppSource SaaS only in most cases | Ships with the base app |
| Ongoing cost shape | One-time build with an agreed post-go-live support window; renewals are optional, not a licence lock | Development cost plus permanent internal maintenance | Per-company or per-user subscription for as long as you invoice in Spain | None, but the compliance gap remains |
Frequently Asked Questions about Spain Veri*factu & SII
How long does delivery take?
This is a build-to-order extension, so nothing is downloaded on purchase. Typical delivery is one working week from confirmed scope — that is, from the point where we have agreed your Business Central version and deployment model, your filing profile (Veri*factu, SII or both), the document types and companies in scope, and any posting customisations we must respect. Scope with unusual document flows, multiple legal entities or heavy customisation of the posting routines can extend that, and we tell you before the build starts rather than after.
Does this make us compliant on its own?
It gives Business Central the technical capability the regulation requires: a hash-chained unalterable invoice record produced at posting, the QR on the document, the event log, and the SII ledger submissions. Compliance also depends on your AEAT registration, your certificate, your filing profile and your own tax positions, which your tax adviser owns. We build and test the software side against the AEAT test environment, and we document exactly what the extension does and does not cover so your adviser can sign it off.
What happens when the AEAT rejects a submission?
Rejected and partially accepted lines land on a correction worklist page inside Business Central with the AEAT error code, the returned message and the affected document. A finance user corrects the offending field and resubmits from the same page. Both the original submission and the correction are retained with their responses and CSVs, so the audit trail shows the full history rather than only the accepted version.
How is support and updates handled after go-live?
Every build includes a post-go-live support window with a named engineer covering defect fixes, AEAT rejection triage and configuration questions. Beyond that window you can take an ongoing support agreement, or maintain it yourself — you hold the full AL source in your own git repository, so any competent AL developer can build and change it. When the AEAT publishes a specification change, or a Business Central release wave changes an API or event signature we depend on, we quote the update as a defined piece of work; there is no subscription that switches the extension off if you stop paying.
Will it work on our version of Business Central, and on-premises?
Yes. We build against your specific version and release wave, for SaaS as a per-tenant extension or for on-premises deployment. On-premises installations often make certificate handling simpler because the certificate can sit on the service tier; SaaS installations use the certificate handling appropriate to the online environment, which we confirm during scoping. Tell us your version at the scoping call and we build for it rather than asking you to upgrade first.
How does it interact with our existing customisations and other extensions?
The extension is additive: table and page extensions plus event subscribers, no modification of base objects. During scoping we review your existing extensions and any customised posting routines so the subscribers fire in the correct order and no other app's logic is bypassed. If a conflict exists we identify it before the build, not during UAT. Object ID ranges are agreed with you so they do not collide with what you already have installed.
Can other systems read the filing status?
Yes. API pages built on REST API v2.0 / OData v4 expose the Veri*factu record and SII submission status, so Power BI can report on the filing position, Power Automate can raise an alert on a rejection, and a Dataverse-connected app can surface status to users who do not have a Business Central licence. Which entities are exposed is part of the scope conversation, since some organisations deliberately keep the audit log read-restricted.
Related Modules

SMS for Dynamics 365 CRM (Twilio/Multi-Gateway)
Two-way SMS texting with automation and bulk campaigns inside Dynamics 365 Business Central, built and installed by ECOSIRE as a per-tenant AL extension over Twilio, Vonage, or MessageBird.

SMS & Notifications for Business Central
A per-tenant AL extension that fires transactional SMS (order confirmations, payment reminders, delivery alerts) directly from Business Central posting and workflow events. Built, installed and supported by ECOSIRE on your environment.

Stored Cards & PCI Token Vault for Business Central
A gateway-agnostic tokenization layer that stores customer cards on file in Business Central with zero PAN data, reducing PCI scope to SAQ-A and enabling one-click rebill on recurring orders.

Stripe Payments & Reconciliation for Business Central
A per-tenant Business Central AL extension that lets your customers pay posted sales invoices online via Stripe (card, ACH, wallets), then automatically posts the payment, Stripe fee and payout and reconciles the bank deposit — built, installed and supported by ECOSIRE on your tenant.
Spain Veri*factu & SII
A build-to-order Dynamics 365 Business Central extension that produces hash-chained Veri*factu invoice records with QR at posting and submits SII ledgers to the AEAT on a job queue. ECOSIRE builds it for your version and deployment model, then hands over the full AL source.
- Veri*factu invoice record generated inside the posting transaction via event subscribers on the sales, service and finance-charge posting codeunits, so no posted document can exist without its compliant record
- Hash-chained record fields (record hash, previous hash, chain sequence, issue timestamp) held on table extensions of the sales invoice, credit memo and their posted counterparts
- QR payload generated and rendered into the invoice report layout, so the human-readable document and the machine record derive from one posting
- Immutable event log with insert-only behaviour and no user-facing delete or modify path, backed by a dedicated permission set for audit-only access