Invoice Requirements in Mexico: Legal Rules for 2026

TL;DR: Mexico requires all invoices to be issued as CFDI (Comprobante Fiscal Digital por Internet) through SAT-certified PAC providers, with UUID, digital stamps, and 16% IVA (or 8% in border regions). XML is the legal document -- retain it alongside PAC acknowledgements for at least five years.

Mexican IVA compliance runs through Comprobantes Fiscales Digitales por Internet (CFDI), issued via PAC providers and validated by the SAT. A pretty PDF without UUID, Timbre fiscal digital, and matching XML is usually useless for buyer deductions and internal audit. Complementos extend CFDI for carta porte, leases, payroll, and other regimes—your template must stay aligned with the Régimen Fiscal and Uso CFDI you actually operate under. This guide reflects 2026 expectations for ordinary B2B; it is not legal advice. Confirm 8% border rules, withholdings, and maquila structures with your contador. Multinationals often run parallel CFDI series per legal entity—never share folios across RFCs.

Required fields

CFDI 4.0-era invoices carry RFC for issuer and recipient, UUID, serie/folio, Fecha y hora de emisión, ClaveProdServ and ClaveUnidad per line, ObjetoImp, Traslados and Retenciones with correct rates, subtotals and totals, and digital certificates from the SAT. Notas de crédito must reference original UUIDs and adjust tax consistently. Carta porte and other complements attach when statute demands—omission can block logistics payments even when IVA math is otherwise fine.

Tax rules (VAT/GST/sales tax rates)

The general IVA rate is 16% across much of Mexico; certain border regions may apply 8% on qualifying transactions—verify SAT tables before freezing template footers. Zero-rated exports and specific transactions need correct tipo de comprobante and evidence. ISR withholdings on professional services often appear as retenciones on the CFDI; separate them clearly from IVA lines for AP teams. Maquila and IMMEX programmes demand complementos that generic templates omit—loop trade compliance into invoice design reviews.

Language requirements

Spanish is mandatory for SAT catalogue fields and official descriptions. English contract clauses do not replace códigos and regímenes printed on the fiscal XML.

Digital invoicing rules

PAC validation responses are part of your audit trail—archive XML, human-readable PDFs, and acknowledgements. Cancellation flows often need customer acceptance; avoid silent edits to issued files. Enterprise customers may reconcile UUID against portal uploads daily. Localisation of catalogue codes matters—ClaveProdServ mistakes are a top reason PAC rejections spike after SKU launches.

Invoice numbering rules

CFDI numbering uses a serie (series) and folio (sequential number) structure. The serie is an optional alphanumeric prefix (up to 25 characters) that groups invoices by type or business unit. The folio is a sequential number (up to 40 characters) within that series. While the serie is optional in the XML schema, most businesses use it to organize different document flows. The UUID (Universally Unique Identifier) assigned by the PAC upon timbrado (stamping) is the definitive unique identifier of each CFDI -- it is globally unique and non-reusable. Credit notes (notas de credito) use document type E (Egreso) and must reference the original CFDI's UUID in the CfdiRelacionados section. Cancelled CFDI must be formally cancelled through the SAT portal or PAC, with a reason code -- the UUID remains in the system as cancelled and cannot be reused. Never reuse folios across different RFCs (legal entities). Gaps in folios are not illegal but should be documented -- unexplained gaps combined with cancelled UUIDs may attract SAT scrutiny.

Common exemptions and special cases

The Regimen Simplificado de Confianza (RESICO) is available to individuals with annual income up to approximately MXN 3.5 million, offering simplified tax rates (generally 1% to 2.5% of income). RESICO participants still issue CFDI but with their specific Regimen Fiscal code. RIF (Regimen de Incorporacion Fiscal) was phased out in favour of RESICO but legacy taxpayers may still exist during transition periods. Zero-rated (tasa 0%) exports require CFDI with the correct tipo de comprobante and supporting customs documentation. Exempt transactions use the Exento tag in the XML rather than a 0% rate -- do not confuse the two. ISR withholdings (retenciones) on professional services, rent, and certain payments must appear as Retenciones on the CFDI, separate from IVA lines. The 8% IVA border region stimulus applies to specific municipalities along the northern and southern borders for qualifying activities -- verify SAT's list of eligible locations and activities before applying the reduced rate. Carta Porte complement is mandatory for the transport of goods on federal highways and must accompany the CFDI for the transaction. Complemento de Comercio Exterior is required for export operations. IMMEX and maquila operations may require specific complements and regime codes.

Record retention requirements

Mexican fiscal law requires retention of CFDI XML, accounting records, and supporting documentation for five years from the date the relevant tax return was filed. For tax losses being carried forward, records must be retained for the entire carry-forward period plus five years. The XML (including the PAC's digital stamp) is the legal fiscal document -- PDF representations are auxiliaries. Cancelled CFDI must also be retained with their cancellation acknowledgements and reason codes. SAT may request records electronically during audits, and your accounting system must be able to produce standard accounting XML files (contabilidad electronica) that reconcile to your CFDI history. Archive PAC acceptance logs alongside the XML. If you switch PAC providers, ensure historical records remain accessible for the full retention period. Monthly accounting XML submissions to SAT (for some taxpayers) create another layer of traceability that must be consistent with your archived CFDI.

E-invoicing status

Mexico has one of the most mature mandatory e-invoicing systems in the world. CFDI has been mandatory for virtually all taxpayers since 2014, with the current version being CFDI 4.0 (mandatory since April 2023). The system works through PAC (Proveedores Autorizados de Certificacion) -- certified service providers that validate and stamp (timbrar) CFDI XML with the SAT's digital seal. The process is: the taxpayer generates XML, sends it to a PAC, the PAC validates it against SAT catalogues and the taxpayer's fiscal data, stamps it with a Timbre Fiscal Digital (TFD), and returns the stamped XML with a UUID. CFDI 4.0 requires mandatory validation of the recipient's RFC, name, Regimen Fiscal, and Uso del CFDI against SAT's registration database -- invalid data causes rejection. The system supports numerous complementos (structured extensions) for specific transaction types: Carta Porte for transport, Comercio Exterior for exports, Nomina for payroll, Pagos for payment receipts, and more. SAT uses CFDI data for pre-filled return proposals and automated risk profiling. Mexico's model has influenced e-invoicing implementations across Latin America.

Penalties

The SAT may assess tax, fines, and recargos (surcharges) for invalid CFDI, late issuance, missing complements, or ledger mismatches. Failure to issue CFDI when required carries a penalty of 5% to 10% of the transaction amount for each unissued document. Issuing CFDI with errors (wrong RFC, incorrect amounts, missing complements) can attract penalties ranging from MXN 17,000 to MXN 97,000 per infraction (these amounts are indexed annually and change each fiscal year -- check the SAT's updated penalty tables). Late cancellation penalties apply when CFDI are cancelled outside the permitted timeframe. Recargos (interest on late-paid tax) accrue monthly at rates published by Congress (typically 1% to 1.5% per month). For fraud (such as operations with companies issuing invoices for non-existent transactions, known as EFOS/EDOS), the consequences are severe: the SAT publishes lists of suspected companies (Article 69-B of the Fiscal Code), and taxpayers who deducted those CFDI must self-correct or face 100% of the deducted amount plus penalties. Criminal prosecution for tax fraud under the National Fiscal Code can result in imprisonment of three to nine years for standard tax fraud. AP teams may withhold cash until UUID checks pass.

Before each CFDI batch job, validate RFC, Uso CFDI, and Regimen Fiscal against SAT catalogues. Keep a changelog of complementos attached to recurring services so seasonal adjustments do not orphan historical UUID chains. Monthly, reconcile PAC acceptance logs to accounts-receivable subledgers.

FAQ

What is the difference between CFDI cancellation and a credit note? CFDI cancellation voids the entire document as if it never existed (for accounting and tax purposes), while a credit note (nota de credito, tipo E) partially or fully offsets a valid CFDI that remains in the record. Cancellation requires the recipient's acceptance (for CFDI over MXN 1,000) and must be done within the same fiscal year the CFDI was issued (or by the time the annual return is filed). Use cancellation for invoices issued in error; use credit notes for legitimate adjustments like returns, discounts, or renegotiated terms.

Do I need a PAC to issue CFDI? Yes. All CFDI must be stamped (timbrado) by a SAT-certified PAC. You cannot issue valid CFDI directly without PAC involvement. SAT publishes the list of authorized PACs on its website. Many accounting software packages integrate with one or more PACs. SAT also offers a free CFDI generation tool on its portal for low-volume taxpayers, which uses SAT's own PAC certification.

What happens if my PAC rejects a CFDI? A PAC rejection means the CFDI failed validation against SAT catalogues or the recipient's fiscal data. Common causes include incorrect RFC, mismatched recipient name, invalid Regimen Fiscal or Uso CFDI, or malformed XML. The CFDI is not issued -- no UUID is assigned, and the document has no fiscal validity. You must correct the error and resubmit. High rejection rates often indicate stale customer master data -- validate RFC and fiscal attributes before each billing run.

How do I handle the Carta Porte complement? The Carta Porte complement is mandatory for transporting goods on federal roads, railways, rivers, or by air. It must be attached to the CFDI (either a transportation invoice or a transfer CFDI) and includes details about the goods, vehicle, driver, route, and origin/destination. Goods transported without a valid Carta Porte may be seized by authorities. The complement requirements have evolved through multiple versions -- ensure your system uses the latest SAT-published version and test new routes before the first shipment.

Template link

Use our Mexico invoice template as a summary layout alongside your PAC-authorised XML. Read the invoice tax compliance guide and tax rate lookup tool. Official references include SAT and the SAT portal home. Join InvoiceQuickly early access to keep Mexico aligned with your North American operations.