A CFO at a mid-market industrial equipment manufacturer discovers, during a review of LATAM subsidiaries, that the Mexican entity has been issuing customer invoices in CFDI 3.3 — the format retired by the SAT since April 2023. Every invoice issued since that date is technically non-compliant. The corresponding tax deductions are at risk. Remediation is urgent, and the issue was never escalated to group level.
This kind of situation is more common than corporate headquarters tend to assume. Mexico has built one of the world’s most advanced electronic tax control systems, with a fundamental new requirement in CFDI 4.0: real-time validation of your customer’s RFC before each invoice is issued. An ERP that is not localised or not updated cannot legally operate a Mexican subsidiary.
What CFDI 4.0 Is and Why This Version Changes Everything
The SAT and the Evolution of CFDI Since 2004
The CFDI (Comprobante Fiscal Digital por Internet) is the mandatory electronic tax document for all commercial transactions carried out by legal entities domiciled in Mexico. Managed by the SAT (Servicio de Administración Tributaria), Mexico’s tax authority, the CFDI has gone through several major versions since its introduction in 2004, each strengthening the level of real-time control.
Version 3.3, introduced in 2017 and made mandatory in 2018, represented the first major break with the standardisation of SAT catalogues for products and services. CFDI 4.0 goes much further: it requires cross-validation of the invoice recipient’s tax data at the moment of issuance.
The Structural Changes in CFDI 4.0
CFDI 4.0 became the only valid format in Mexico from 1 April 2023 for commercial invoices, and from 1 July 2023 for payroll slips (Nómina). According to the official SAT communiqué published in January 2024, more than 10 billion 323 million CFDIs were issued throughout 2023, averaging 327 invoices per second (SAT, Comunicado 18-2024, gob.mx).
The fundamental break with version 3.3 comes down to one point: the invoice recipient must be validated in real time in the SAT register before the invoice is certified by the PAC. In version 3.3, it was enough to enter the RFC (Mexico’s equivalent of a company registration number) of the customer. In version 4.0, four fields must exactly match the official taxpayer record:
- The company name (razón social / nombre) — exactly as registered with the SAT
- The RFC — tax identifier of 12 or 13 characters
- The Régimen Fiscal — the recipient’s tax regime code (e.g. 601 for legal entities under the general regime)
- The Código Postal fiscal — the postal code of the tax-registered head office
If any one of these four fields does not match exactly, the PAC refuses certification and the invoice cannot be issued. For a Mexican subsidiary issuing hundreds of invoices per day, this means a simple address update at a customer’s end can halt the entire invoicing chain if the ERP is not synchronised with SAT data.
Who Is Affected
Every legal entity registered in Mexico — subsidiary, permanent establishment, joint venture — is subject to CFDI 4.0 from the very first peso of commercial transaction. There is no revenue threshold or simplified regime for subsidiaries of foreign groups.
The Fields and Complements Your ERP Must Be Able to Generate
The Core of CFDI 4.0
Beyond recipient validation, CFDI 4.0 mandates a set of structured fields linked to SAT catalogues: the product or service code (c_ClaveProdServ), the unit of measure (c_ClaveUnidad), tax breakdowns (IVA, IEPS, withholdings), the payment method (PUE for immediate payment, PPD for deferred payment), and the currency.
The subsidiary’s ERP must be able to produce the CFDI XML compliant with the XSD schema (Annex 20 of the CFF), transmit it to the PAC for certification, receive the fiscal stamp (TFD) in return, and archive it. None of these steps are manual in a well-configured organisation.
The Three Critical Complements by Business Flow
Beyond the base CFDI, three complements are mandatory depending on the nature of operations:
Carta Porte 3.0 — Goods Transport. This complement is mandatory for any transport of goods within Mexico, regardless of the value of the goods and regardless of the mode of transport (road, rail, air, sea). Since 1 January 2024, only version 3.0 is accepted by the SAT. Non-compliance sanctions are immediate: a fine of 400 to 600 pesos per CFDI issued without the complement, and from 760 to 14,710 pesos if the carrier cannot present the Carta Porte during a roadside inspection (Expeditors, Mexico Carta Porte 3.0 enforcement 2024). For an industrial subsidiary with significant logistics flows, integrating this complement into the ERP’s transport orders is non-negotiable.
Nómina 1.2 — Payroll. The Mexican payslip is a CFDI in its own right. Every payslip issued since 1 July 2023 must be in CFDI 4.0 format with the Nómina 1.2 complement. This applies to all Mexican employees of the subsidiary. The ERP’s payroll module — or a connected HRIS — must comply with this standard.
Pago 2.0 — Deferred Settlements. When an invoice is issued with the PPD payment method (Pago en Parcialidades o Diferido), each partial or full receipt must give rise to the issuance of a payment complement CFDI with the Pago 2.0 complement. This is the fiscal proof that the counterparty has paid — required to validate VAT (IVA) deductibility on the buyer’s side.
The PAC: The Mandatory Intermediary Your ERP Must Integrate
What a PAC Is and Why No ERP Can Do Without One
The PAC (Proveedor Autorizado de Certificación) is a private service provider certified by the SAT to affix the Timbre Fiscal Digital (TFD) to each CFDI. Without this stamp, the invoice has no legal or fiscal value in Mexico. The SAT does not accept self-signed invoices from issuers: third-party certification by an authorised PAC is mandatory for 100% of CFDIs.
The technical flow is as follows: the ERP generates the compliant XML, transmits it to the PAC via API or middleware, the PAC validates compliance with SAT catalogues and affixes the digital signature (TFD), then the ERP receives the certified XML and can archive and transmit it to the customer. This cycle typically runs in a few seconds.
Recommended Certified PACs for European Groups
Four PACs are particularly well-suited to the needs of mid-market and large European companies operating in Mexico:
- Edicom: a long-established PAC, SAT-certified since 2010 (EDICOM, Mexico e-invoicing). Offers native connectors for SAP S/4HANA Cloud.
- Sovos: international tax compliance specialist, particularly suited to groups with multi-country LATAM needs.
- Invoiceware International: enterprise-focused with high-volume capability, offering integration with major ERP platforms.
- Pegaso TSI: a PAC referenced in SAP DRC native integrations for the Mexican market.
The choice of PAC must align with the group’s ERP solution: some ERPs offer certified connectors for specific PACs, which simplifies the maintenance of regulatory updates (such as the Annex 20 update planned for 1 January 2026 introducing 847 new product/service codes).
ERP Configuration by Platform
SAP S/4HANA: SAP Document and Reporting Compliance
SAP manages Mexico localisation via the SAP Document and Reporting Compliance (DRC) module, formerly known as SAP eDocument. CFDI 4.0 compliance has been available since SAP S/4HANA Cloud 2202.2 (Interface Version 4) according to SAP documentation. The SAP DRC module includes certified connectors to Edicom and Pegaso TSI PACs, covering standard CFDI, Carta Porte, and Nómina.
Note: Annex 20 of the CFF will be updated on 1 January 2026 with 847 new product/service codes and strengthened validation rules (PIKON SAP Consulting, Mexico CFDI 4.0 2026 update). SAP S/4HANA Cloud customers receive these updates via quarterly releases. On-Premise customers must ensure their Support Packages include these changes.
Oracle Fusion Cloud Finance: Native Mexico Localisation
Oracle Fusion Cloud integrates Regulatory Features Mexico in its Finance Cloud suite. The platform supports CFDI 4.0 and Mexican regulatory updates via its quarterly release cycles. Oracle Fusion Cloud HR also covers CFDI Nómina 1.2 for Mexican payroll. For groups that have standardised on Oracle Fusion globally, the Mexican subsidiary can be onboarded onto the Oracle localisation without deploying a satellite ERP.
Dynamics 365 Finance: CFDI 4.0 from Version 10.0.27
Microsoft Dynamics 365 Finance has supported CFDI 4.0 since version 10.0.27, available from June 2022 according to official Microsoft documentation (Microsoft Learn, CFDI layout version 4.0). Configuration is done via the Electronic invoice parameters page, where version 4.0 and the associated XML schemas are selected. Dynamics 365 Business Central also has a Mexico localisation for smaller organisations.
Odoo 17/18: l10n_mx Module
Odoo offers the l10n_mx (Mexico localisation) module for versions 17 and 18, available on the Odoo App Store. This module covers standard CFDI, Carta Porte, and Nómina. For Mexican subsidiaries of groups using Odoo as their group ERP, this is a viable option. For a standalone subsidiary with high volumes, the PAC API integration should be verified against specific requirements.
Record Retention and SAT Audit Risks
Five Years of Mandatory Retention
Article 30 of the Federal Fiscal Code (CFF) requires a five-year retention period for all tax documents, including issued and received CFDIs as well as SAT acknowledgements (Acuse de recibo). Standard NOM-151 provides a strengthened legal framework for electronic archiving by applying certified digital timestamps to retained documents (EDICOM, Electronic invoicing Mexico).
For a European group with a Mexican subsidiary, this means CFDI archiving cannot be delegated to unstructured cloud storage: the XMLs must be accessible, intact, and timestamped for five years, with complete traceability of the TFD for each invoice.
How SAT Electronic Audits Work
The SAT has an electronic audit system (Auditoría Electrónica) provided for in Article 42 of the CFF. Unlike traditional paper-based audits, the electronic audit is conducted entirely digitally: the SAT notifies the company via its fiscal mailbox (Buzón Tributario), sends observations or information requests, and awaits a documented response within the prescribed deadlines.
The SAT cross-references CFDI data issued and received by both parties to a transaction. If a supplier declared a sale but the corresponding customer did not declare the purchase, or if the amounts diverge, the system automatically detects the inconsistency. For a European group subsidiary, the risk is real if local accounting is not regularly reconciled with archived CFDIs.
Non-Deductibility as the Primary Sanction
The most significant fiscal penalty is not a direct fine but the refusal of deductibility. Any received invoice that does not correspond to a valid, certified, and archived CFDI is not tax-deductible in Mexico. For an industrial subsidiary with significant purchasing activity, the impact on taxable income can be substantial. This is why verifying the CFDI compliance of suppliers is just as important as managing the subsidiary’s own issuances.
CFDI 4.0 Compliance Checklist: 12 Points
Before validating your Mexican subsidiary’s compliance, check these twelve points:
- CFDI version: all issued invoices are in version 4.0 (no CFDI 3.3 after 1 April 2023)
- Recipient RFC validation: the ERP validates the 4 fields in real time (razón social, RFC, Régimen Fiscal, CP fiscal) before each issuance
- SAT-certified PAC: an SAT-authorised PAC is integrated into the issuance flow (Edicom, Sovos, Pegaso TSI, Invoiceware)
- Carta Porte 3.0: all goods movements within Mexican territory are covered by a CFDI + Carta Porte 3.0 complement
- Nómina 1.2: payslips for Mexican employees are generated in CFDI 4.0 format from 1 July 2023
- Pago 2.0: settlements on PPD invoices give rise to a payment complement CFDI
- SAT catalogue codes: product/service codes (c_ClaveProdServ) and units of measure (c_ClaveUnidad) are current per the applicable Annex 20
- 5-year archiving: CFDI XMLs + TFDs are securely archived for at least 5 years (Art. 30 CFF)
- Active Buzón Tributario: the subsidiary’s SAT fiscal mailbox is monitored and notifications processed within deadlines
- Supplier CFDI reconciliation: received CFDIs from suppliers are validated and reconciled against accounting entries
- ERP regulatory update plan: the maintenance plan for the Mexico localisation module is confirmed with the ERP vendor (particularly for January 2026)
- PAC disconnection testing: a continuity plan is defined for PAC unavailability (invoices cannot be issued without it)
To go further on international electronic tax compliance, see our SAF-T and digital tax compliance guide for Europe, our article on ERP in Brazil: SPED, NF-e and Brazil’s tax complexity — the LATAM counterpart to the Mexican case — and our overview of ERP and international trade compliance: customs, export, multi-country.
