When a company starts operating in Spain, it quickly runs into the same issue: almost everything is handled online and the Spanish authorities will only “talk” to whoever identifies themselves with a digital certificate.
In this article, we look at what exactly a digital certificate Spain is, why it is so important to comply with obligations before the Spanish Tax Agency (Hacienda), Social Security and other authorities, which types of certificates exist, how to obtain one in practice, and which mistakes you should avoid if you don’t want to lose time or create unnecessary risks.
What is a digital certificate in Spain (in simple terms)?
A digital certificate (or electronic certificate) is an electronic document issued by a Certification Authority that links the identity of a person or entity (name, tax ID number – NIF/CIF, etc.) to a cryptographic key.
Put simply, it is your online ID before the Spanish Administration and many private entities.
With a digital certificate Spain, you can:
- Identify yourself online before official bodies (Spanish Tax Agency, Social Security, local authorities, etc.).
- Sign documents and electronic forms with the same legal effect as a handwritten signature.
- Receive and access electronic notifications that replace traditional postal mail.
A typical digital certificate includes:
- Name or corporate name of the holder.
- Tax ID (NIF/CIF).
- Type of certificate (individual, company representative, etc.).
- Issue and expiry dates.
- Details of the issuing authority.
Types of digital certificate that matter for a company
There are several types of certificates in Spain, but for day-to-day business operations, two are particularly relevant.
Digital certificate for an individual (persona física)
This is requested by a specific person (director, attorney-in-fact, CFO, etc.) and identifies them as an individual before the Spanish authorities. The certificate belongs to that person, not to the company, although they may use it to act on behalf of the company if they are duly authorised to do so.
For example:
the finance director of a Spanish subsidiary can use their individual digital certificate to file VAT returns or reply to a request from the Spanish Tax Agency, provided they are properly authorised to act on behalf of the company (for instance, as an attorney-in-fact or a registered tax representative with the Tax Agency). In that case, the filing is technically made with their personal certificate, but on behalf of the company.
Company representative certificates
The FNMT-RCM (the Spanish Mint and National Currency Factory) and other certification authorities issue representative certificates for legal entities, entities without legal personality and sole or joint directors. These are “qualified certificates” under the EU eIDAS Regulation (EU 910/2014).
In practice, these certificates allow you to:
- File and sign tax returns in the name of the company.
- Process employee registrations and de-registrations with Social Security.
- Access and manage mandatory electronic notifications.
If you are a foreign company with a subsidiary, branch or permanent establishment in Spain, this company representative digital certificate will be critical for your day-to-day operations.
Why is a digital certificate necessary to operate in Spain?
Because the law requires you to interact electronically
Law 39/2015 obliges many individuals and entities – including legal entities and most entities without legal personality – to deal with Spanish public authorities exclusively by electronic means.
This means that procedures such as:
- Filing VAT, Corporate Income Tax, withholding tax and other returns.
- Responding to requests for information from the Spanish Tax Agency.
- Submitting written statements, appeals and claims.
- A large part of dealings with Social Security (for example, through the RED system).
Are carried out electronically and, in many cases, access and/or signature requires a digital certificate Spain.
Because without a digital certificate you lose control over notifications
For years now, many companies receive their official communications only by electronic means:
- Notifications from the Spanish Tax Agency.
- Requests and communications from Social Security.
- Resolutions in administrative proceedings.
If you do not access those notifications on time, they are deemed served anyway, and the deadlines to appeal or pay – often with surcharges – start to run.
Without a digital certificate Spain:
- You rely 100% on a third party to access the electronic portals.
- It is much easier to miss deadlines and end up facing penalties, surcharges and interest.
- You have less control over who opens, reads and responds on behalf of the company.
Because it makes management easier if your team is outside Spain
In many international groups, the management team is based outside Spain.
With a digital certificate:
- The director or authorised representative can review and sign filings from anywhere.
- It simplifies dealings with banks, notaries and other service providers that accept qualified electronic signatures.
Common situations we see in international companies
In practice, the problem is not only “we don’t have a digital certificate”, but how (or whether) its management has been organised. Some typical cases:
Newly incorporated subsidiary with no digital certificate
The company is registered with the Commercial Registry, the bank account is open… but nobody has requested the representative certificate. As a result, tax returns cannot be filed on time, or the company has to rush to grant urgent powers of attorney and organise everything at the last minute.
Non-resident director
The director lives outside Spain, does not have a Spanish foreigner ID number (NIE) or is unable to travel to Spain to identify themselves in person. A clear strategy is required: who will hold the digital certificate, which powers need to be granted before a notary, and who will be in charge of monitoring notifications.
Certificate installed on the laptop of an employee who leaves
The certificate is “lost” on a device that is no longer under the company’s control. Nobody knows if it has been revoked, where the backup is stored or who may have used it. This generates both security and compliance risks.
Several advisers using the same certificate with no clear protocol
The digital certificate file is shared by email or USB with different providers or employees. This leads to a complete lack of control over who is signing what, when and from where, and makes it very difficult to trace responsibilities.
How to obtain a digital certificate in Spain
The specific process depends on the type of certificate, but it generally follows these steps. If you are still in the planning phase, you may also want to see where this fits within the overall incorporation process in our guide on how to set up a company in Spain.
Application
An application is completed (usually online) with the personal or company details.
Identification
You must prove your identity before an authorised body or office (in person or, in some cases, by electronic means).
For non-resident directors or representatives, identity verification is often done at consulates or local notaries abroad, usually with an apostille, which adds practical complexity and longer lead times.
Issuance of the certificate
Once your identity has been verified, the issuing authority generates the digital certificate.
Download and use
The certificate is downloaded or installed on the intended device (computer, browser, card, etc.), and from that moment it can be used to sign and carry out electronic procedures.
In addition to FNMT, there are other certification authorities (Camerfirma, ACCV, etc.) whose digital certificates are also accepted for many procedures. The choice may depend on the company’s structure, jurisdictions involved and specific signing needs.
Common risks when a digital certificate is not properly managed
Having a digital certificate Spain is not enough; what really matters is how it is managed. Some of the recurring issues we see:
- No internal person is formally appointed as responsible for the certificate and the monitoring of notifications.
- The certificate is installed on several devices without any real control or record.
- There is no internal usage protocol: who can sign what, who has access to which electronic portals, how backups are created and stored.
- The expiry date is overlooked and only discovered when an urgent filing needs to be submitted.
All of this leads to:
- Penalties and surcharges for late filing.
- A higher risk of administrative and procedural errors.
- Loss of sensitive information or the inability to prove who did what and when.
Quick FAQs on digital certificates in Spain
Is a digital certificate the same as the Cl@ve system?
No. A digital certificate is a file installed on a device (computer, smart card, token, etc.) used to identify and sign electronically. Cl@ve is an identification system based on a username/password and one-time codes, mainly intended for individuals. For companies and authorised representatives, the digital certificate remains the key tool.
What happens to the certificate when the director or attorney-in-fact changes?
If a certificate is linked to a director or attorney-in-fact who no longer holds powers, the prudent approach is to revoke the certificate and issue a new one for the person who is taking over the role. Otherwise, someone who no longer represents the company could continue to sign or access information on its behalf.
What should I do if I lose the certificate or suspect misuse?
The first step is to revoke the certificate with the issuing authority so that it is no longer valid. Then, review who had access, which filings have been made recently, and, if necessary, tighten your internal protocol (new passwords, fewer devices with the certificate installed, etc.).
Can my company work with an advisory firm without handing over our digital certificate?
Yes. You can grant specific powers of attorney before the Tax Agency, Social Security and other authorities so that the advisory firm acts on your behalf using its own certificates. This way, the company keeps control over its own certificates while outsourcing day-to-day compliance.
Can a certificate issued in another EU country be used for procedures in Spain?
In theory, the eIDAS Regulation allows for the recognition of electronic identification systems from other Member States. In practice, however, many Spanish e-government portals work mainly with certain issuers and formats. For smooth day-to-day operations, it is generally safer to have a digital certificate recognised by the Spanish authorities.
How many digital certificates does it make sense for a company operating in Spain to have?
There is no “official” number, but a simple and effective set-up is usually:
- One company representative certificate for the core operations.
- Individual certificates for one or two key people (for example, finance or legal) with clearly defined powers of attorney.
What really matters is not the number of certificates, but having a clear internal policy on who uses which certificate, for what purpose and with what limits.
How often does a digital certificate expire?
It depends on the type of certificate and the issuer. For example, many personal FNMT certificates are valid for 2–4 years. The exact validity period is shown in the certificate itself and on the issuer’s website.
In summary: the essentials on the digital certificate in Spain
Key takeaways:
- The digital certificate Spain is the basic tool that allows your company to identify itself, sign and receive official notifications from Spanish authorities.
- Regulations require legal entities to interact electronically, so the digital certificate is not a “nice to have”: it is a prerequisite for operating normally.
- Poor management (no protocol, no control, no monitoring of expiry dates) can be costly in the form of surcharges, penalties and compliance issues.
- For international groups, a well-structured approach to digital certificates is what enables you to manage Spain remotely without losing visibility or control.
- A good advisory firm does more than simply request the certificate; it helps you integrate it into your tax, labour, financial and corporate governance processes.
A well-managed digital certificate, a more predictable business
The digital certificate is a core requirement for your company to identify itself, sign and receive official communications in Spain in a secure and predictable way. Its effectiveness depends on how it is obtained, who administers it and which procedures you have in place for its use and renewal.
If you would like us to review the current situation of your company in Spain – certificate holders, access to electronic portals, notification management – or to support you from the outset with digital certificates, notifications and process implementation, we can analyse your case and define a clear action plan.
If you are ready to take that step, contact GCO and we will be pleased to discuss your specific situation.
