How to Verify Spanish Supplier Bank Accounts: VoP, NIF, and the Registro Mercantil

Spain is an unusual market for supplier verification. Since October 2025 every Spanish bank must run a Verification of Payee check before a euro transfer leaves the account — and Spain also has a second, older mechanism that most of Europe does not: a national service that matches an IBAN to the account holder's tax number. Between them, the account layer in Spain is stronger than in almost any other euro-area country. The company layer behind it is a different story, spread across a provincial registry network, a tax census, and a beneficial ownership register that is not open to the public. This guide covers both, and where the gap between them sits.

Sources: Iberpay 2025 activity data; EBA and ECB joint Payment Fraud Report, December 2025.

The account layer, part one: Verification of Payee

Verification of Payee became mandatory across the euro area under the Instant Payments Regulation, Regulation (EU) 2024/886, which required all payment service providers in euro-using EEA countries to offer the check from 9 October 2025. In Spain the service went live on 5 October 2025, built and operated centrally by Iberpay, the operator of the Spanish national payment system, on behalf of the banking community. More than 120 Spanish and international banks and PSPs signed up, and the service now handles an average of 2.6 million verifications a day.

The mechanics are the same as elsewhere in the EU. Before a SEPA credit transfer or instant transfer is sent, the payer's bank asks the payee's bank whether the name being paid matches the account holder on the destination IBAN. The answer comes back as one of four outcomes.

One point is easy to lose. As the Banco de España sets out in its guidance for bank customers, the IBAN remains the account's unique identifier. If the result is a no match or a close match and the payer chooses to continue anyway, the money still goes to the IBAN entered — and may not reach the intended payee. VoP informs the decision; it does not block the payment.

The account layer, part two: Valitic

This is the part of the Spanish setup that has no direct equivalent in most of Europe. Alongside VoP, Iberpay operates Valitic, a national account ownership service that answers a different question: does this IBAN belong to the holder of this tax identification number?

Where VoP compares a name to an account, Valitic compares a NIF, CIF or NIE to an account. It returns a binary result — OK if the identifier and the account correspond, KO if they do not — in around one second. The service reaches 93 participating institutions and can confirm ownership on roughly 88 million accounts, about 99% of all Spanish bank accounts.

The distinction matters for supplier payments. Company names are messy: trading names, abbreviations, legal-form suffixes, regional-language variants and accented characters all produce close matches that a human then has to adjudicate. A tax identifier is exact. For a business counterparty, matching an IBAN to a NIF removes almost all of the ambiguity that makes name matching operationally expensive.

Valitic is not self-serve. Banks, payment institutions and e-money providers can join directly if they hold their own IBANs and are authorised by the Banco de España; companies and public bodies reach the service through a participating institution. If you pay Spanish suppliers at volume, it is worth asking your Spanish banking partner whether they offer it — many corporates are entitled to it and have never been told.

Reading a Spanish IBAN

Spanish IBANs are 24 characters. Unlike most SEPA countries, the domestic account structure is still visible inside the IBAN: the old CCC format — bank, branch, two check digits, account number — sits directly after the country and IBAN check digits.

Format validation is worth doing first because it is free and it catches transcription errors, but it is the weakest check available. It confirms the string is well-formed and identifies the issuing bank. It says nothing about whether the account is open, or whose it is.

The company layer: reading the NIF

Every Spanish company has a NIF (Número de Identificación Fiscal). You will still see it called a CIF, and for practical purposes the two are the same thing — Royal Decree 1065/2007 folded the old Código de Identificación Fiscal into the general NIF system with effect from 2008, and the number itself did not change. A company whose CIF was B66254202 has the NIF B66254202 today.

The useful part is the first character. For a Spanish legal entity it encodes the legal form, which means you can tell what kind of organisation you are dealing with before you look anything up.

Two of these are worth flagging in a supplier context. An N prefix means a non-resident foreign entity with Spanish tax obligations, and a W prefix means the Spanish permanent establishment of a foreign company. Both are entirely legitimate, but many validation tools hard-code the domestic A-to-J range and reject them. If your onboarding rejects an N or W NIF automatically, you are turning away real suppliers.

A related trap: if the supplier is a sole trader (an autónomo) rather than a company, the NIF is their personal DNI and starts with a digit, or is a NIE starting with X, Y or Z. There is no company to look up in the commercial registry, and no annual accounts to check. The verification path is different, and thinner.

The company layer: the Registro Mercantil

Spain's commercial registry is not a single database. It is a network of provincial registries — one per province — coordinated by the Colegio de Registradores under the supervision of the Ministry of Justice, plus the Registro Mercantil Central (RMC) in Madrid.

The division matters when you are looking something up. The RMC maintains the national index and handles company name reservations, but the authoritative file on any given company sits with the provincial registry for its domicilio social — its registered office. A Madrid-registered S.L. is on file in Madrid, not centrally. In practice you confirm the province through the central index and then order the document from the provincial registry through the registrars' shared electronic portal.

Three outputs are relevant to supplier verification:

• The nota simple (also called a nota informativa) — the standard extract. It gives the registered name, NIF, registered office, share capital, directors and attorneys-in-fact, the list of registered acts, and which annual accounts have been deposited. This is the workhorse document for onboarding.
• The cuentas anuales — the deposited annual accounts, including balance sheet and profit and loss.
• The BORME (Boletín Oficial del Registro Mercantil) — the official commercial gazette, published daily and freely searchable. Incorporations, capital changes, director appointments and dissolutions all appear here.

The signal most buyers miss: cierre registral

Spanish companies must file annual accounts, and the sanction for not doing so is unusually informative for anyone assessing a supplier.

The sequence is fixed by law. Under article 253 of the Ley de Sociedades de Capital, directors must draw up the accounts within three months of the financial year end. The shareholders' meeting approves them, and they must be deposited with the provincial registry within one month of approval. If a full year passes from the financial year end without approved accounts on file, article 282 triggers cierre registral — the registrar closes the company's registry sheet.

A closed sheet means no new entries can be registered — no new director appointments, no capital changes, no new powers of attorney — with a short list of exceptions covering resignations, revocation of powers, dissolution and court-ordered entries. Separately, the tax authority can trigger its own registry closure by provisionally striking an entity from the Index of Legal Entities for tax non-compliance. And beyond the closure itself, the accounting regulator can impose fines from €1,200 to €60,000, rising to €300,000 where turnover exceeds €6 million.

For a buyer, this is a gift. A supplier whose registry sheet is closed is telling you, on the public record and with a date attached, that it has not filed accounts for over a year. That is not proof of fraud — plenty of small S.L.s file late through disorganisation rather than intent. But it is a hard, checkable signal that belongs in an onboarding decision, and it is invisible to any account-level check.

Insolvency: the Registro Público Concursal

The commercial registry will eventually reflect a formal insolvency, but it is not the fastest source. Spain runs a separate national register for insolvency proceedings — the Registro Público Concursal, operating under the consolidated Insolvency Law (Royal Legislative Decree 1/2020), managed under the Ministry of Justice and operated by the Colegio de Registradores.

It publishes the court resolutions issued in Spanish insolvency proceedings across three sections: insolvency notices, registry entries of insolvency resolutions, and out-of-court settlement arrangements. Access is free, online and permanent, and — unlike the beneficial ownership register — requires no demonstration of legitimate interest. That makes it one of the cheapest checks on this list to add to an onboarding flow.

One caveat is worth carrying. The register depends on courts, notaries, insolvency administrators and registrars filing correctly, and the operator states plainly that it cannot guarantee the completeness of what is published. Treat a hit as significant and a miss as inconclusive rather than as a clean bill of health.

VIES, the ROI, and why good suppliers fail VAT checks

This one causes more false rejections than any other Spanish check, so it is worth being precise about.

A Spanish company has a NIF from the moment it registers with the tax authority. It does not automatically appear in VIES, the EU VAT information exchange system. To be listed, the company must separately apply to join the Registro de Operadores Intracomunitarios (ROI) by filing form 036 and ticking box 582. Only then is it assigned an intra-community VAT number with the ES prefix and entered in the VIES census. The tax authority has three months to decide, and silence counts as refusal.

The inverse also holds: a VIES hit confirms the company is authorised for intra-EU trade on the date you checked. It does not confirm the company is solvent, active in any meaningful sense, or connected to the bank account in front of you.

Beneficial ownership: the RCTIR

Spain created a single national beneficial ownership register, the Registro Central de Titularidades Reales (RCTIR), under Royal Decree 609/2023. It went live on 19 September 2023 and is run by the Ministry of Justice through the Directorate-General for Legal Certainty and Public Faith. It covers all Spanish legal persons, plus trusts and analogous arrangements operating in Spain.

The threshold follows Law 10/2010: a beneficial owner is a natural person who directly or indirectly holds or controls more than 25% of the capital or voting rights, or who otherwise exercises effective control.

Access is the constraint. Following the Court of Justice ruling that struck down unrestricted public access to EU beneficial ownership registers, the RCTIR is open to competent authorities, to obliged entities under the anti-money-laundering law, and to any person or organisation that can demonstrate a legitimate interest — with a qualifying electronic identity and an application process. It is not a page you can search. Separately, the commercial registries can issue a beneficial ownership certificate for a company.

The practical position is the same as in several other markets: the data exists, the register is real, and confirming ownership on a routine supplier still depends either on what the supplier discloses or on registry-sourced data assembled from company filings. A recently incorporated company, a sole shareholder, or an ownership chain that runs somewhere unexpected all remain worth weighing before a first payment.

Why verification is not optional in Spain: you can inherit the debt

In most markets the argument for verifying a supplier is fraud prevention. Spain has a second argument, and for a finance director it is the stronger one. Two separate statutes make a buyer answerable for its supplier's unpaid obligations, and in both cases the way out is a certificate somebody has to remember to ask for.

Tax: article 43.1.f of the Ley General Tributaria

If you contract or subcontract the execution of works or the provision of services corresponding to your main economic activity, you become subsidiarily liable for the contractor's tax debts on that work — specifically taxes that should have been passed on, such as VAT, and amounts that should have been withheld from workers, professionals or other businesses.

The exemption is narrow and specific. The liability is not enforceable where the contractor has given you a certificado específico confirming it is current on its tax obligations, issued by the tax authority for that purpose, within the 12 months before you pay each invoice. The contractor requests it, and the tax authority must issue or refuse it within three days.

Read that timing again. Not once at onboarding — within the twelve months before payment of each invoice. It is a rolling control attached to your payment run, not a document you file once and forget.

Social security and wages: article 42 of the Estatuto de los Trabajadores

The parallel regime is wider in scope. A company contracting works or services corresponding to its own activity must check that the contractor is current on social security contributions, by requesting in writing a certificación negativa por descubiertos from the Tesorería General de la Seguridad Social.

The TGSS has 30 non-extendable days to issue it. If it fails to answer in that window, the company that asked is exonerated — the written request is itself the protection. If you never ask, you have no defence to fall back on.

Where liability does attach, it is joint and several rather than subsidiary. The principal answers for social security obligations the contractor incurred during the engagement for three years after it ends, and for wage obligations for one year. The Supreme Court has confirmed one useful limit: the principal is not liable for debts the contractor ran up before the contract began.

Both regimes turn on the same idea — work corresponding to your own activity — and both are triggered by the ordinary act of paying a supplier invoice. Neither has anything whatsoever to do with the bank account.

What an account match will not catch

Spain's account layer is genuinely strong. Between VoP and Valitic, you can establish that an account exists, that the name on it matches, and that it belongs to the holder of a specific tax number. That is more than most European buyers can establish anywhere else.

None of it tells you anything about the business, and none of it touches the liabilities above. A verified account can belong to a company whose registry sheet has been closed for eighteen months, whose sole director was appointed last quarter, whose accounts have never been deposited, or whose ownership changed hands between your last two purchase orders. There are several company red flags a bank account match alone will not catch, and in Spain they sit in a registry that the payment rails never touch.

The two layers answer different questions. A matched account is a necessary condition for paying safely. It is not a sufficient one.

Why this matters now

The EBA and ECB joint payment fraud report published in December 2025 put total payment fraud across the European Economic Area at €4.2 billion in 2024, up from €3.5 billion the year before. The composition is the part that should concern anyone running accounts payable: for credit transfers, payment service users bore roughly 85% of total fraud losses, overwhelmingly through scams in which they were manipulated into initiating the transfer themselves.

That is the defining characteristic of the attack. Strong customer authentication works — the report confirms it — because it stops an attacker transacting as you. It does nothing when you authorise the payment yourself, believing the instruction is genuine. Vendor email compromise and bank-detail change requests are built precisely around that gap.

Spain's exposure is growing with its instant payment volumes. Iberpay processed 1,556.3 million instant transfers in 2025, up 31.1% on the previous year, with the rise in total value driven substantially by corporate B2B payments rather than consumer transfers. Faster settlement means a shorter window to catch a misdirected payment, and less chance of recall.

A practical verification workflow

For a new Spanish supplier, or a change to an existing one, a defensible sequence looks like this:

1. Validate the IBAN. Confirm the 24-character structure and identify the issuing bank. Free, instant, and it catches transcription errors before anything else.
2. Match the account to the company. Run the payee name check through your bank's VoP flow, and where you have access, match the IBAN to the supplier's NIF through Valitic. The tax-ID match is the stronger of the two for a business counterparty.
3. Confirm the NIF. Check the entity letter is consistent with the legal form the supplier claims, and validate the number against the tax census rather than a format regex — particularly for N and W prefixes.
4. Confirm the company. Pull the nota simple from the provincial Registro Mercantil. Check the registered name, status, registered office, and current directors against what the supplier has told you.
5. Check the accounts are filed. Look at which annual accounts have been deposited and whether the registry sheet is closed. A gap of more than a year is a material finding, not an administrative detail.
6. Check for insolvency. Search the Registro Público Concursal. It is free, needs no justification, and takes seconds.
7. Check ownership. Review shareholders and beneficial owners, and note recent incorporation, a single owner, or a recent change of control.
8. Collect the liability certificates, where they apply. If the supplier is performing works or services within your own main activity, obtain the specific tax certificate before paying invoices and request the TGSS negative certificate in writing. Diarise both — the tax certificate has to be current within 12 months of each payment.
9. Monitor. Re-verify on every bank-detail change request, and monitor status and ownership across the existing supplier base rather than treating onboarding as a one-time event.

Frequently asked questions