One-minute summary
In Q1 2026, thousands of Mexican SMBs already received Buzón Tributario notices about CFDI discrepancies. The stakes jumped: starting January 1, 2026, issuing a false CFDI is a criminal offense, not an administrative fine. This 30-point checklist closes the gaps before the first audit lands.
- From January 1, 2026, every CFDI must reflect real and verifiable operations (Article 29-A CFF, reform published in DOF on December 30, 2025).
- False CFDI equals criminal tax fraud: 3 to 9 years in prison (Article 113-Bis CFF).
- Anexo 20 catalogs updated on January 30, 2026: changes in c_UsoCFDI, c_FormaPago, and the Carta Porte 3.1 complement.
- 3-day cancellation window: the CFDI recipient must accept or reject via Buzón Tributario.
- CSD suspends automatically on mass issuance without support, missed filings, or inactivity.
- 30 checklist items cover issuance, validation, cancellation, Carta Porte 3.1, and audit readiness.
- Mexican vendors keep focusing on issuance. The real 2026 pain is post-issuance and real-operations validation.
What changes in 2026 and why the risk level is new
The reform to the Código Fiscal de la Federación, published in DOF on December 30, 2025, introduced two structural changes that did not exist in 2024 or 2025.
First. CFDI is no longer evaluated only on XML technical validity and RFC consistency. Article 29-A CFF now requires every CFDI to reflect a real and verifiable operation. The tax authority can challenge a technically valid CFDI if it determines the physical operation never occurred. In practice:
- SAT gets the power to run on-site inspections: inventory review, employee presence, real activity at the registered address.
- Photos, video, and audio are admissible as evidence in administrative proceedings.
- The audit clock speeds up: a review can take 30 to 45 days instead of the traditional 12 months.
Second. Issuing or using a false CFDI is reclassified as a criminal offense under Article 113-Bis CFF. Before, it was an administrative violation with a 55% to 75% fine on the amount. Now it is 3 to 9 years in prison if the defrauded amount exceeds 9 million pesos.
At the same time, SAT updated the Anexo 20 catalogs (published January 29, 2026, effective January 30, 2026): new UsoCFDI codes, refreshed c_FormaPago, changes to the Carta Porte 3.1 complement, new fields for RESICO taxpayers. If your PAC did not sync catalogs in the first week of February 2026, every CFDI you issued went out with stale values.
2026 timeline — dates you cannot afford to miss:
| Date | What takes effect |
|---|---|
| January 1, 2026 | Real-operations rule; criminal liability for false CFDI |
| January 30, 2026 | Updated CFDI 4.0 catalogs (Anexo 20) |
| April 1, 2026 | Carta Porte 3.1 migration deadline |
| July 1, 2026 | Expanded SIPRED for SMBs with revenue above 13 million pesos |
| October 1, 2026 | Tech platforms: expanded VAT and ISR reporting |
Checklist: 30 CFDI Real-Ops items
The checklist breaks into three blocks of 10 items each. Every item is yes or no. Five "no" answers in one block signal a structural problem, not a one-off oversight.
#1. Block A — Issuance and technical baseline (1–10)
- PAC updated Anexo 20 catalogs after January 30, 2026. Written confirmation from the provider.
- Recipient RFCs are validated against the Listado 69-B before issuance. Counterparty in EFOS, no CFDI issued.
- UsoCFDI is picked from the updated c_UsoCFDI (February 2026 version).
- MétodoPago and FormaPago are consistent. If PUE, FormaPago cannot be 99 (to be defined).
- RegimenFiscalReceptor matches the counterparty's Constancia de Situación Fiscal. Top rejection point in 2026.
- DomicilioFiscalReceptor equals the ZIP code on the recipient's Constancia de Situación Fiscal.
- ObjetoImp coded correctly (01/02/03/04) on every conceptos line.
- NumRegIdTrib for foreign RFCs is present in export transactions.
- Every concepto carries a valid ClaveProdServ from the updated SAT catalog.
- Stamps reserved with the PAC for peak periods (fiscal close, month-end).
#2. Block B — Real-operations and validation (11–20)
- Every CFDI has supporting documentation: purchase order, contract, delivery evidence — in the ERP or on file. First line of defense in an on-site inspection.
- Book inventory matches physical inventory as of December 31, 2025. A gap above 5% is a red flag.
- Transfer CFDI travels with the Carta Porte 3.1 complement on any goods movement over federal highways, including intra-company.
- Services without a physical deliverable have a timesheet, progress report, and documented payment milestone.
- Payroll CFDIs are issued only for real employees with SUA and IMSS registration.
- Credit notes are issued within 30 days and linked to the original CFDI via CfdiRelacionados.
- Partial payments recorded with the Payment Complement within 5 business days of actual payment.
- Intercompany operations have a transfer pricing study and signed contracts.
- Advance payments handled correctly: income CFDI, expense CFDI, final income CFDI.
- Professional fees and consulting are never issued without receipts, execution evidence, and deliverables.
#3. Block C — Cancellation, CSD, and operational stability (21–30)
- Cancellation process tuned to a 3-day SLA: notice to the recipient via Buzón Tributario, response monitoring.
- CancelaCFDI with the correct motivo (01: errors with relation; 02: errors without relation; 03: operation not performed; 04: nominative global). Motivo 03 is the danger zone.
- CSD active and clear of suspension triggers. Daily review of Buzón Tributario notices.
- e.firma valid with more than 90 days of buffer. Renewal scheduled well ahead.
- XML and PDF backed up for 5 years in protected storage (Article 30 CFF).
- Buzón Tributario contact data current. Minimum 2 verified emails and 2 mobile numbers.
- Contingency procedure for PAC outages longer than 24 hours: fallback PAC plus pre-purchased stamps.
- CFDI por sustitución procedure tested against a sample scenario.
- Monthly readiness audit: 10% sample of issued CFDIs re-validated through the SAT verifier.
- Carta Porte 3.1 fields complete: Mercancía, Ubicación, FiguraTransporte, AutotransporteFederal. Empty field equals rejection.
When the checklist works and when it does not
It works if you run a structured ERP (Odoo with active l10n_mx, SAP, NetSuite, Aspel SAE) and an official PAC. The 30 items are configuration plus operational discipline. Real rollout time: 4 to 8 weeks for an SMB with revenue up to 50 million pesos. Internal resource cost: 60 to 120 person-hours.
It works with adjustments if you live in Excel plus a standalone billing tool (Factura.com, Bind, Facturama without integration). The checklist closes the issuance front, but real-operations validation (Block B) needs a parallel inventory and supporting-document system. Expect a hybrid model: issuance in SaaS, supporting documents in SharePoint or Drive with strict naming conventions and monthly audit.
It does not work if the business historically ran on simulated operations (a common practice in construction, outdoor advertising, freight transport). The 30 items close the issuance risk but do not solve the absence of real operations. The fix is compliance restructuring, not a checklist, and a serious conversation with a tax attorney before July 1, 2026, when the expanded SIPRED kicks in.
It also does not work for Personas Físicas con Actividad Empresarial with revenue under 3.5 million pesos in RESICO. That regime has a different validation set (Article 113-E LISR) and the general logic does not fully apply. They need a RESICO-specific variant of the checklist.
Top 5 mistakes in SAT 2026 preparation
Mistake 1: "We have a PAC, we're fine." The PAC is responsible for XML technical validation and the Digital Fiscal Stamp. The real-operations rule is the taxpayer's responsibility. The PAC does not verify whether you have inventory backing the shipment or whether the payroll person is registered with IMSS.
Mistake 2: Ignoring Buzón Tributario. SAT sends more than 80% of notices through Buzón. A notice left unread for 30 days counts as received. A PIO notice (Procedimiento por Inversión de Operación) opens a 15-day response window. Miss it and an acta de hechos lands, with presumption favoring the authority.
Mistake 3: Cancellation with the wrong motivo. Many companies default to motivo 01 out of habit. If SAT sees a CFDI was paid and later canceled with motivo 03, that is an automatic red flag and an invitation to audit.
Mistake 4: Treating Carta Porte as a formality. Under Carta Porte 3.0 (2024), the validator accepted XML with empty subfields. Under Carta Porte 3.1 (effective April 2026), the validator rejects XML if Mercancía, Ubicación, or FiguraTransporte are missing. Shipping without a valid Carta Porte means the freight gets stopped at a Guardia Nacional checkpoint, plus fines and precautionary seizure.
Mistake 5: CSD as a "set and forget." CSD suspension triggers automatically: 3 missed filings in a row, EFOS transactions, inactivity over 12 months, breaches in regulated sectors (hydrocarbons, alcohol). The notice arrives by Buzón. You have 10 days to file a clarification (Article 17-H Bis CFF); miss it and reinstating the CSD through the SAT portal with e.firma takes 2 to 4 weeks, during which you cannot issue a single CFDI.
Anonymous case: B2B distributor, 120M MXN revenue, Mexico City
A spare-parts distributor with warehouses in Mexico City and Guadalajara, 14 employees, roughly 120 million pesos in annual revenue. Until December 2025 it ran on Aspel SAE plus a standalone PAC, issuing 800 to 1,200 CFDIs per month.
Situation. In February 2026 a Buzón Tributario notice arrived: transfer CFDIs from November and December 2025 were missing the Carta Porte complement. The accountant's interpretation had let intra-warehouse moves travel without Carta Porte, but SAT ruled the intercity Mexico City to Guadalajara moves as required. Estimated fine: about 190 thousand pesos plus the risk of CSD suspension.
What they did. A 30-point checklist audit in 6 weeks. They closed 22 of 30 items. The critical piece: a retroactive Carta Porte 3.1 rebuild through cancelación motivo 02 plus re-issuance with the complement. Supporting-document coverage rose to 91% on sample.
Outcome. SAT accepted the clarification. CSD was not suspended. They embedded a monthly audit process into the ERP. Cost of the delay: 40 person-days of internal resources plus around 8,000 USD on external compliance review. Cost of prevention if the checklist had been done in December 2025: about 2,500 USD.
When the inspection lands through Buzón Tributario asking for Carta Porte supporting documents from two months back, there is no time to rebuild. It was either already in the ERP, or you pay the fine.
Download the checklist in Excel
The full 30-item template includes a scoring formula, sample evidence on each item, references to the specific CFF articles, and clarification templates for the most common scenarios. In exchange for an email we send the Excel, the PDF, and a 7-day email course with a breakdown of every block.
→ Download the CFDI Real-Ops Checklist 2026
Conclusion and what's next
CFDI 2026 marks the shift from formal XML validation to verification of the operations themselves. The 30 items are the minimum baseline that covers roughly 80% of the risk for an SMB up to 200 million pesos in revenue. The remaining 20% depends on the industry: freight needs deeper Carta Porte work, retail needs the Payment Complement, construction needs transfer pricing documentation.
If you are implementing or auditing Odoo with l10n_mx, run the checklist twice: once on the historical CFDI load and again on the first live issuance after go-live. The cost of leaving one item open in 2026 ranges from 500 to 50,000 USD depending on the item and the revenue.
What's next:
- Odoo in Mexico — implementation with CFDI 4.0 localization: step-by-step methodology with l10n_mx.
- SAT CFDI Real-Ops — pillar of the 2026 reform: deeper regulatory context.
- Odoo Audit: external review in 30 days.
- Odoo Project Rescue: when the implementation stalled.
- Odoo Implementation: full-cycle projects.
- Computer Vision for inventory: automated counting to back up Block B.
- Odoo Analytics: CFDI as a BI source.
- Implementation cases: anonymized client stories.
Frequently asked questions
When does the real-operations rule become mandatory?
January 1, 2026, under the CFF reform published in DOF on December 30, 2025. The base norm is Article 29-A of the Código Fiscal de la Federación.
What is the penalty for a false CFDI in 2026?
Article 113-Bis CFF: 3 to 6 years in prison if the defrauded amount is below 9 million pesos, and 3 to 9 years if it goes higher. Plus fines from 55% to 75% of the defrauded amount.
What happens if the CSD gets suspended?
You have 10 business days to file a clarification through the SAT portal with e.firma (Article 17-H Bis CFF). Reinstatement typically takes 2 to 4 weeks. During that window no new CFDIs can be issued.
Is the Carta Porte 3.1 complement required between affiliates?
Yes, for any goods movement on federal highways, including intra-company transfers. Inside a single municipality, Carta Porte is not required. As of April 1, 2026, version 3.0 is no longer accepted.
How often should an internal CFDI audit run?
Quarterly at minimum, on a 10% sample of issued CFDIs. For SMBs above 50 million pesos in revenue, monthly. Use the SAT verifier or the ERP's built-in audit.
How long do CFDI XML files need to be kept?
5 years (Article 30 CFF). In the original XML format plus PDF and the PAC acknowledgment. Cloud storage is acceptable as long as the files are retrievable within 5 business days on SAT request.
Does the checklist apply to Personas Físicas under RESICO?
Partially. Block A applies in full. Blocks B and C need RESICO-specific adaptation (Article 113-E LISR). A separate RESICO variant of the checklist is worth preparing.