SAF-T PT & E-Invoice in Portugal 2026: AT Compliance, Monthly Reporting & E-Commerce Integration Guide

The 2026 Portuguese Compliance Stack at a Glance

Few European countries have a compliance architecture as layered as Portugal's. The cards below summarise the six pillars covered in this guide — keep them in mind as you read each deep-dive section.

1. SAF-T PT Format Overview — The OECD-Derived XML Standard

From OECD Recommendation to Portuguese Mandate

The Standard Audit File for Tax (SAF-T) is a globally standardised XML schema first published by the OECD in 2005. Portugal was the first country in the world to make it legally mandatory: Portaria 321-A/2007 introduced the Portuguese variant — SAF-T PT — and required every accounting and billing software vendor to support it from 1 January 2008. Today the schema is governed by the AT and published as XSD 1.04_01, with periodic addenda (ATCUD added in 2020, hash field upgraded in 2021, simplified-invoice extensions in 2023). It powers both monthly reporting and on-demand audits.

Anatomy of a SAF-T PT XML File

A complete SAF-T PT file is a single XML with four top-level blocks: Header (taxpayer NIF, name, address, fiscal year, software certificate, period); MasterFiles (chart of accounts, customers, suppliers, products, tax tables); GeneralLedgerEntries (full journal entries, only for the annual accounting SAF-T); and SourceDocuments broken into SalesInvoices, MovementOfGoods, WorkingDocuments and Payments. The billing-only SAF-T PT (the 2026 monthly export) includes Header, MasterFiles (customers, products, tax tables) and SourceDocuments → SalesInvoices. The full accounting SAF-T PT, required during inspections, adds chart of accounts and GeneralLedgerEntries — typically multi-hundred-megabyte files for active businesses.

Hash Chain and Digital Signature

Every invoice element in SAF-T PT must include a SHA-1 hash chained to the previous invoice in the same series — computed over InvoiceDate + SystemEntryDate + InvoiceNo + GrossTotal + PreviousHash and signed with the RSA private key issued to the certified software vendor by AT. Tampering with any invoice breaks every subsequent hash, making the file forensically auditable. Zunapro maintains the hash chain server-side per series per tenant, so concurrent invoice issuance from multiple POS or marketplace channels never desynchronises.

2. e-Fatura — Mandatory for All Invoices Since 2013

The Real-Time Communication Mandate

The e-Fatura system, operated by AT under Decreto-Lei 198/2012, went live on 1 January 2013. Every business issuing an invoice in Portugal — regardless of size, sector or customer type — must communicate the document to AT via one of three channels: the real-time webservice (the standard for certified software), the monthly SAF-T billing batch (legally available but deprecated in practice) or manual entry on Portal das Finanças. The legal deadline is the 5th day of the following month (tightened from "12th day" by OE 2023). Communication after the deadline triggers an automatic AT penalty, even when the IVA itself was correctly paid.

What Documents Must Be Communicated

• Fatura (FT) — full invoice with all customer data; mandatory for B2B and B2C above €1,000
• Fatura simplificada (FS) — simplified invoice; allowed for B2C up to €1,000 (or €100 if customer requests no NIF)
• Fatura-recibo (FR) — invoice-receipt combined; common for services and freelancers
• Nota de crédito (NC) — credit note for returns or corrections; reverses original document
• Nota de débito (ND) — debit note for additional charges
• Recibo (RC) — payment receipt; mandatory when invoice and payment are separate
• Documento de transporte (GT, GR, GA) — transport documents communicated separately before goods leave the seller's premises

The Citizen Side — IRS Deductions Drive NIF Adoption

The flip side of e-Fatura is the citizen portal at faturas.portaldasfinancas.gov.pt. When a Portuguese consumer provides their NIF at checkout, the invoice is automatically registered against their personal tax account. Categories such as education (15%), health (15%), restaurants and lodging (15%), hairdressers (15%) and general family expenses (35%) generate IRS deductions of €250 to €1,000 per household. The result: 80%+ of Portuguese consumers routinely provide their NIF at checkout — an unusually high rate that e-commerce sellers must accommodate at the form level.

3. Monthly SAF-T PT Submission to AT

The 2026 Mandate

The headline change for 2026 is the move from legacy by-document communication to a full monthly SAF-T PT (billing) file submission. Legal basis: Decreto-Lei 28/2019 as amended by the 2024–2026 budget laws, with operational detail in Portaria 195/2020. The schedule is now firm:

• Up to month M-1 — businesses operate certified software; every invoice already has ATCUD, QR Code, hash and is communicated to e-Fatura
• By day 5 of month M+1 — last-day cut-off for individual document communication (legacy e-Fatura)
• By day 5 of month M+2 — submission of the consolidated SAF-T PT (billing) XML covering all documents of month M
• By the end of June each year — annual accounting SAF-T PT on AT request, with full GeneralLedgerEntries

What Goes Into the Monthly Billing SAF-T PT

The monthly billing file is a slimmed SAF-T PT: Header (fiscal year, month, taxpayer NIF, certified software code); MasterFiles.Customer (all customers invoiced in the month with NIF, country, address); MasterFiles.Product (every product/service code appearing in the month); MasterFiles.TaxTable (IVA rates applied — 6%, 13%, 23% mainland; regional rates for Madeira/Açores); and SourceDocuments.SalesInvoices (every fatura, fatura simplificada, nota de crédito and nota de débito with ATCUD, QR Code hash, lines, taxes and totals).

Submission Channels

Three channels exist: manual upload via Portal das Finanças → Faturas → Comunicar Documentos Emitidos → Por Ficheiro SAF-T (limit ~30 MB); AT SOAP webservice FaturasService (programmatic, up to ~250 MB, returns a receipt token); and the new AT REST API (preview in 2026) with JSON-wrapped XML and streaming for high-volume taxpayers. Zunapro generates the SAF-T PT XML per tenant, validates against XSD 1.04_01, signs it with the seller's AT subuser credentials and submits via the SOAP webservice, storing the receipt token for audit.

4. ATCUD — The Unique Document Code

What ATCUD Is and Why It Exists

ATCUD (Código Único de Documento) is the per-document unique identifier introduced by Decreto-Lei 28/2019 and Portaria 195/2020, mandatory on every Portuguese commercial document since 1 January 2023. It gives AT, the citizen e-Fatura app and any auditor a single immutable reference tying each invoice to its officially registered document series. The format is ATCUD: XXXXXXXX-N, where XXXXXXXX is the 8-character validation code issued by AT for the series and N is the sequential number — e.g. ATCUD: CSDF7T5H-35.

How to Obtain the Series Validation Code

Before issuing the first document of a new series, the taxpayer must register the series on Portal das Finanças (or via the AT SeriesService webservice). The registration declares: series identifier (e.g. FT2026, FS-LOJA-LISBOA); document type (FT, FS, NC, ND, RC, GT, GA, etc.); first document number (typically 1, higher for migrations); expected start date (must be future); and certified software code. The webservice responds within seconds with the 8-character validation code, then stored against the series. The same series can only be used with the same certified software — switching vendors requires a new series.

Where ATCUD Must Appear

ATCUD must appear on the printed/PDF invoice (clearly visible in header or footer), inside the AT QR Code (field H of the 18-field string), in the SAF-T PT XML (as the ATCUD element inside each Invoice node), and in the e-Fatura communication (propagated automatically by the certified software).

5. QR Code on Invoices — The 18-Field AT Specification

From Optional to Mandatory

The QR Code on Portuguese invoices was introduced as best practice in Despacho 8632/2014 and made mandatory by Despacho 412/2020-XXII from 1 January 2022. Every printed or PDF invoice issued in Portugal must include the QR Code — a missing QR Code is fined €150 to €3,750 per document under RGIT Article 123.

The 18 Mandatory Fields

The QR Code payload is a single colon-delimited string. Each field is identified by a letter prefix: A issuer NIF · B customer NIF (or 999999990 for anonymous B2C) · C country ISO code · D document type (FT/FS/FR/NC/ND/RC/GT/GA) · E status (N normal, A cancelled, R rectified, F closed) · F date YYYYMMDD · G full unique document number · H ATCUD · I1 tax region (PT, PT-AC, PT-MA) · I2-I8 tax-exempt base plus bases and amounts at 6%, 13% and 23% · N total IVA · O gross total · P withholding tax · Q 4-character SHA-1 hash from the SAF-T chain · R AT certified software certificate number.

Visual Requirements

Minimum size 30×30 mm on printed invoices, error correction level M (15% redundancy), high-contrast black on white, no decorative overlays. The QR Code is scanned by the AT citizen app (e-Fatura mobile) which auto-registers the invoice against the consumer's NIF. Many Portuguese consumers scan immediately on receipt — if the invoice wasn't communicated to e-Fatura within the legal window, the scan returns an error and the customer demands a re-issue. This consumer-driven enforcement is the AT's most effective compliance lever.

6. Certified Billing Software List

The Certification Programme

Since Decreto Regulamentar 25/2009 and Portaria 363/2010, Portuguese law has required AT-certified billing software. The threshold was €100,000 turnover, then €50,000 in 2013, then €0 from 1 January 2024 — every VAT-registered business must now use certified software regardless of size, under Article 35-A of the Código do IVA.

What "Certified" Means

Certification is granted to a specific product (and version) after the AT inspects against a checklist: SAF-T PT export conforming to XSD 1.04_01; hash chain per document series with SHA-1 over the SAF-T fields; RSA digital signature linked to the certificate number; e-Fatura webservice integration for real-time communication; ATCUD support with SeriesService; AT QR Code generation with all 18 fields; tamper-evident logs for invoice cancellation, modification and reprint; and minimum document type coverage FT, FS, NC, ND, RC (transport docs GT/GA optional). On approval, the AT issues a unique certificate number (e.g. 0123/AT) embedded in every invoice's QR Code field R and the SAF-T PT header.

The Public List

The AT maintains a public list at Portal das Finanças with roughly 270+ certified products in 2026 — local SME accounting (PHC, Sage, Primavera, Cegid, Moloni, InvoiceXpress), enterprise ERPs (SAP, Oracle, Microsoft Dynamics) and cloud platforms. Zunapro is integrated as a certified billing platform — every invoice from a Portuguese tenant carries the Zunapro AT certificate number in QR Code field R.

7. IVA Reporting — Rates, Periods and Declarations

The 2026 IVA Rate Structure

Portugal applies three IVA (Imposto sobre o Valor Acrescentado) rates on the mainland, plus reduced regional rates for the autonomous regions of Açores and Madeira under the Listas I, II and III of the Código do IVA:

The autonomous regions apply lower rates: Madeira 4% / 12% / 22% and Açores 4% / 9% / 16%. The applicable rate is determined by the customer's delivery address, not the seller's establishment — a mainland seller shipping to Funchal must apply Madeira rates and report regional IVA accordingly.

Declarations and Periods

The monthly regime is mandatory above €650,000 turnover (Declaração Periódica by day 10 of M+2, payment by day 15); the quarterly regime applies below (Declaração by day 15 of M+2 after quarter end). Additional filings: Anexo Recapitulativo for intra-community B2B sales and IES / DA annual Informação Empresarial Simplificada with Anexo L (IVA detail). Zunapro reconciles every marketplace order against e-Fatura and pre-populates the Declaração Periódica from SAF-T PT data — the IVA return becomes a one-click confirmation.

Cross-Border B2C — OSS Scheme

For e-commerce sellers shipping cross-border to or from Portugal, the EU One Stop Shop (OSS) scheme applies above the €10,000 EU-wide annual threshold. Portuguese OSS registration and the quarterly OSS return are handled via the Portal das Finanças; collected IVA is redistributed to destination member states.

8. Cross-Border E-Invoice — Peppol and the FE-AP Gateway

Peppol and the CIUS-PT Profile

Peppol (Pan-European Public Procurement OnLine) is the EU-wide network for structured B2B and B2G e-invoicing, governed by OpenPeppol. Portugal's national Peppol Authority is eSPap (Entidade de Serviços Partilhados da Administração Pública), which also operates FE-AP (Facturação Electrónica na Administração Pública) — the central B2G gateway. Portugal uses the CIUS-PT (Core Invoice Usage Specification — Portugal) profile, a UBL 2.1-based XML aligned with the EU semantic standard EN 16931 with Portuguese extensions for ATCUD, AT QR Code, IVA per Lista, withholding tax and certified-software certificate number. Every B2G invoice must travel in CIUS-PT XML — PDF attachments are not legally valid for public-sector payment.

B2G Mandate Timeline

Large enterprises (≥250 employees) from January 2021; medium (50-249) from July 2021; small (10-49) and all public bodies including municipalities from January 2024; all suppliers including micro-enterprises and freelancers from January 2026. Today every invoice to a Portuguese public-sector entity (ministries, municipalities, hospitals, schools, public universities, utilities) must travel via FE-AP / Peppol in CIUS-PT XML — PDF and paper invoices are returned unprocessed.

B2B Peppol — Optional Today, Likely Mandatory Soon

For B2B transactions, Peppol is currently optional in Portugal — most B2B still flows via e-Fatura + PDF email. With the EU ViDA (VAT in the Digital Age) package phasing in from 2030, mandatory cross-border B2B Peppol invoicing is on the horizon, and Portugal is widely expected to extend its CIUS-PT mandate to domestic B2B between 2027 and 2030.

9. Penalties — Up to €22,500 per Infraction Under RGIT

The RGIT Framework

The RGIT (Regime Geral das Infrações Tributárias — Lei 15/2001) sets penalties for tax infractions in Portugal, distinguishing contraordenações (administrative fines) from crimes fiscais (tax crimes with potential imprisonment for amounts above €15,000). Most e-commerce compliance failures sit in the contraordenação band; repeat offences or fraud above €15,000 escalate to the criminal track under Articles 103-105.

Penalty Table for the Most Common Infractions

Infraction	RGIT Article	Penalty Range
Failure / late e-Fatura communication	Art. 117	€150 – €3,750
Failure to submit SAF-T PT (billing)	Art. 117	€375 – €22,500
Using non-certified billing software	Art. 123	€375 – €18,750
Invoice without ATCUD or QR Code	Art. 123	€150 – €3,750 per doc
Incorrect IVA rate applied	Art. 114	€300 – €22,500 (30% of underpaid tax)
Late IVA payment	Art. 114	30%–100% of tax due, capped €165K
Fraudulent invoicing (>€15,000)	Art. 103-105 (criminal)	Up to 5 years imprisonment + fine

How Penalties Compound and Mitigation

RGIT fines are calculated per infraction — a missing QR Code on 500 invoices is technically 500 offences. In practice, AT inspectors apply a "single-conduct" reduction, but the worst-case exposure is genuine. Repeat offences within 5 years double the minimum penalty; a third offence triggers automatic referral to the AT special compliance team. RGIT Article 29 allows voluntary disclosure (regularização voluntária) — taxpayers who self-report before AT raises an issue benefit from reduced penalties of 12.5%–25% of the standard fine. When Zunapro's monthly reconciliation flags a missed e-Fatura communication, disclose and pay the reduced fine rather than gamble on AT not detecting it.

10. E-Commerce Specific Compliance

The Marketplace Edge Case

Portuguese tax law does not formally treat marketplace sales differently from other invoicing — every order must still produce a fatura or fatura simplificada with ATCUD, QR Code and e-Fatura communication. The operational pattern of marketplace e-commerce raises specific issues the AT has progressively addressed:

• NIF collection at checkout — required above €1,000 for B2C, any value for B2B; marketplaces such as Amazon ES, Worten Marketplace and Fnac.pt expose the customer NIF in the order webhook
• Real-time invoice issuance — the invoice must be issued within 5 business days of the operation (Código do IVA Art. 36); for shipped goods this is the dispatch date, not the order date
• Cross-border IVA — orders from EU consumers above the OSS threshold use the destination IVA rate via OSS, not the Portuguese 23%
• Returns and refunds — every refund requires a nota de crédito (NC) referencing the original FT; the NC is itself communicated to e-Fatura and listed in SAF-T PT
• Marketplace facilitator rules — Decreto-Lei 36/2021 implements EU rules making marketplaces deemed sellers for certain B2C transactions; the marketplace, not the seller, issues the customer invoice

NIF at Checkout — The 80% Adoption Rate

Portuguese consumers routinely provide their NIF at checkout to claim IRS deductions. Practical implications: keep the NIF field visible on the main checkout form (burying it in "additional info" drops the provide-rate from ~80% to under 30%); validate the NIF modulo-11 check digit at submission to prevent downstream e-Fatura errors; default to 999999990 ("consumidor final", the AT placeholder for anonymous B2C) when the shopper declines; and for B2B orders also collect company name and full address — fatura simplificada is not allowed when the customer provides a NIF, even below €1,000.

Marketplace-Specific Patterns

• Amazon.es / Amazon.fr selling into PT — Amazon is the deemed seller under DL 36/2021 for non-EU sellers; for EU sellers, the seller still invoices but Amazon collects destination IVA via OSS
• Worten Marketplace / Fnac.pt / Continente Online — domestic marketplaces with standard seller-invoiced model; seller issues all invoices in Portuguese with NIF and ATCUD; e-Fatura is the seller's responsibility
• Vinted / Wallapop — C2C platforms with DAC7 reporting obligations for the platform; registered businesses must still invoice and report normally
• Shopify / WooCommerce own-shop — full seller responsibility; the storefront's billing module must be AT-certified or connected to a certified service such as Zunapro

Dispatch Documents (GT / GA)

For physical goods, Portuguese law requires a documento de transporte (guia de transporte GT or guia de remessa GR) to be issued and communicated to AT before the goods leave the seller's premises. The dispatch document has its own AT communication channel (the GR webservice returns a transport identifier), separate from the invoice. Failure to issue a dispatch document is a Art. 117 RGIT infraction with fines €150-€3,750 per shipment.

Returns, Refunds and the Nota de Crédito

When a customer returns a marketplace purchase, the seller must:

1. Issue a nota de crédito (NC) with ATCUD from a dedicated NC series, referencing the original FT number
2. Apply the negative IVA at the same rate as the original invoice
3. Communicate the NC to e-Fatura within the standard day-5-of-M+1 window
4. Include the NC in the monthly SAF-T PT as a SourceDocument with the same SHA-1 hash chain
5. Reverse the inventory and refund payment via the marketplace or payment gateway

Zunapro automates all five steps when a refund is triggered from the marketplace order management module — one click and the NC is issued, communicated and reconciled.

Portuguese Legal Framework 2026 — Anchor Documents

The Top-Level Statutes

• Código do IVA (CIVA) — Decreto-Lei 394-B/84, consolidated; the master VAT statute, including Article 35-A on certified software and Article 36 on invoicing timelines
• Decreto-Lei 28/2019 — the modernisation framework that introduced ATCUD, structured invoice communication and the path to monthly SAF-T PT
• Decreto Regulamentar 25/2009 + Portaria 363/2010 — certified software requirements and inspection checklist
• Decreto-Lei 198/2012 — e-Fatura system establishment and communication obligations
• Portaria 321-A/2007 — original SAF-T PT mandate and XSD reference
• Portaria 195/2020 — ATCUD operational specification and SeriesService API
• Despacho 8632/2014 (revised 2020) — AT QR Code specification, all 18 fields
• Decreto-Lei 123/2018 + Decreto-Lei 111-B/2017 — B2G e-invoicing and FE-AP framework
• Decreto-Lei 36/2021 — implementation of EU marketplace facilitator rules for IVA
• Lei 15/2001 (RGIT) — General Regime of Tax Infractions; the penalty framework

Annual Budget Laws (Orçamento do Estado)

Each annual Orçamento do Estado adjusts SAF-T PT deadlines, IVA rates, regional exceptions and certified-software thresholds. The 2026 OE confirmed the day-5-of-M+2 monthly SAF-T PT timeline and froze the €650,000 monthly/quarterly IVA threshold. Stay current on the AT's Circulares and Ofícios Circulados — operational guidance often diverges in detail from the original Decreto-Lei text.

Consumer Protection Layer

• Decreto-Lei 24/2014 — distance contracts; 14-day right of withdrawal, mirrors EU Directive 2011/83/EU
• Código Civil Art. 921+ — 2-year statutory legal guarantee on consumer goods
• RGPD / Lei 58/2019 — Portuguese implementation of GDPR, supervised by CNPD
• Lei 144/2015 — out-of-court consumer dispute resolution and mandatory CIAB / centro de arbitragem links on every checkout

How to Activate Portuguese AT Compliance — 2026 Step-by-Step

1. Confirm Your Legal Setup

• Portuguese resident company / ENI — Sociedade por Quotas (Lda), Sociedade Anónima (SA) or Empresário em Nome Individual (ENI); standard path for established operations
• Foreign EU entity with PT VAT registration — non-resident registration via Portal das Finanças; still requires certified software and full AT compliance
• Foreign EU entity using OSS — for cross-border B2C only; OSS exempts you from PT VAT registration but not from the destination country's rules where applicable
• Foreign non-EU entity — fiscal representative in Portugal mandatory under Código do IVA Art. 30

2. Register Document Series and Obtain ATCUD Codes

For each document type (FT, FS, NC, ND, RC, GT, GA), define at least one series and register it on Portal das Finanças → Faturas → Comunicação de Séries to receive the 8-character validation code. A small e-commerce shop typically registers 3–5 series; a multi-store omnichannel operation 20+.

3. Adopt or Connect AT-Certified Software

Select a certified billing platform from the AT list. For marketplace and omnichannel sellers, Zunapro's certified module handles every layer (ATCUD, QR Code, hash chain, signature, e-Fatura, SAF-T PT, Peppol) and connects to Amazon, Worten Marketplace, Fnac.pt, Continente Online, Shopify and WooCommerce.

4. Configure e-Fatura and Monthly SAF-T PT

Provision a Portal das Finanças subuser with the FAT sub-perfil, test in the AT sandbox, then go live. Schedule the SAF-T PT export on day 1 of each month for the prior month, validate against XSD 1.04_01, submit via the AT SOAP webservice and store the receipt token. Alert on day 3 if submission hasn't succeeded — that gives 48h of buffer before the day-5-of-M+2 deadline.

5. Activate Peppol / FE-AP for B2G Orders

If you sell to any public-sector entity, register on FE-AP, obtain eSPap accreditation and configure your billing software to emit CIUS-PT XML for B2G recipients. Zunapro auto-detects public-sector customer NIFs (the AT publishes the list) and routes those invoices via Peppol automatically.

6. Connect via Zunapro (Setup in Under an Hour)

1. Sign in to Zunapro and open the Portugal module
2. Provide your NIF + AT subuser credentials — Zunapro tests the connection end-to-end
3. Register your document series — Zunapro talks to SeriesService and stores the validation codes
4. Connect marketplaces and storefront — Amazon, Worten Marketplace, Fnac.pt, Shopify, WooCommerce; OAuth or API key per channel
5. Enable monthly SAF-T PT auto-submit — single toggle; first export covers the current month-to-date
6. Optionally enable Peppol — for B2G or B2B Peppol-ready customers
7. Go live — next marketplace order produces an FT or FS with full AT compliance and is communicated to e-Fatura within seconds

Portuguese AT Compliance FAQ 2026