Digital Certificates in Spain: What Foreign Companies and Residents Need to Know

Introduction

In this guide by Accompany, we explain everything foreign companies and non-residents need to know about digital certificates in Spain: from the legal definition and the difference between a digital certificate and an electronic signature, to the types available (FNMT, Cl@ve, DNIe), how to obtain one, and why it is now a non-negotiable requirement for anyone managing administrative procedures in Spain.

Whether you are a European entrepreneur who has incorporated a Spanish SL, a director or senior employee who has recently relocated to Barcelona or Madrid, or a non-resident managing tax obligations in Spain: understanding how the Spanish digital certificate (certificado digital) works, which type applies to your situation (personal, company representative, or Cl@ve), and how to keep it valid over time, is essential to operate without friction from the Agencia Tributaria (AEAT), Social Security, and Spanish public administration at every level.

How to get a Digital ID?

The process of getting a Spanish Digital Signature (Certificado Digital) can be confusing. The different layers of government and autonomous regions have not been able to agree on one single system and now there are several partial solutions around. Besides, the websites are not always very clear, there are specific technical requirements to keep in mind and often a physical appointment is required to complete the process.

Before you can get a Digital Signature, you’ll need a DNI or will first need to obtain a NIE (número de identidad de extranjero), which is a national identification number for non-Spanish residents. For more information on how to get a NIE, check out our guidelines or contact us to help you get their papers in order. Once you have your NIE, you can file your application for a digital certificate.

Spanish citizens can also get an electronic DNI, or DNIe. We can help you obtaining the Spanish nationality and once you become a Spanish citizen, you will be given a PIN number that corresponds to your DNIe when your official identity card is issued. In order to use the certificate associated with your DNI, you’ll need to download a specific application from the government’s website. The certificates have to be renewed every five years, which can be done at most Spanish National Police stations.

Both Spanish citizens without a DNIe and Non-Spanish legal residents can also choose from any one of the following digital options:

FNMT Certificate (Fábrica Nacional de Moneda y Timbre)

A Digital Signature from the National Currency and Stamp Factory (FNMT), or Spanish Royal Mint. This type of signature can be obtained by individuals as well as legal entities and their representatives, and is one of the most widely accepted types of digital ID. It is not just a digital signature or a password, it is a unique encrypted certificate with a serial number that must be stored in one place and is recognized by all Spanish government entities and public institutions. Personal (individual) FNMT certificates are currently valid for 4 years; corporate representative certificates are valid for 2 years. Both can be renewed online within the 60 days prior to expiry, provided the certificate is still active. If it expires before renewal, the full in-person process must be restarted from scratch.

The FNMT application process for individuals follows four steps: (1) download and run the FNMT Configurador application; (2) request the certificate online at sede.fnmt.gob.es using your NIE and last name; (3) verify your identity in person at an authorised office (AEAT offices, some ayuntamientos and notaries); (4) download and install the certificate in the same browser and computer used for the request. Firefox is the recommended browser — Safari is not supported for installation.

The Cl@ve System

The Cl@ve system is a cloud-based electronic password system that issues permanent (Cl@ve Permanente) and temporary single-use (Cl@ve Pin) passwords via SMS and the Cl@ve mobile application. As the electronic certificates are stored by the public administration and accessed using the aforementioned passwords, they can be used anywhere that has an internet connection, without having to access a specific computer. This system is exclusively available to physical persons acting in their own name, not to legal entities or their representatives. It is recognized by nearly all Spanish government entities and public institutions.

Cl@ve PIN provides limited access and is suitable for occasional personal procedures. Cl@ve Permanente offers broader access but still does not cover all AEAT procedures available to certificate holders. For company directors acting on behalf of their Spanish SL, Cl@ve is not a substitute for the FNMT representative certificate.

The idCat

The idCat is a digital certificate with the same concept as the FNMT certificate but is issued by the Consortium of Open Administration of Catalunya. It only works within the confines of Catalunya and only applied to legal processes involving the Catalan government.

MobileID

The MobileID is another form of identification that, as its name implies, is tied to your mobile phone and functions via SMS validation. It is an application available on GooglePlay and the Apple AppStore, it is not an encrypted certificate that needs to be installed. This system only allows for the representation of legal persons and is valid only for procedures with the Barcelona City Council. It expires after five years.

Pros@ / Sistema JNLP

Pros@ or Sistema JNLP is a system used by the Social Security services and is known to provoke compatibility issues depending on the system you use, the version of your operating system, Java or other applications running at the same time.

Note for companies with employees in Spain: Social Security administrative procedures (payroll filings, new hire registrations, terminations) are managed through the Sistema RED online platform, which requires a representative certificate and specific authorisation granted by the TGSS (Tesorería General de la Seguridad Social). This is separate from and additional to the AEAT digital certificate. See our guide on Payroll compliance in Spain for the full scope of obligations.

Types of Digital Signature

Besides, apart from different systems, there are different kinds of Digital Signatures to choose from to make it even more confusing, for example:

• Signatures for individuals either for private use or as freelance professionals representing themselves in an administrative or legal context.
• Signatures for individuals linked to an organization without the capacity to represent it. The identified person belongs to a professional group and/or business and can act in his or her own name but cannot take legal action in the name of the group or company.
• Signatures for individuals linked to an organization with representation capacity. The identified person belongs to a professional group and/or business and can act on behalf of the group or company in legal matters.
• Signatures for individuals belonging to a professional group and/or business and are identified as the group or company itself; for example, a sole proprietorship. In this case, the entity should have its own legal ID number (a NIF), separate from your NIE, DNI or passport number.

What Digital Signature should I apply for?

All the different certification solutions described have a number of problems in common:

• The application process is lengthy, bothersome and involves a physical appointment
• The ID’s do not cover all regions or are not recognized by all administrations
• Some ID’s only work on computers while others only work on mobile phones
• The only way to authorize a third party is to give them a copy of the file and the password
• There is no way to see or to limit what somebody is doing with your certificate
• There is no way you can check if your personal data are being respected

Since the state monopoly on digital certification was lifted some years ago, a number of technological solutions like the one we use have been created and officially recognized. These have the following advantages:

• Fast online application and emission process
• Safe hosting in a secure cloud server, available anywhere anytime
• Works for all administrations, autonomous regions and municipalities
• Explicit authorization of users that can be cancelled at any moment
• Logging of usage of your certificate with identification of user, time and action
• Personal data protection in line with the latest legislation and technology
• Automatic renewal of expired certificates

In order to avoid security risks and liability issues for our clients, we only work with the new generation of cloud based Digital Signatures of which we are an authorized certification and emission center.

Personal digital signatures (cloud-based, managed by Accompany) can be requested for a validity period of 2 to 3 years. Corporate representative digital signatures have a validity period of 2 to 5 years. These are the validity periods for the cloud-based certificates managed through our platform; FNMT-issued personal certificates have a standard 4-year validity.

We also offer a convenient remote identification process, eliminating the need for physical displacement.

Electronic Mailboxes and DEHú: A Critical Obligation for Spanish Companies

Having a valid digital certificate is not just useful in Spain, it is legally necessary for companies to receive official notifications from the AEAT, Social Security, and other public bodies. Since January 2016, all Spanish legal entities (SL, SA) are mandatorily enrolled in the electronic notification system, through which the public administration sends official notifications digitally.

Since 2022, the unified platform for these notifications is DEHú (Dirección Electrónica Habilitada única), which consolidates notifications from the AEAT, Social Security, and other national bodies in a single electronic inbox, accessible at dehú.gob.es. All Spanish SLs are automatically enrolled. The system requires a valid digital certificate or Cl@ve credentials to access.

Two practical actions every foreign company director must take after incorporation: (1) access DEHú and configure email alerts so that every new notification triggers an immediate warning to a monitored inbox; (2) assign a representative with a valid digital certificate to check the mailbox regularly. Without these steps, notifications arrive silently and the legal countdown begins regardless.

A critical legal detail: official notifications sent to your DEHú mailbox are deemed legally served 10 days after delivery, whether or not they have been read. Missing a notification — because no one is monitoring it — has the same legal effect as receiving and ignoring it. Fines, tax requirements, and compliance deadlines can lapse as a result. This is one of the most common and costly gaps identified in companies that switch to Accompany from a previous advisor.

Accompany monitors DEHú and electronic mailboxes as part of its standard compliance service for foreign companies, ensuring that no official notification goes unattended.

How Accompany Manages Digital Certificates for Its Clients

At Accompany, we manage digital certificates on behalf of the foreign companies and directors we work with — handling the full process from application to renewal, with no physical displacement required from the client. Our scope includes:

• Personal certificates for directors and employees with NIE and residency obligations in Spain.
• Representative certificates (certificado de representante) for Spanish SLs, enabling full interaction with AEAT, Social Security, and Registro Mercantil.
• Ongoing monitoring of electronic mailboxes (buzón electrónico) to ensure no official notification is missed.
• Proactive renewal management: we alert clients before certificates expire and renew within the 60-day window to avoid process restarts.
• Power of attorney (apoderamiento): for directors who are non-resident in Spain and prefer not to obtain a personal Spanish digital certificate themselves, Accompany can act as authorised representative before the AEAT and other public administrations through a notarised power of attorney (apoderamiento APO). This eliminates the need for the director to go through the FNMT process personally while maintaining full legal compliance.

The power of attorney route is particularly common for Dutch and other European directors whose Spanish SL is managed remotely from abroad. The apoderamiento is granted before a Spanish notary or consulate, registered in the AEAT’s representative registry, and allows Accompany to file returns, respond to tax authority requirements, and manage all administrative procedures on the company’s behalf with the director’s full oversight but without requiring their personal digital certificate.

If you are setting up a company in Spain or have taken over management of an existing SL without a valid digital certificate in place, contact Accompany. We work exclusively with international companies and their teams.