What Is CFDI? A Guide for US Companies in Mexico

Your Mexican supplier sends an XML file instead of a PDF invoice, and your accounts payable team has no idea what to do with it. This guide explains what CFDI is, which fields actually matter, and how to wire Mexico's e-invoicing rules into the systems you already run.

A supplier in Monterrey ships you parts, and your accounts payable inbox gets an email with two attachments: a PDF that looks like an invoice and an XML file nobody opens. Three weeks later the vendor is calling about payment, your controller is asking which document is the real one, and your Mexican subsidiary's accountant says the expense cannot be deducted because the XML was never validated.

That is the moment most US finance and IT leaders ask what is CFDI and why Mexico does invoicing so differently. The short answer: Mexico does not have paper invoices with an electronic copy. It has electronic invoices with a paper-looking summary, and only the electronic version counts.

If you buy from, sell in, or operate a company in Mexico, understanding this changes how you design your AP process, your ERP integration and your document retention policy. Here is the practical version, without the tax jargon.

What Is CFDI and Why Mexican Invoices Look Different

CFDI stands for Comprobante Fiscal Digital por Internet — roughly, "digital tax receipt via internet." It is the mandatory electronic invoice format in Mexico, defined and enforced by the federal tax authority, the SAT.

Unlike the US, where an invoice is whatever document a seller and buyer agree on, Mexico standardized the invoice itself. Every sale, every payroll payment, every payment receipt and every freight movement produces a structured file in a format the government specifies, validates and stores.

The current version is CFDI 4.0, which replaced 3.3 and became the only accepted version for new invoices in 2023. Version changes are not cosmetic: they add required fields and tighten validation, which is why integrations that worked fine one year break the next.

The XML Is the Invoice; the PDF Is a Picture of It

This is the single most useful thing to tell your AP team. The legal document is the XML file. The PDF — properly called the representación impresa, or printed representation — is a human-readable rendering with no legal weight on its own.

Practically, that means you cannot archive the PDF and delete the XML. If an audit asks for support on a deduction, the XML is what gets produced, and it has to still validate.

It also means your document management system needs to store and index XML, not just scan images. Teams that treat the XML as "the attachment we ignore" end up rebuilding their entire archive two years later, usually under time pressure.

Who Stamps It: SAT, PACs and the UUID

A CFDI is not valid because the seller created it. It becomes valid when it is certified — "stamped" — through an authorized certification provider, known as a PAC (Proveedor Autorizado de Certificación), which validates the structure and registers it with the SAT.

The stamp adds a timbre fiscal digital and a UUID: a unique 36-character identifier that acts as the invoice's fingerprint. Two documents can have the same vendor invoice number; no two valid CFDIs share a UUID.

Use the UUID as your primary key. If your ERP matches invoices on vendor number plus amount, you will eventually double-pay a reissued invoice. Matching on UUID makes duplicates structurally impossible, and it gives you a clean way to verify any document against the SAT's own records on the official SAT portal.

The Fields Your Team Will Actually Argue About

Most CFDI disputes are not about tax law. They are about four or five fields that someone filled in wrong and that cannot be edited after stamping.

RFC — the taxpayer ID of both parties. One wrong character and the invoice is useless to the buyer.
Nombre and Régimen Fiscal — the receiver's legal name and tax regime, which must match SAT records exactly, including punctuation and legal suffix.
Código Postal — the receiver's tax-domicile ZIP code, which CFDI 4.0 validates against the registered address.
Uso del CFDI — a code declaring what the buyer will use the purchase for, such as acquisition of merchandise or general expenses.
Método and Forma de Pago — whether it is a single payment or installments, and the payment instrument used.

Here is the operational rule worth putting in your vendor onboarding packet: give suppliers your exact tax data in writing once, in a single block, and ask them to copy it verbatim. A one-page "invoice us this way" sheet with legal name, RFC, ZIP code, tax regime and the intended use code prevents the majority of rejections.

Payment Receipts: The Second Document Nobody Expects

When an invoice is issued as payable later rather than paid on the spot, the seller must also issue a payment receipt complement — the complemento de pago, or REP — each time money actually arrives.

So a single transaction on credit terms generates at least two CFDIs: the invoice, then one receipt per payment. Partial payments mean more. If your AP process assumes one document per purchase, your records will not reconcile with your vendor's.

Build this into your workflow explicitly: a column tracking whether the payment complement was received, and a monthly check against what you actually paid. It is tedious manually and trivial once automated, which is exactly the kind of gap electronic invoicing software for Mexico is built to close inside your existing ERP.

Carta Porte: When Freight Enters the Picture

If goods move on Mexican roads, rail, water or air, the transport document is also a CFDI — specifically, one carrying the Complemento Carta Porte. It declares what is being hauled, by whom, in what vehicle, along what route and with which permits.

This matters to US shippers and distributors more than it first appears. Carriers get stopped and inspected, and a missing or wrong Carta Porte can strand a truck with your inventory on it. The transport and logistics rules behind it come from the federal transport ministry, the Secretaría de Infraestructura, Comunicaciones y Transportes, alongside SAT's fiscal requirements.

What to Ask Your Carrier Before You Ship

Do you issue Carta Porte yourself, or do you need data from us?
Which product classification codes will you use for our SKUs?
How will you send us the stamped XML, and how fast?
Who corrects an error — and what is the turnaround?

Answer those four before the first load, and store the responses with the carrier contract. Most Carta Porte emergencies are really data-handoff problems discovered at a checkpoint.

Cancellations: Why You Can't Just Void an Invoice

In the US, a seller voids an invoice and issues a new one. In Mexico, cancelling a stamped CFDI generally requires the buyer's acceptance through the SAT portal, must state a reason code, and must reference the replacement document when one exists. There are also time limits on when cancellation is allowed at all.

The downstream effect is real: your vendor cannot fix a bad invoice without your cooperation, and your team becomes a bottleneck. Assign an owner for cancellation requests and a service-level target — two business days works for most companies.

This is also where the "edit it later" habit gets expensive. Validating data before stamping costs minutes; unwinding a wrong stamp costs days and sometimes a closed accounting period.

Wiring CFDI Into the Systems You Already Run

You do not need to replace your ERP to handle CFDI properly. You need a layer that handles five jobs reliably.

Ingest — pull XML from email, supplier portals and SAT downloads automatically.
Validate — check structure, verify the stamp, and confirm the UUID is live and not cancelled.
Match — tie the UUID to a purchase order, receipt and payment.
Archive — store the XML immutably, with the PDF as a convenience copy.
Monitor — re-check previously accepted UUIDs periodically, because a vendor can cancel after you have paid.

That last one surprises people. A cancelled CFDI you already recorded is a deduction you no longer have support for, and you will only find out if something is actively watching.

A Reasonable First 30 Days

Week one: inventory where XMLs currently land and who touches them. Week two: publish the vendor invoicing data sheet and standardize on UUID as the matching key. Week three: automate ingestion and validation for your top twenty suppliers by volume. Week four: add the cancellation monitor and a payment-complement tracker.

Scope it to your highest-volume vendors first. They generate most of the documents and most of the errors, and fixing them proves the process before you roll it out broadly.

Getting It Right Without Becoming a Tax Expert

The honest framing of what is CFDI is this: it is a data integration problem wearing a tax costume. The compliance rules are set by someone else, they change on a schedule you do not control, and the only sustainable answer is systems that validate automatically instead of people checking PDFs by hand.

One note worth repeating: nothing here is tax or legal advice, and CFDI rules shift. Confirm your specific obligations — regime, complements, deductibility, retention periods — with a Mexican accountant or tax attorney before you finalize a process. What this article gives you is the structure to have that conversation efficiently.

On the build side, this is well-trodden ground. Our team works from Mexico in US time zones, which means the people who understand SAT validation rules are available during your business day, not twelve hours offset from it. If you are mapping CFDI into an ERP, a WMS or a homegrown AP workflow, get a quote for your project and we will walk through your current document flow before anyone writes code.