How CFDI Stamping Works in Mexican Payroll: The Government-Certified Receipt Behind Every Paycheck

In most countries the payslip is a document the employer designs and hands to the worker. In Mexico it is something else entirely: a government-certified electronic invoice, the CFDI de nómina, that has no legal force until it has been digitally stamped by an authorized provider on the tax authority's behalf. The stamp, the timbrado, is the moment a payment becomes real in the eyes of SAT, the Mexican tax authority. No stamp, no valid payslip, and no deductible payroll expense. Understanding how that stamp works, and why Mexico built payroll this way, explains a lot about what is different, and what is unforgiving, about running Mexican payroll.

Why the CFDI exists

To understand the stamp, start with the problem it was built to solve. For years Mexico had a large-scale invoice-fraud problem: companies that existed mainly to sell fake invoices, known as EFOS, empresas que facturan operaciones simuladas. A business would buy invoices for operations that never happened, inflate its deductions, lower its tax, and in many cases move money through transactions that had no real substance. Paper and self-printed invoices made this easy, because nobody was checking each document against reality in real time.

Mexico's answer was to move all invoicing onto a single, certified electronic format and to require that every document be validated and sealed by the tax authority before it could be used. The CFDI (Comprobante Fiscal Digital por Internet) is that format. Once payroll was pulled into the same system through the CFDI de nómina, SAT gained something powerful: every peso an employer claims as a payroll deduction is tied to a specific worker's tax ID, and every peso of income the worker reports is the same certified figure. The two sides have to match. Phantom employees and payroll deductions with no real worker behind them became far harder to hide, because paying one now requires issuing a stamped CFDI tied to a specific tax ID, which SAT can match against that person's reported income and the employer's claimed deductions.

What the stamp actually is

Three parties take part in the timbrado, the employer, an authorized certification provider, and SAT, and the order in which they act is fixed: the document has to be certified before the employer may issue it to the worker. The employer generates the payslip as an XML document, built to SAT's CFDI 4.0 structure with the payroll complement (complemento de nómina) attached, and signs it with its own digital seal certificate, the Certificado de Sello Digital. Before the document can be issued to the worker, the employer sends it to an authorized certification provider, a PAC (Proveedor Autorizado de Certificación), which acts for SAT.

The PAC validates the document against SAT's rules and catalogs, and if it passes, applies the SAT digital seal and assigns a unique identifier, the UUID or folio fiscal, then registers the document with SAT. Only at that point is the CFDI "timbrado," stamped, and legally valid. The obligation and this sequence come straight from Article 29 of the Federal Tax Code: the taxpayer must hold a valid electronic-signature certificate, obtain the digital-seal certificate, meet the content requirements, submit the document for certification before issuing it, and then deliver the sealed file to the recipient. The stamped CFDI has to be issued within a window of roughly three to eleven business days of payment depending on the employer's size, and both employer and worker must retain it for five years.

How the stamp works on payroll

Two features make the payroll case distinct. First, in Mexico the CFDI de nómina is the payslip. There is no separate pay-stub format in addition to the tax document; the certified electronic invoice is the official receipt, and it must follow CFDI 4.0 with the payroll complement in its current version. Everything on a payslip lives inside that structure: the perceptions (percepciones) such as salary, overtime, and bonuses; the deductions (deducciones) such as social security and income tax withheld; and a separate "other payments" block (otros pagos) that holds items like the subsidio al empleo credit.

Second, the stamp is what links the whole chain together. Because the employer's CFDIs are the evidence of what it paid, an employer can only deduct payroll for corporate income tax if valid stamped CFDIs exist for those payments; without them, the deduction is lost. On the other side, SAT pre-fills each worker's annual tax return from the same stamped CFDIs, so the employee's declared income is built from documents the employer already certified. The stamp matters in the courtroom too: a CFDI de nómina has full evidentiary value in a labor dispute to prove that wages were paid and in what amount, without needing the worker's physical signature, once it is verified through the SAT portal.

When a CFDI is wrong, missing, or late

Several steps in the process are strict, and each has a concrete consequence attached. A CFDI that fails the PAC's validation is simply not stamped, which means the payslip does not legally exist until the error is fixed and the document is resubmitted. Missing a CFDI de nómina altogether is a tax violation with a fine on the order of MXN$17,000 to MXN$97,000 per missing document. On top of the fine, the employer cannot deduct that wage payment for corporate income tax, because in Mexico a payroll cost is only deductible if a valid stamped CFDI backs it.

The rules also change from year to year. SAT republishes the payroll complement, the technical format the CFDI de nómina must follow, with changes most years, so a structure that validated last year can stop validating. The version effective from January 2026, Revisión E, tightened the validation rules and raised the employment-subsidy limit recorded in the document. And from 2026 the Federal Tax Code adds a materiality requirement: a CFDI must document a real, existing operation, and one that does not is treated as false for tax purposes, which extends the original anti-simulation logic directly into the rules each payslip has to satisfy. Cancellations are their own process, requiring a stated reason and, in most cases, the recipient's acceptance, so a mistake on a stamped document cannot simply be deleted.

What every Mexican payslip requires

The stamp is the point where a payment stops being an internal number and becomes an official, tax-recognized record. Every payment has to meet the same requirements: a correctly built payroll complement, certified by a PAC within the deadline, kept for five years, and matching the worker's tax ID and the employer's deductions. Each requirement has a specific consequence if it fails. If the document is built wrong, the PAC rejects it, and there is no valid payslip until it is corrected. If a payment is made without a CFDI, the employer loses the deduction and can be fined per missing document. And if the employer keeps using last year's format after SAT has updated it, the documents no longer validate.

Flux builds the CFDI de nómina complement for each payment, submits it for PAC timbrado, tracks the returned UUID, and keeps the structure current as SAT reissues the complement and its catalogs each year, so every payslip is a valid stamped document from the day the new rules take effect. In Mexico the tax authority is effectively a party to every paycheck, because no payment is complete until SAT has certified it. For an employer, that means the real task is producing a valid, stamped CFDI for every payment, on time, in the current format, every cycle.