A French entrepreneur sends a Kbis (the official extract from the French companies register) to prove that their company exists, a copy of their identity card to open a bank account and, if they run a small business, PDF invoices until September 2027. Their European neighbours do things differently. In Portugal, you don't send a register extract: you hand over a code. In Italy, a PDF invoice has had no value for tax purposes since 2019. In Spain, customers will be able to check an invoice with the tax authority by scanning a QR code. And in the UK, a country with no identity card, the companies register was so open that companies were set up in the names of government ministers.
After our series on company paperwork in France, this one looks at how four countries handle the same documents: what they got right, what went wrong, and what can be learned from it on the French side of the Channel.
Four countries, four answers to the same questions
Every administration faces the same problems: proving that a business exists without the proof being easy to forge, checking identity without multiplying copies, making invoices reliable, and keeping the register transparent without exposing directors. Each country has favoured a different answer.
The UK bet on complete openness, then had to correct course. Searching the Companies House register has been free since June 2015, and its data was accessed more than 16 billion times in 2023-24 (Companies House). With no checks in place, it took in sham companies registered at strangers' addresses; since 18 November 2025, directors' identities have had to be verified, with a twelve-month transition period for existing companies (gov.uk).
Spain bet on controlling invoicing software and on minimising personal data. Its VeriFactu system requires chained invoices and a QR code the customer can check (AEAT); its data protection authority, the AEPD, considers that a copy of the identity card (the DNI) is generally not necessary (AEPD).
Italy bet on a single public platform, the Sistema di Interscambio (SdI), through which every invoice has passed since 2019, with free tools (Agenzia delle Entrate guide), and on certified email (PEC, a kind of electronic recorded delivery) being mandatory for every business.
Portugal bet on access rather than copies: a code that gives access to the up-to-date register entry for one to four years and replaces the paper extract (gov.pt); and invoices that have been chained and carried a QR code for years.
France, for its part, combines a register that can be searched for free (the RNE extract, from the national business register), a dated Kbis that has to be paid for (see our episode on the Kbis), e-invoicing that goes through approved private platforms and becomes mandatory for SMEs to issue in September 2027 (LegalPlace), and an official recommendation to watermark copies of identity documents.
What went wrong?
Every model has its downside, and that's often the most instructive part.
- In the UK, the open register served fraudsters well. Having your address or signature removed from an old filing now costs £34 per document (gov.uk).
- In Spain, VeriFactu, originally planned for 2025, has been delayed twice, and a third delay, to October 2028, was announced on 5 October 2026 but has yet to be published (Hacienda). And the same state that advises against photocopying the DNI requires hotels to record up to 42 pieces of data per guest.
- In Italy, certified email is now used to spread malware from hacked inboxes (CERT-AGID), and the VAT gap started rising again in 2023.
- In Portugal, the requirement to sign PDF invoices has been pushed back every year since 2020; the 2026 budget still accepts unsigned PDFs until 31 December 2026 (OCC), and the draft 2027 budget proposes another delay. One private website even charged nearly twice the official price for the register code.
One thing runs through all four countries, as it does in France: every reform spawns its own phishing. Fake Companies House messages about identity verification, fake e-invoices in Italy, fake emails from the Portuguese tax authority with a "PortaldasFinancas.pdf" attachment, a fake "notificación de factura electrónica" in Spain. Scammers follow the administrations' timetables, in France too (see the scams that follow company registration).
The episodes in the series
- UK: Companies House, Europe's most open register: companies in ministers' names, hijacked home addresses, and identity verification required since 2025.
- The UK: no ID card, yet everyone gets checked: the abandoned digital ID, passport copies, and e-invoicing in 2029.
- Spain: VeriFactu, the invoice your customer can check with the tax authority: the QR code, chained invoices and the delays.
- Spain: no more photocopying your ID card: the data protection authority's doctrine, the fines, and the MiDNI app.
- Italy: seven years of mandatory e-invoicing: the PDF reduced to a courtesy copy, the free tools, the effect on fraud.
- Italy: PEC, the electronic recorded delivery that fraudsters now target: the mandatory digital address, and phishing from certified inboxes.
- Portugal: the register extract replaced by a code: the company set up in a single visit to the counter, and the certidão permanente.
- Portugal: the QR-coded invoice, and the signed PDF postponed since 2020: certified software, ATCUD, and a requirement pushed back year after year.
What can France take from all this?
Three ideas come up from one country to the next, and all of them can be applied today.
Share access rather than a copy. The Portuguese code, the MiDNI app or the identity certificate from France Identité (the French state's ID app) pass on what's needed and nothing more. When a French partner asks for a Kbis, the company's SIREN number lets them look up the RNE extract themselves, free and up to date, even if some will still insist on a Kbis (see our episode on the Kbis).
Check at the source rather than trusting appearances. The QR code on a Spanish invoice, the code on an Italian visura (register extract) or the one on a Kbis points back to the register or the tax authority: that's where to check, not on the document itself. And an official channel, even a certified one such as Italian PEC, doesn't guarantee the sender is honest.
Prepare your documents yourself. A copy you can't avoid sending can be cut down to what's needed with Redact PDF and marked with its recipient's name using Watermark PDF; a dubious attachment can be run through Inspect PDF, which flags JavaScript, automatic actions and embedded files before you open it. These tools work in the browser, without sending your files to a server (see where your PDF files go online). They don't replace an approved invoicing platform, an identity verification service or a legal professional.
Glossary
Companies register: a public register listing businesses and their directors; Companies House in the UK, the Registro Mercantil in Spain, the Registro delle imprese in Italy, the Registo comercial in Portugal, the RCS and RNE in France.
E-invoice: an invoice issued, sent and received as structured data, rather than as a plain PDF file.
Invoice chaining: a technique that embeds a fingerprint of the previous invoice in each new one, so that any deletion or insertion can be detected.
Data minimisation: the GDPR principle that only strictly necessary data should be collected.
Phishing: posing as a trusted organisation to obtain a payment or information.
Prepare your documents without sending them to a third party: PDFKami, in your browser.