What a digital certificate actually is
It is not a password and it is not an account. It is a file installed in your browser or on your computer, issued by a recognised authority, that does two things: it proves you are you, and it signs. Anything submitted with your certificate is legally attributed to you, exactly as if you had signed a paper document in front of a civil servant. That is the whole point of it, and it is also the reason for the warning further down this page.
The one nearly everybody uses is issued free of charge by the Spanish Royal Mint, the FNMT, for individuals. There are also certificates issued to companies and to representatives of companies, and there is an alternative system, Cl@ve, which is not a certificate at all. They are not interchangeable, and we come back to that.
The sequence, in order
- Request it online and keep the request code. On the FNMT site you enter your NIF or NIE, your surname exactly as it appears on your identity document and an email address. You are sent a request code. Write it down somewhere other than the computer you are using. Time: ten minutes.
- Prove who you are, in person. You take that code and your identity document to a registration office — a tax office, a Social Security office, many town halls. An appointment is normally required and in busy coastal offices it can be two or three weeks out, so book it the same day you request the code. Time: fifteen minutes at the counter, plus the wait for the appointment.
- Download it on the same computer, in the same browser. This is the step that catches people. The key pair was created in the browser you used to request the certificate. Download it anywhere else and it will not install. If that machine has been wiped, updated aggressively or replaced in the meantime, you start again from step one.
- Export a backup immediately. From the browser's certificate manager, export it as a password-protected file and store that file somewhere you will still have access to in three years. Do this before you use the certificate for anything, because the day you need the backup is the day you no longer have the computer.
- Install it wherever you will actually use it. The exported file can be installed on a second laptop or on a phone. Do it now rather than at nine in the evening on the 20th of the month.
- Note the expiry date in your calendar. Certificates expire. While yours is still valid you can usually renew online without going anywhere; once it has expired you are back to the in-person appointment. A certificate that lapses in the middle of a filing period is a genuinely avoidable problem.
If you live abroad and cannot attend in person
This is the ordinary situation of a non-resident owner, and it has three answers.
- A Spanish consulate. Many consulates act as registration offices for the identity check, which removes the need to travel to Spain. Availability varies enormously between consulates, so ask before planning anything around it.
- A power of attorney granted before a notary, apostilled where the country in question is party to the Hague Convention, allowing somebody in Spain to act for you. This is heavier and costs money, but it solves more than the certificate alone.
- Appointing a representative at the tax office, which for tax purposes is usually the cleanest answer of the three and is covered on its own page: appointing us at the tax office.
What Cl@ve is, and when it is enough
Cl@ve is an identification system run by the government in which you register once and then identify yourself with a code sent to your phone, or with a permanent password. Registration is done in person, or by requesting a letter sent to your registered address in Spain, or in some cases by video call. It is convenient and it covers a great deal of routine consultation and filing.
It has two limits worth knowing. It is tied to a Spanish mobile number and, in the letter route, to a Spanish address, which many non-residents do not have. And there are procedures — particularly anything involving representation, company matters or documents requiring a qualified signature — where only a certificate will do.
| Route | What it gets you | The catch |
|---|---|---|
| FNMT certificate | Everything, including signing on behalf of others where you are authorised | One in-person identity check, and it is a file you have to look after |
| Cl@ve | Most personal filings and consultations | Needs a Spanish phone, and does not reach every procedure |
| Appointing a representative | We file, you keep your credentials | You still need a way of granting it in the first place |
Advisers still ask clients to email them the certificate file and its password. Understand what that means: the holder can sign anything in your name, accept notifications on your behalf, consult your whole tax history and bind you to filings you never saw. If the relationship ends badly, or the adviser's laptop is compromised, there is no way of proving which submissions were yours. The register of representatives exists precisely so that this is never necessary, and we have never asked a client for a certificate.
What usually goes wrong, and the fix
| The problem | Why it happens | What to do |
|---|---|---|
| The download fails or the certificate will not install | Different browser, different machine, or the browser profile was reset between request and download | Start the request again. There is no way to recover a key pair that no longer exists |
| The surname is rejected | Foreign documents often carry one surname where the Spanish system expects two, or a middle name recorded as a surname | Enter it exactly as printed on the document used for your NIE, spaces and all |
| The appointment system shows nothing available | Coastal offices in season | Look at neighbouring towns and at Social Security offices, which are often emptier than tax offices |
| It expired last month | Nobody diarised it | Renewal online is only possible before expiry. After that, the in-person route again |
| It works at home but not at the office | The certificate is installed per user profile and per machine | Install the exported backup file on the second machine |
How this fits with us
You do not need a certificate for us to act for you. What you need is either a certificate or Cl@ve once, to grant the representation, or a signed standard form that we lodge on your behalf. After that, the quarterly and annual filings happen without you touching the electronic office at all. If you would rather see the whole picture first, our how it works page sets out the four steps, and our pricing explains what is included.
It is still worth having your own certificate even if you never use it. It is the only way to read your own tax file, check what has been filed in your name and download your own history if you ever change adviser. Ownership of your own record is not a small thing.
Klaus, twelve years in Torrox and no way into his own file
Klaus has owned a flat in Torrox for twelve years and lives in Cologne. A neighbour tells him the tax office has started writing to foreign owners, and he wants to check something simple: which returns appear in his name. He cannot. He has no certificate and no Cl@ve, and his former agent, who kept "the client's certificate" on his own computer, has retired. What was at stake for Klaus was not a formality. It was whether a notification was already waiting for him with its deadline running.
Between the consulate appointment and the download, his certificate took five weeks. When he finally logged in he found a communication from four months earlier. Nothing serious, but its deadline had passed.
Where the Spanish electronic identity card fits
Spanish nationals have a third option alongside the FNMT certificate, which is free, and Cl@ve: the electronic national identity card, the DNIe, which carries a certificate of its own. It does the same things as the FNMT one, but it is available only to nationals and needs its PIN plus either a card reader or a phone with NFC. For most readers of this page, therefore, the realistic choice is between the FNMT certificate for everything and Cl@ve for day-to-day use.
What your own login shows you that nobody else will
Even with every return filed by a representative, a certificate of your own lets you see what has been filed in your name, download the tax data held about you, confirm the tax address on record and look for electronic notifications waiting to be opened. That last one matters: a notification placed in your electronic mailbox counts as delivered after ten calendar days whether or not anyone opens it, as set out in how deadlines and electronic notices are counted. If the address on file is the one you had a decade ago, correct it; the route is in fixing your tax address.