5 mistakes that will get your CSD suspended at SAT in 2026

Why this matters in 2026

SAT opened 2026 with its toughest CFDI enforcement campaign since 2020. A CSD restriction under article 17-H Bis stops your SMB from issuing any invoice in 5 business days — and gives you 40 days to fix it before permanent cancellation.

These are the 5 mistakes that trigger most Digital Seal Certificate suspensions at SAT in 2026, with verifiable IMCP data, field scenarios, and prevention steps. If your business files as a corporation or as an individual with business activity (PFAE) and issues more than 10 CFDIs a month, this guide is directly operational.

One-minute summary

• No active CSD means zero CFDIs: no income, no expense, no payroll, no payment complement.
• Article 17-H Bis of the CFF triggers a temporary restriction in 5 business days, with no prior notice.
• The 5 triggers in 2026: CFDI vs. tax-return mismatch, unlocatable tax domicile, EFOS transactions (69-B), inactivity, and fictitious operations.
• You have 40 days to file an aclaración request; SAT must respond within 10 business days.
• Cost benchmarks: recovering a restricted CSD runs 15,000–50,000 MXN; a preventive accountant costs 1,500–3,000 MXN per month.

What the CSD is and why it gets suspended

The Certificado de Sello Digital (CSD) is the certificate that signs every CFDI 4.0 you issue. SAT grants it to corporations and to individuals with business activity (PFAE). It is valid for 4 years.

Without an active CSD:

• You cannot issue invoices — your B2B customer will not pay without a valid CFDI.
• You cannot stamp payroll — friction with staff and with IMSS.
• You cannot credit input VAT on purchases — cash flow drops.
• You cannot issue payment complements — you breach the obligation to notify SAT of collections.

Article 17-H Bis of the Federal Tax Code (CFF) lets SAT temporarily restrict CSD use. The rule has been on the books since 2020, but in 2025 IMCP recorded a 35% year-over-year increase in restrictions — roughly 200,000 RFCs restricted in a single year.

After a restriction, the taxpayer has 40 days to file an aclaración request through the SAT portal. SAT must rule within 10 business days. Positive ruling: CSD reactivated. Negative ruling or missed deadline: the case escalates to permanent cancellation under article 17-H, with a full compliance review (60–90 days) needed before a new CSD can be issued.

On January 1, 2026 an updated rule from the Resolución Miscelánea Fiscal 2026 took effect: CFDIs must reflect real, verifiable operations. If SAT cross-references with banks, IMSS, INE, or customs and the declared operation lacks material backing, the restriction applies automatically.

The 5 mistakes that trigger most CSD blocks in 2026

The 5 triggers that appeared most in 17-H Bis restrictions last year, in order of frequency per IMCP 2025.

#1. CFDI vs. tax-return mismatch

Most frequent trigger: about 38% of 2025 restrictions. Classic scenario:

• January: CFDIs issued for 1,200,000 MXN.
• Monthly VAT return: 850,000 MXN declared.
• SAT's automated cross-check detects a 350,000 MXN delta.

Fraction IV of 17-H Bis applies — discrepancy detected by the authority. The restriction takes effect in 5 business days.

What to do: set up automated reconciliation of issued CFDIs vs. tax returns before filing. In Odoo this comes from l10n_mx_edi plus a custom pre-submission reconciliation report. In Excel: at minimum a monthly pivot broken down by CFDI type (Income, Expense, Transfer, Payroll, Payment). Deeper operational context in our Odoo audit service.

Preventive move: the complementaria can be filed through the SAT portal as many times as needed. If you file it yourself before SAT spots the delta, the restriction is almost never applied. Cheapest defense in the playbook.

#2. Tax domicile not locatable

Fraction III, about 22% of 2025 cases. SAT dispatches a verifier — physical or by certified mail plus Google Street View — to confirm the declared tax domicile exists.

2026 scenario: an e-commerce SMB registered its tax domicile in the owner's apartment. Owner moved, new tenant does not know what an RFC is. The verifier records tax domicile not locatable and the restriction lands in 5 days.

What to do:

• Keep at least one physical address with a company sign and someone who answers the door during business hours (9:00 to 18:00).
• If you run remote, sign up at a real coworking (Regus, WeWork, IOS Offices) with a written contract and reception access.
• Skip the virtual office for 30 USD per month. SAT has those flagged and rejects them on visit.
• Update the tax domicile the same day you move, through the SAT portal — 30 minutes online.

#3. Transactions with EFOS (Article 69-B)

EFOS — companies that invoice simulated operations — are the firms on the SAT public list under article 69-B that issue fictitious CFDIs. In 2025 the list grew by roughly 47% — about 12,000 new RFCs in the year, many of them formerly considered trusted suppliers.

If you received a CFDI from an RFC that later landed on the definitive 69-B list and you did not file a deslinde (disassociation) within 30 days of DOF publication, your CSD is at risk.

Scenario: you hired marketing services from an agency in 2024 for 80,000 MXN and credited 12,800 MXN of VAT. In March 2026 that agency lands on the definitive 69-B list. You have 30 days to take one of two routes:

1. Prove materiality — signed contract, bank transfer to the supplier's CLABE, email thread, deliverables.
2. File a complementaria returning the credited VAT plus surcharges.

No action within that window: CSD restriction and possible move to the 69-B accomplice list.

What to do: automate a weekly check of every CFDI issuer in your books against the 69-B list. SAT publishes updates on Wednesdays. In Odoo a cron job plus a community module handles the cross-check — 3 to 5 days of implementation. For full architecture, see our Odoo Mexico localization.

#4. Prolonged inactivity

Fraction V of 17-H Bis: three consecutive months without filing a periodic return — even a zero return — triggers a CSD suspension.

Seasonal SMBs (tourism, agriculture, schools) often fall into this trap with the logic we have no sales in the off-season, why file a zero return?. Critical mistake: the zero return is mandatory. If you skip it, SAT reads abandonment of activity and applies the restriction.

Scenario: a travel agency in Cancún. May through August: zero sales. The accountant skips three filings in a row. In September the CSD restriction lands under fraction V. High season starts in December, the recovery took almost 2 months, direct revenue loss near 750,000 MXN.

What to do: automatic reminders on the 14th of each month — the monthly filing deadline. Sign on an accountant with a monthly contract between 1,500 and 3,000 MXN, ten times cheaper than any recovery. Formal alternative: file a suspension of activities through the SAT portal — it legally pauses the filing obligation for the duration.

#5. Nonexistent operations (2026 focus)

The most dangerous and the newest trigger. Under the updated RMF 2026 rule, if SAT proves a CFDI has no real operation behind it — no logistics evidence, no bank movement, no client communication — the case escalates on two levels:

• First, restriction under 17-H Bis.
• Second, potentially a tax crime under CFF article 113 Bis — up to 9 years in prison for officers and legal representatives.

2026 scenario: an SMB issues a consulting CFDI for 200,000 MXN so the client can credit VAT. The money never moved (or came back in cash off the books). SAT, through ICEF (the federal-state intelligence unit for tax enforcement), cross-checked with banks — no transfer. CSD restriction for both parties and a 69-B procedure opens.

What to do: every CFDI must be backed by at least 3 pieces of evidence kept for 5 years:

1. A signed contract or purchase order.
2. A bank transfer to the supplier's CLABE — or a nominative check, or a validated POS payment.
3. Communications by email, WhatsApp, or Teams about deliverables, with timestamps.

Cash operations above 2,000 MXN without backing are a direct potential trigger for CSD loss.

Who this applies to (and who not)

This applies to you if:

• You issue more than 10 CFDIs a month.
• You have B2B customers in sectors with high EFOS exposure: marketing, IT, consulting, hydrocarbons, alcohol, tobacco.
• You file as a general-regime corporation or as PFAE.
• Your annual revenue exceeds 5 million MXN — SAT prioritizes enforcement in this band.

This applies less directly if:

• You file as Resico-PF with a 3.5 million MXN cap — simplified obligations and fewer reconciliation points, but fractions III (domicile) and V (inactivity) of 17-H Bis still apply.
• You are an exporter with 100% USD CFDIs and confirmed pedimentos — your risk set is different (proof of export, transfer pricing); the classic mismatch trigger barely fires.
• You are within the first 6 months of RFC registration — SAT usually grants a grace period, not an exemption.

This guide is not the right focus if:

• You are an individual without business activity — your tool is the e.firma, not the CSD.
• You are a large corporate with an in-house tax team and a Big 4 advisor — this guide is just an audit checklist for you.
• You file under the Digital Platforms regime — automatic VAT withholding, separate rules.
• You are an authorized donataria — separate regime with its own RMF chapter.

Anonymous case: CDMX restaurant chain, 12-day recovery

Situation: chain of 3 restaurants in CDMX, around 8 million MXN annual revenue, 47 employees. February 2026: email from SAT, CSD restriction under 17-H Bis fraction IV. A 180,000 MXN gap between issued CFDIs and the January VAT return.

Diagnosis: registers issued type-I CFDIs (income) for banquet prepayments but did not issue type-E CFDIs (expense) when the actual event was canceled or recalculated. Technically correct, but SAT saw the gap on its automated reconciliation.

What they did:

1. Days 1–2: gathered all January CFDIs by type and the banquet contracts.
2. Day 3: filed an aclaración request through the SAT portal with PDFs of contracts and bank statements that backed the prepayments.
3. Days 4–10: SAT requested extra evidence on 2 operations — delivered within 24 hours.
4. Day 11: positive ruling, restriction lifted.
5. Day 12: CSD active again, they cleared the backlog of CFDIs from the pause window.

Result: 11 days of stoppage. Direct revenue loss near 240,000 MXN — the restaurants ran on simplified tickets without CFDIs, lost B2B customers, and missed VAT crediting for the month.

What they put in afterwards: monthly CFDI vs. tax-return reconciliation inside Odoo with a custom report (6 hours of development). Automated 69-B verification on every new counterparty via cron job. Total cost: 28,000 MXN. ROI in 4 months from zero repeat restrictions. Pattern similar to the Estée Lauder Odoo pricing case.

The expensive part of the restriction wasn't the 240,000 MXN of lost revenue; it was the conversation with the 14 corporate clients asking why we couldn't invoice them.

How to harden your SMB against 17-H Bis

An operational checklist that cuts restriction risk to acceptable levels:

Download the CSD-proof SMB 2026 Checklist (PDF, 12 items) with automatic email delivery and an optional 30-minute audit session. Three weeks of well-executed implementation are worth more than any insurance against a restriction.

Frequently asked questions