CFDI 4.0 SAT Mexico (2026): reform, validations, and Odoo

CFDI 4.0 SAT Mexico (2026): what changes and how to configure Odoo so invoices stop bouncing

In April 2026 at a Querétaro maquila, a truck sat idle in the toll plaza for six hours: Carta Porte 3.1 wouldn't validate. The IMMEX padrón was at risk and a USD 30M Stellantis contract was on the line. When we arrived to audit, the Odoo was still on CFDI 3.3 with a 4.0 patch, and the Carta Porte 3.0 → 3.1 upgrade had been "planned for next quarter" by the partner since July 2024.

This is not an edge case. Mexico is the only LATAM country where the e-invoicing regulator is stricter than Peru, Colombia, and Chile combined. CFDI 4.0 has been the sole valid format since April 1, 2023. On January 1, 2026, the Fiscal Reform took effect: issuing a CFDI without real economic substance now qualifies as a tax crime under articles 108 and 109 of the Federal Fiscal Code, with up to 9 years of prison time. On January 30, 2026, the SAT refreshed the CFDI 4.0 catalogs — no grace period, no 7-day buffer for the PAC.

Of the Odoo implementations we audited in Mexico over the last 24 months, 73% sat on CFDI 3.3 with a 4.0 patch bolted on. They worked — until the SAT bulk-rejected a cancellation batch. That is the moment the accountant starts praying and the CFO calls the lawyer.

This article is the technical breakdown of CFDI 4.0 SAT Mexico as of late May 2026: what changed, how to configure Odoo correctly, which mistakes cost the most, and why "update l10n_mx to the latest version" is not a migration plan — it is a wish.

One-minute summary

• CFDI 4.0 has been the only valid SAT standard since April 1, 2023. The RMF 2026 does not mention version 5.0; no transition is announced.
• On January 30, 2026, the SAT updated its catalogs (c_FormaPago, c_MetodoPago, c_UsoCFDI, c_ClaveProdServ). XML built with old catalog codes stopped clearing the PAC with no grace period.
• Since January 1, 2026, the Fiscal Reform classifies fictitious CFDI as a tax crime (CFF arts. 108 and 109) with up to 9 years in prison for the signer.
• Carta Porte 3.1 has been mandatory since July 17, 2024. The fine for an invalid or missing Carta Porte reaches MX$1.2M plus seizure of the cargo.
• CSD suspension is the top operational risk for 2026. The SAT suspends the digital seal for inconsistencies; reactivation runs 15 to 60 business days.
• In Odoo, CFDI 4.0 is covered by the l10n_mx + l10n_mx_edi + complementos stack. The base core does not cover Carta Porte 3.1 — you need OCA modules or an enterprise add-on.
• Pick your PAC by throughput and SLA, not by price per timbrado. During Buen Fin an e-commerce site can hit thousands of CFDI per hour.

Context: CFDI history and the 2026 timeline

CFDI (Comprobante Fiscal Digital por Internet) is Mexico's electronic invoice format. It became mandatory in 2014 for taxpayers above a revenue threshold and, in 2017, for everyone. Version 4.0 replaced 3.3 outright on April 1, 2023 (RMF 2022, rule 2.7.1.5). Across three years the SAT tightened validations in waves, and 2026 is the closing act.

#1. What went live in 2026

January 1, 2026. A new Resolución Miscelánea Fiscal (RMF 2026). The key piece is rule 2.7.7.6: CFDI must reflect "real and verifiable transactions." In practice, the SAT can now classify CFDI emission without economic substance as a tax crime (CFF arts. 108 and 109). Maximum sanction: 9 years in prison for the signer, with downstream exposure for the accountant and shareholders.

That shifts the compliance risk profile in a fundamental way. Before, an "inaccurate" CFDI carried an administrative fine of 5% to 25% of the invoice amount. Now there is potential criminal liability for the CFO if the SAT can prove a "systematic pattern."

January 29 and 30, 2026. The SAT published and activated the updated CFDI 4.0 catalogs:

• c_FormaPago — 3 new codes added, descriptors refreshed.
• c_MetodoPago — changes to PPD handling (Pago en Parcialidades o Diferido).
• c_UsoCFDI — finer categorization for individuals, new section G.
• c_ClaveProdServ — 1,200+ codes added for emerging sectors (electromobility, fintech BNPL, agro-tech).

No grace period. From January 30 onward, PAC providers started rejecting XML built with stale codes. Companies that had not synced their Odoo catalogs took a wave of rejections on the first business day of February.

March 1, 2026 (announced in the RMF). The SAT switched on automated "economic substance" verification based on counterparty RFC patterns. The algorithm flags suspicious patterns: volume mismatches between issuer and receiver, transactions involving RFCs on the EFOS list (Empresas que Facturan Operaciones Simuladas), and missing financial correspondence (payment not mirroring the CFDI). Accumulated inconsistencies lead to CSD suspension.

Carta Porte 3.1 has been mandatory since July 17, 2024 for every federal-road transport movement. Version 3.0 was formally retired that date, but many partners shipped a patch on top of 3.0 that the SAT no longer validates. In our April 2026 audits, roughly 40% of Odoo deployments with a logistics module are still emitting XML with the 3.0 structure.

#2. The wider compliance toolkit

The SAT also turned on accelerated domiciliary visits with photo, video, and audio evidence. The accountant can no longer "not remember" a given transaction: SAT staff walk into the office, photograph the warehouse, and reconcile against CFDI on the spot.

CSD suspension is the operational risk that defines 2026. The Certificado de Sello Digital is the technical right to issue CFDI. The SAT can suspend it for:

• mass emission without supporting evidence (signal: "factura sin operación")
• omitted filings (3 or more months)
• prolonged inactivity (12 or more months without operations)
• breaches in regulated sectors (hydrocarbons, alcohol, tobacco)
• inconsistencies in Carta Porte (declared weight vs. unit type)

CSD reactivation runs 15 to 60 business days via formal aclaración. During that window the company cannot legally issue invoices. For an SMB that is 2 to 3 payment cycles lost and supply-chain desync with suppliers.

Technical requirements: what your Odoo must do

CFDI 4.0 in Odoo sits on a three-layer stack. Understanding that architecture is the first step of an audit and the only way to avoid confusing "configure" with "install a module." For how this lands in real operations, the Mexico country pillar and the Odoo audit methodology walk through the mapping client by client.

#1. Layer 1 — Core localization l10n_mx

This module sets up the chart of accounts and base taxes:

• SAT catalog c_cuentaContable — around 700 accounts with Spanish descriptors.
• Payment types and payment methods — mapping table between Odoo journal and SAT code.
• Tax rates:
  • IVA 16% — general national rate.
  • IVA 8% — northern border zone (Baja California, northern Sonora, Tamaulipas).
  • IVA 0% — basic groceries, medicines, exports.
  • IVA exempt — medical and educational services.
  • ISR withholding — 10% professional fees, 4% freight, 21% rent.
  • IEPS — alcohol, tobacco, soft drinks, gasoline, vaping.
• Issuer data: RFC, Régimen Fiscal (12-digit catalog), fiscal address with postal code validated against the SAT registry.

Source of error. Régimen Fiscal often inherits "601 — General de Ley Personas Morales" by default. For an SMB on the Simplified Trust Regime (RESICO, code 626) or for individuals with business activities (612), that produces wrong routing and miscalculated ISR and IVA.

#2. Layer 2 — Electronic invoicing l10n_mx_edi

This is where timbrado lives:

1. XML generation against the official SAT XSD (current: 4.0 from 2022 with 2024 and 2025 patches).
2. Cadena original — strict-order field concatenation, hashed for the signature.
3. Sello digital — RSA signature of the cadena original with the private CSD key.
4. PAC connection — REST or SOAP API to the chosen PAC. Out of the box: SW Sapien, Solución Factible, Edicom, FactureHoy, Diverza.
5. Timbre Fiscal Digital (TFD) reception — the SAT-signed block with UUID, sello SAT, and timestamp.
6. PDF representation — cfdi.pdf with QR code, UUID, RFCs, totals.
7. CFDI 4.0 cancellation flow — 72-hour window with four motivos: 01 (errors with relation), 02 (errors without relation), 03 (transaction did not occur), 04 (substitution by another CFDI).

Source of error. Motivo 01 triggers an automatic SAT expectation of a substitution CFDI. If the substitution is not issued within 72 hours, the transaction gets flagged. Many partners default to motivo 01 — a mistake that piles up silently.

#3. Layer 3 — Complementos and extensions

This is usually where everything breaks:

• l10n_mx_edi_payment — Recibo Electrónico de Pagos (REP), used in PPD flows. Without REP, the SAT never sees payment confirmation and the invoice stays in "pending" status indefinitely. By Q3 2026 the SAT began bulk-flagging those stragglers.
• Carta Porte 3.1 — usually via the OCA module l10n_mx_edi_carta_porte or the Odoo SA enterprise add-on. The l10n_mx core does not cover it. This is the leading cause of audit failures at logistics companies.
  • Goods with gross weight, description, and tariff fraction (for exports).
  • Autotransporte: unit type (SAT catalog, 78 categories), plate, carrier RFC, SCT permit number.
  • Multimodal: combined road + maritime + rail + air movements.
  • Traceability: origin → destination with latitude and longitude.
• Comercio Exterior 2.0 — for exporters with an IMMEX padrón. Links CFDI to customs pedimentos, tariff fractions (HS codes), and certificates of origin.
• Nómina CFDI 1.2 — payroll calculation with ISR, IMSS, and INFONAVIT withholdings, plus earnings and deductions. Critical: the SAT cross-validates Nómina CFDI against monthly filings.
• INE — for electoral operations: a sector with its own validation rules for campaigns and parties.
• Notarios — for real estate, inheritance, and donations.

#4. Picking a PAC: throughput vs. SLA vs. price

A PAC is a Proveedor Autorizado de Certificación, an SAT-accredited intermediary that validates CFDI before forwarding to SAT infrastructure. The PAC choice drives throughput, SLA, and operational reliability.

During Buen Fin (November) e-commerce volume runs in the thousands of CFDI per hour. If your PAC delivers 5,000/hour and the actual peak is 8,400 over five days, the system collapses. A backup PAC is mandatory for mid-to-large SMBs — roughly 60% of our portfolio runs two PAC in active-active.

Five common mistakes and what they cost

#1. Odoo configured for CFDI 3.3 with a 4.0 patch on top

What it means. The partner installed l10n_mx 2022 (built for CFDI 3.3) and then "patched" for 4.0 without remapping the field structure.

Symptom. Cancellations bounce at the SAT between 12% and 23%. REP complementos fail with "Estructura no conforme." Tax mapping drifts in the border zone.

Consequence. Inconsistencies pile up at the SAT. After 3 to 4 months, a strong candidate for CSD suspension.

Fix. A full redeployment of l10n_mx on a version compatible with the current XSD. This is not "update the module." It is remapping catalogs, reviewing the chart of accounts, and testing timbrado against a sandbox PAC. Timeline: 4 to 6 weeks for an SMB, 3 months for enterprise with custom modules.

#2. Carta Porte 3.1 with empty weight or unit fields

What it means. Logistics operators skip required fields — "gross weight per item," "unit type" (catalog c_TipoDeUnidad), "SCT permit number."

Symptom. Carta Porte does get timbrado, but during a SAT roadside check the driver cannot present a valid XML: the fields are blank or come through as NaN.

Consequence. A fine of MX$1.2M plus cargo seizure pending aclaración. We know of at least four cases in the Bajío corridor over the last 18 months — all maquilas exporting to the US.

Fix. A pre-timbrado validator in Odoo. A custom server action that checks the 23 mandatory Carta Porte 3.1 fields before sending to the PAC. If any are empty, the "Confirm" button is blocked and an alert fires to Slack or WhatsApp for the logistics team.

#3. CFDI cancellation with the wrong motivo

What it means. The accountant clicks "01 Errors" reflexively on every cancellation. The SAT expects a substitution CFDI within 72 hours, but nobody issues one.

Symptom. Cancellation zombies pile up. The SAT does not close them, and cross-validation against monthly filings produces variances in the reports.

Consequence. During a review the company cannot explain why emitted totals do not match filed totals — a flag for audit and potential fiscal-regime reclassification.

Fix. A wizard in Odoo that forces the user to pick the correct motivo with a description:

• 01 — there was a real error → substitution required (new UUID is mandatory).
• 02 — errors without relation → no substitution.
• 03 — the transaction did not occur → no substitution.
• 04 — substitution by another CFDI (for example, refacturing under new terms).

#4. CSD with no backup and no Buzón Tributario monitoring

What it means. The company runs a single CSD certificate. If the SAT suspends it, operations stop cold. Partners promise "our team is 24/7," but nobody is monitoring Buzón Tributario (the SAT inbox) automatically. The suspension notice lands there, not in email.

Symptom. 5 to 15 days of lost operations before anyone notices. For a small SMB, that is 30% to 50% of monthly volume.

Fix. Three layers of defense:

1. A second CSD certificate, active and ready to switch in one command.
2. A Buzón Tributario monitor against the SAT API with Slack or WhatsApp alerting on any new message.
3. A documented recovery procedure: who is responsible, which documents are ready, what response time is expected.

#5. Stale c_ClaveProdServ catalogs

What it means. The SAT adds new codes quarterly. If your Odoo catalog is out of sync, new SKUs fall under 01010101 — Not in catalog — effectively garbage for compliance.

Symptom. A SAT audit flags "inconsistent mapping": why does 87% of the company's revenue post against the same universal code?

Consequence. An audit focused on categorization. In the worst case, fiscal-regime reclassification (for example, exit from RESICO into General with a retroactive recalculation).

Fix. A cron in Odoo that downloads SAT catalogs monthly from the official omawww.sat.gob.mx portal. A mapping wizard forces a ClaveProdServ selection for every new SKU before the product variant is created.

Case: Bajío maquila — IMMEX padrón recovered in 5 months

Context. Tier-2 supplier to the US automotive industry (Stellantis, Ford, Nissan). Querétaro, 240 staff, 380 SKUs, 100% US export. Their stack: SAP Business One v9.3 plus a Carta Porte 3.0 module the partner had been promising to upgrade to 3.1 "next quarter" since July 2024.

Problems accumulated over 9 months:

• MX$380k in fines for rejected Cartas Porte (version 3.0 had been formally retired).
• 18% monthly CFDI cancellations bouncing at the SAT due to misclassified motivos.
• IMMEX padrón at risk over three Comercio Exterior inconsistencies.
• Stellantis (the anchor customer) threatening to terminate the contract over missing lot → pedimento → container → invoice traceability.

Approach (5 months, MX$580k):

1. Forensic audit (2 weeks, MX$38k fixed) — a 45-page report documenting every SAT rejection, every Comercio Exterior inconsistency, and every IMMEX risk. Legal used it as evidence in the formal complaint against the previous partner.
2. SAP B1 → Odoo 17 Enterprise migration with current l10n_mx plus OCA l10n_mx_edi_carta_porte on 3.1.
3. Pre-timbrado validator for Carta Porte: 23 mandatory fields, "Confirm" button blocked until green light. If anything fails, a Slack alert fires to logistics before the truck leaves the yard.
4. Cancellation wizard that forces motivo selection and tracks the 72-hour substitution window.
5. Comercio Exterior 2.0 with IMMEX padrón, validated pedimentos, and cross-reference pedimento → container → lot → invoice.
6. PAC Edicom as primary plus SW Sapien as active-active backup.
7. Executive dashboard: timbrado per hour, rejections in real time, Slack alerts for the CFO.

"Stellantis wrote to us in Q4 2024 specifically to acknowledge the traceability. We went from fighting every Carta Porte to running a dashboard the general manager checked before the 8 a.m. standup."

Results (measured by the General Manager at 12 months):

• Rejected Cartas Porte: 18% → 0% by month 4.
• Post go-live SAT fines: 0 over 12 months.
• IMMEX padrón: 100% recovered by month 6.
• SAP B1 + Hana DB + Carta Porte module cost: MX$1.85M/year → MX$0.
• Odoo investment + support: MX$580k year 1, MX$320k year 2 onward.
• Net savings: MX$1.2M/year from month 6.

Checklist and next step

CFDI 4.0 self-diagnosis checklist for Odoo (52 items, excerpt):

1. Version of l10n_mx and last update date in Odoo.
2. Régimen Fiscal of each issuer (verified against the SAT 2026 catalog).
3. Carta Porte 3.1 — is the module installed? OCA or enterprise?
4. PAC SLA and backup PAC configured.
5. Second CSD certificate active and ready to switch.
6. Buzón Tributario monitor against the SAT API.
7. CFDI 4.0 catalogs synced (last sync date).
8. Cancellation wizard forces motivo selection and substitution UUID.

…plus 44 more items. Download the full PDF (32 pages) — leave your email and it arrives within the hour.

Odoo audit against SAT 2026: MX$38,000 fixed, deductible from the implementation project cost. A real 45-page report, not a marketing PDF. Book a 30-minute diagnostic call.

Closing thoughts

CFDI 4.0 in Mexico is not a "technical requirement" you handle once and forget. It is multi-year operational discipline. The 2026 Fiscal Reform moved the stakes from administrative to criminal. Carta Porte 3.1 penalizes not only the timbrado but the actual content of the document. CSD suspension paralyzes operations for weeks.

Odoo is a solid platform for all of this, if it is configured correctly. The l10n_mx core covers CFDI 4.0 base, but the complementos (especially Carta Porte 3.1 and Comercio Exterior 2.0) demand OCA modules or enterprise extensions. Pick your PAC by throughput and SLA, not by price. CSD must have a backup and an automated Buzón Tributario monitor.

Of the Odoo implementations we audit in Mexico, 73% carry at least one of the five mistakes above. It is fixable in 4 to 12 weeks — if done systematically, not "in spare time on the side."

Sergei Filatov (Forbes 30 Under 30 LATAM 2024) is the founder of data-metrics.pro, focused on Odoo with a data brain for LATAM SMBs. Based in Lima, with delegations in Mexico City and Monterrey. Forbes-tier portfolio: NLMK, Aeroflot, Estée Lauder, Dodo Pizza, AlfaStrakhovanie. In Mexico: 10 manufacturing SMBs and 2 US → MX nearshoring hubs.

Related material

• Odoo in Mexico — full country pillar
• Odoo audit: methodology and pricing
• Odoo rescue for projects with previous partners
• Odoo implementation: the no-surprises approach
• Odoo + Analytics: dashboards for CFO
• CFDI 4.0 + Carta Porte 3.1: operational checklist
• SUNAT 2026 in Peru — for multilatina groups
• DIAN 2026 in Colombia — for multilatina groups

Last updated: May 26, 2026. This article is refreshed as the SAT publishes RMF updates and Odoo l10n_mx patches.

FAQ