Revoked PACs in Mexico: What to Do and How to Protect Your Invoicing
The recent revocations of authorizations granted to Authorized Certification Providers (PACs), published by Mexico’s Tax Administration Service (SAT), have brought the issue of business continuity in electronic invoicing into focus. What should a company do when its provider loses its authorization?
The answer goes beyond simply contracting another stamping service. Companies should assess the provider’s reliability and its ability to ensure operational continuity. We examine what a revocation entails, and the value offered by EDICOM’s capabilities and accreditations as a PAC and Certification Service Provider (PSC).
PAC revocations in Mexico: Why does the SAT revoke authorization?
Recent revocations published by the SAT mean that the affected PACs must stop certifying Digital Tax Receipts via Internet (CFDI), in accordance with the procedures and transition period established by the applicable regulations.
Obtaining authorization as a PAC is not enough to retain it: the provider must continue to meet the requirements and obligations applicable to its activities. In the event of potential noncompliance, the regulations establish a procedure that allows the provider to submit evidence to refute the alleged violations.
Grounds for revocation include failure to comply with the conditions of authorization, errors in certain validations, providing false information during audits, failure to provide the required guarantee, or accumulating three or more warnings within the same fiscal year. Specific circumstances involving taxpayers identified as engaging in nonexistent transactions or issuing false tax receipts are also covered.
However, the SAT’s public list does not, by itself, specify the reason for each revocation. A provider’s inclusion in this registry does not automatically mean that it committed fraud or participated in simulated transactions.
For companies, this environment reinforces the importance of assessing a PAC’s reliability beyond its authorization status. Integration with business systems, traceability, specialized support, and contingency preparedness are all important criteria for ensuring continuity in electronic invoicing.
What does it mean for your company if your PAC is revoked?
The priority is to prepare for the transition before the certification service is interrupted. A revocation does not necessarily require replacing the entire invoicing system, but companies must have an alternative stamping channel in place and verify that the new connection works properly with their business processes.
How much time do you have to set up another certification service?
Following a revocation, there is a 90-calendar-day transition period, but the PAC may continue certifying documents for its existing customers only during the first 30 days. The remaining 60 days are intended for compliance with other obligations, and stamping is no longer permitted during that period.
Companies must therefore prepare for the transition and have another operational service before the end of the initial 30-day period. The exact date should be confirmed in the notice sent by the PAC to its customers and should not be calculated solely based on the date the revocation is published on the SAT portal.
What happens to issued CFDIs and pending processes?
The revocation affects the provider’s authorization to continue certifying documents; it does not, by itself, automatically invalidate CFDIs that were properly certified while the PAC was authorized.
During the transition, companies should retain the XML files for their tax receipts and the corresponding acknowledgments and verify their registration through the SAT verification service. At the same time, they should review any processes that still depend on the service, including invoices, payroll receipts, supplements, or other pending CFDIs. The goal is to ensure that the new integration can maintain operations without duplication or disruption.
EDICOM as a PAC in Mexico: Experience, integration, and business continuity
In an environment of increased scrutiny of PACs, choosing a provider involves assessing more than whether it holds a valid authorization. Experience, technology infrastructure, and the ability to integrate CFDI certification with a company’s systems are important factors in reducing dependencies and maintaining control over operations.
CFDI certification and electronic invoicing experience in Mexico
EDICOM was the first Authorized Certification Provider (PAC) authorized by the SAT in Mexico, allowing us to support the evolution of the CFDI model and its requirements from the outset. This experience is also reflected in the scale of our operations: in 2025, we stamped 468,259,262 CFDIs, and since 2011, 644,074 taxpayers have issued tax receipts using our stamping service.
As a PAC, our primary role is to validate and certify CFDIs in accordance with SAT requirements. This process includes the corresponding validations, assignment of the tax folio (UUID), incorporation of the Digital Tax Stamp, and submission of the certified tax receipt to the SAT.
Our platform can also cover the entire electronic invoicing process, from generating the XML based on ERP data and applying the issuer’s digital seal using its Digital Seal Certificate (CSD), to certification and return of the stamped CFDI, fully integrated with the company’s systems.
This allows us to adapt to different scenarios: some companies need to automate the end-to-end issuance and certification of their CFDIs, while others generate and digitally seal tax receipts within their own systems and use EDICOM solely for validation and certification as a PAC.
ERP integration and automation
The EDICOM platform can integrate with any ERP or other business management system to automate the exchange of information required to generate, validate, certify, and manage electronic tax receipts. This keeps tax processes connected to the company’s internal systems while providing traceability across statuses, validations, acknowledgments, and rejections.
Infrastructure, availability, and scalability for critical processes
For operations involving high volumes, multiple systems, or multiple legal entities, it is also important to assess a provider’s ability to scale, maintain service availability, and respond to incidents. The EDICOM platform is monitored 24/7 and backed by a Service Level Agreement (SLA) guaranteeing 99.9% availability, along with multilingual international support.
Another key differentiator is that we develop our own technology. Both our software and its ongoing development are managed in-house, reducing our dependence on third parties and giving us greater control over infrastructure, updates, and adaptation to new technical or regulatory requirements. Together, availability, scalability, proprietary technology, and specialized support are key factors when assessing the reliability of a PAC beyond its SAT authorization.
EDICOM certifications: What they support and why they matter
SAT authorization confirms that a provider is permitted to operate as a PAC, but assessing its reliability also requires considering how it manages security, service delivery, and infrastructure continuity. External certifications and audits provide an additional benchmark for evaluating the controls implemented by the provider.
EDICOM holds international certifications including ISO 27001, focused on information security management, and ISO 20000, related to IT service management. In addition, our processes and controls are audited in accordance with ISAE 3402, which assesses internal controls related to service delivery.
Business continuity is also part of this model. EDICOM has disaster recovery and business restoration procedures incorporated into its Business Continuity Plan (BCP), aligned with ISO 22301 and certified by AENOR and IQNET.
These accreditations do not replace PAC authorization or guarantee that incidents will never occur, but they provide additional criteria for assessing the provider’s security, operational controls, and preparedness for situations that could affect a critical process such as electronic invoicing.
EDICOM as a PSC in Mexico: Certification services and electronic evidence
In addition to operating as a PAC, EDICOM is accredited in Mexico as a Certification Service Provider (PSC). PAC and PSC are two separate roles, regulated by different authorities and with distinct functions, but they can complement each other within a company’s digital processes.
What is the difference between a PAC and a PSC?
As a PAC authorized by the SAT, our role focuses on validating and certifying CFDIs in accordance with the tax and technical requirements established by the authority. The PAC validates the tax receipt, incorporates the Digital Tax Stamp, and submits the certified CFDI to the SAT.
A PSC, on the other hand, is accredited and supervised by Mexico’s Ministry of Economy and provides services related to the generation and preservation of electronic evidence. A PSC does not replace a PAC and is not authorized to certify CFDIs for tax purposes.
Digital certificates, timestamps, and NOM-151-compliant preservation
EDICOM is accredited as a PSC to provide digital certificate issuance, digital timestamping, and data message preservation services in accordance with NOM-151-SCFI-2016. In addition, EDICOM is accredited as a Legally Authorized Third Party (TLA) for the digitization of documents originally produced in physical form.
These services make it possible to generate evidence regarding document integrity and the existence of a document at a specific point in time, as well as to preserve data messages in accordance with the procedures established under NOM-151. When required by a project, these capabilities can complement electronic invoicing and CFDI certification processes with services focused on the management and preservation of electronic documents and evidence.
How to prepare for a PAC transition and assess your project with EDICOM
When a PAC’s authorization is revoked, companies should begin the transition as soon as possible to prevent the change from affecting CFDI issuance. The first step is to identify which legal entities, RFCs, systems, and tax processes depend on the current provider, as well as document volumes and existing integrations with the ERP or other applications.
The migration should also include configuration and testing of the new service, covering invoices, supplements, payroll, and any other CFDIs used by the company, as well as cancellation and inquiry processes that form part of its operations. The goal is to ensure that the new channel is fully operational before the period during which the revoked PAC may continue certifying documents comes to an end.
At EDICOM, we assess the project scope, the systems involved, and integration requirements to define the transition to our PAC service. Our proprietary platform, integration capabilities, and centralized tax services also make it possible to manage the transition within an environment designed to handle CFDI certification, automation, and control in an integrated manner.
