Authorising your gestoría at AEAT: certificate, limits and risks

Authorising your gestoría before the Spanish Tax Agency is not the same as sending them the USB drive with the certificate or the token password. What matters is more prosaic: who can identify themselves to the Agency, for which concrete procedures, until which date, and how you cut that access if the engagement changes.

The Tax Agency maintains an electronic register of powers of attorney so natural and legal persons can record powers and let a third party carry out online tax procedures on their behalf. That register operates solely for electronic dealings with the AEAT and is not a public register. AEAT, procedure ZP01; AEAT, Register of powers of attorney. The attorney acts with their own electronic identification on the procedures you have enabled. They do not need your certificate to “pretend” to be you.

This guide covers Spain’s common tax territory and the Electronic Office of the State Tax Agency. It leaves out the foral territories, the Canary Islands and IGIC, and Ceuta and Melilla except where noted. It does not replace scrutiny of a specific power or the contractual engagement with your gestoría. A power of attorney does not make an incorrect return correct or remove your tax obligation. This guide does not decide whether your company should grant GENERALNOT, or how much power suits a particular self-employed person.

Voluntary representation and the electronic register

Taxpayers with legal capacity may act through a representative, who may be a tax adviser, with whom successive administrative acts will be conducted unless they expressly state otherwise. For appeals, waivers, recognition of obligations or refunds, representation must be evidenced by a valid means that leaves reliable proof or by appearance. General Tax Law, article 46. For mere procedural acts the law presumes representation; that is not a blank cheque over appeals or waivers.

Law 39/2015 adds the general administrative frame: interested parties may act through a representative, representation is evidenced by a valid means and is treated as evidenced, among other routes, when it appears in the competent electronic register of powers. Law 39/2015, article 5. The same law requires Administrations to keep electronic registers of powers and allows particular registers of bodies for specific procedures. Law 39/2015, article 6. The AEAT register is precisely that sectoral instrument for online dealings with the tax office.

The processing rule cited by procedure ZP01 is the Resolution of 18 May 2010 of the Directorate-General of the Tax Agency on the register and management of powers of attorney (and, in the same text, successions and legal representation of minors and incapacitated persons) for online procedures. AEAT Resolution 18/05/2010; AEAT, ZP01. That resolution remains the normative reference the Electronic Office links today; later 2012 and 2014 amendments adapted it, but the basic scheme — registration, scope by procedure, acceptance for notifications, revocation and resignation — still stands.

Three registration routes, not only the web click

The AEAT admits three ways to grant the power: appearance at Delegations or Administrations with a form; a public or private document with a notarially authenticated signature filed with the Agency; or the internet with the identification systems provided for in Law 39/2015. AEAT, registering a power; AEAT, ZP01. If the grantor is a legal person or an entity under article 35.4 of the General Tax Law, in appearance the legal representative or anyone with sufficient power to grant attorney appointments acts. AEAT, registering a power.

In the procedure, if there are defects in the grant, the Agency notifies the shortcoming and allows ten days to cure; if you do not respond, it archives the file and treats the request as withdrawn. AEAT, ZP01; AEAT Resolution 18/05/2010. That ten-day period also appears in the General Tax Law when the power is missing or insufficient for the act in question. General Tax Law, article 46.7.

Certificate, Cl@ve and who identifies

Electronic authorisation on the Agency’s site lets you empower a third party — a natural or legal person — to carry out the enabled procedures online in your name, using the attorney’s electronic certificate, DNIe, Cl@ve or eIDAS system. AEAT, registering a power. That is usually where the misunderstanding sits. The gestoría does not “use your certificate”: it identifies as attorney and acts within the recorded scope.

Handing over the certificate file and its PIN is another story. With that pair, whoever holds them can sign as the certificate holder, outside the register’s procedure catalogue. The Electronic Office does not describe that exchange as a form of tax representation. If they ask for it “because it is faster”, ask which register procedures would suffice and why their own certificate with a recorded power is not enough.

For companies, the practical nuance is double. First, the entity’s representative certificate is not a power to the gestoría: it proves who signs for the company. Second, the register of powers lets an external adviser file and consult without your sharing that representative certificate. Keep control of the company certificate separate from the scope of any third-party power.

General power, codes and specific procedures

To register a power online, the grantor identifies in the Electronic Office, chooses a general or specific power, enters the attorney’s NIF or CIF, selects codes or procedures and signs the submission. If the power includes receipt of notifications marked as electronic notification, the attorney must confirm it afterwards before it takes effect. AEAT, registering a power; AEAT, DEHú access through a power of attorney.

In the general-power registration, AEAT help says to select one or more of these codes: GENERALLEY58, GENERALDATPE and GENERALNOT. AEAT, registering a power. GENERALNOT is the one that opens receipt of notifications and communications; the DEHú access guide itself identifies it as the general notifications procedure, without prejudice to a specific receipt power. AEAT, DEHú access through a power of attorney.

You can also grant a power for specific procedures: the Electronic Office organises categories, lets you search and select folders or concrete procedures, and shows at the end the list with a verification CSV. AEAT, registering a power. The 2010 Resolution makes clear that the power only takes effect for the procedures listed among those enabled in the public Electronic Office catalogue. AEAT Resolution 18/05/2010. If you do not know which code you need, do not tick “everything just in case”: ask the gestoría for the list of procedures it will use this quarter and the next.

The power may be granted to one or more persons, natural or legal. AEAT, registering a power. In practice, many firms ask for the power in the name of the professional company or the responsible practising member. Note the exact NIF or CIF: one wrong digit does not “almost work”.

Notifications: confirmation or no effect

If you grant a power to receive notifications for a specific procedure, the AEAT warns that, for that procedure, notifications will be addressed to the document’s addressee and to the specifically designated attorney, and not to the attorney under the general procedure. AEAT, registering a power. That nuance matters when you mix a broad GENERALNOT with one-off powers.

For GENERALNOT, the electronic flow has two steps: grant by the grantor and confirmation by the attorney under “Consulta, confirmación y renuncia de apoderamientos recibidos”. AEAT, DEHú access through a power of attorney. The registration help insists on the same point: when the status marks “Notificación Telemática”, the attorney’s confirmation is required before the power takes effect. AEAT, registering a power. The 2010 Resolution already required that specific acceptance for receipt of communications and notifications. AEAT Resolution 18/05/2010.

Until confirmation exists, do not assume they “can already look at the inbox”. Ask for the receipt or a screenshot of the confirmed status and the CSV. Afterwards, the attorney can filter notifications “on behalf of” in the AEAT Electronic Office. AEAT, DEHú access through a power of attorney. You, as holder, do not disappear from the channel: the risk is operational, not an abstract legal puzzle. If nobody forwards the alert and the gestoría opens the notification late, the deadline still runs. The guide on tax office letters and requirements covers what to do when the document is already in the inbox; this article covers who may open it.

Validity, renewal and the five-year ceiling

In the electronic registration flow, if you do not change the authorisation end date, the power lasts five years, and that is the maximum duration in that flow. AEAT, registering a power. Law 39/2015 sets, for powers entered in electronic registers of powers of attorney, a maximum validity of five years from registration, with the possibility of revoking or renewing before it ends, and with renewals also capped at five years. Law 39/2015, article 6.6.

There is AEAT help on DEHú that, when discussing GENERALNOT, says that if you leave the end date blank, the power is treated as indefinite until revocation or rejection. AEAT, DEHú access through a power of attorney. That wording clashes with the five-year maximum of the general registration flow and with article 6.6 of Law 39/2015. Faced with the discrepancy, look at the date shown on screen when you grant, download the CSV and, after registration, open the query of powers granted to see the real recorded validity. The Electronic Office also contemplates renewal as a register management step. AEAT, Register of powers of attorney.

A power “forgotten” four years ago is usually a business problem, not a technical footnote. If the relationship with the gestoría cooled or the administrator changed, review the register before the next quarter.

Revocation, resignation and changing gestoría

Revocation of registered powers only takes effect once it is communicated reliably to the Tax Agency. It may be done by appearance with a form, by a public or private document with a notarially authenticated signature, or online with electronic identification and the Electronic Office form; in the telematic case, the cancellation is automatic. AEAT Resolution 18/05/2010; AEAT, Register of powers of attorney. The grantor consults and revokes under “Consulta, prórroga y revocación de apoderamientos otorgados”. AEAT, registering a power.

The attorney may resign at any time through the Electronic Office, so the cancellation is automated. AEAT Resolution 18/05/2010. That does not replace your revocation when you decide to cut the link: if the gestoría will “resign when they can”, you can — and it usually makes sense — revoke now.

When you change advisers, the document handover and the power of attorney are different layers. You may already have handed over books and invoices and still leave a live GENERALNOT in favour of the previous firm. The guide to switching accounting firms stresses inventorying certificates, powers and inboxes; here the concrete step is to enter the register, list active powers, revoke or limit those you no longer need and grant the new one with the correct NIF. Do not wait until “we finish the quarter”: a requirement can arrive any day.

What a power of attorney does not fix

A well-recorded power does not heal a badly filed return. It also does not protect you if the gestoría files late or answers a requirement with incomplete documents. Representation confers capacity to act; the taxpayer’s tax liability remains. That is why the written engagement — what they file, who watches notifications, within how many hours they alert you, who signs appeals — matters as much as the registration CSV.

Do not confuse the AEAT register with a generic notarial power for “everything about the company”, or with representation before other Administrations. Law 39/2015 contemplates general and particular registers; the Agency’s is particular to its Electronic Office. Law 39/2015, article 6; AEAT, ZP01. If you need action before Social Security, commercial registries or other bodies, that tax-office power does not solve it on its own.

How to decide scope without improvising

Before you sign, separate identification, scope and validity. Who uses which certificate. Whether the power is general, GENERALNOT, or only specific procedures. How long it lasts and how you revoke it. In the general-power registration, AEAT help says to select one or more of these codes: GENERALLEY58, GENERALDATPE and GENERALNOT. The 2010 Resolution makes clear that the power only takes effect for the procedures listed among those enabled in the public Electronic Office catalogue. A wide power speeds the gestoría’s work; a narrow one reduces acts you did not want to hand over. The practical decision is what the firm truly needs and what you want to keep.

Without pretending this is an official template:

Periodic filing (303, 130, 111, 200, and so on): a power aimed at those procedures or the general management block usually suffices, depending on the current catalogue.
Consultation of personal data: GENERALDATPE or an equivalent option, so the gestoría can see censuses and data without opening notifications.
Notifications: GENERALNOT or a specific power, always with confirmation and a written alert arrangement for you.
Acts under article 46.2 of the General Tax Law (appeals, waivers, refunds…): only if you want the gestoría to sign those acts in your name and you put that in writing.

If the business is small and you want to see every notification, you can authorise filing and consultation and leave GENERALNOT out. Or keep it, but require an immediate copy. If you administer several companies, avoid copy-pasting the same power without checking NIF: each grantor is a separate registration.

The tax administration may require, in telematic filings and social collaboration, proof of representation at any time. General Tax Law, article 46.4. Having the power in the register leaves a consultable record; it is not decoration.

Next step

Before you send anything to the gestoría, enter the Register of powers of attorney with your identification, note the powers already active and decide the minimum scope you need now. Complete the electronic registration or the documentary route that applies, keep the CSVs, require confirmation if notifications are included, and write into the engagement who watches the inbox. If an old power from another firm remains, revoke it the same day. And if what worries you is not the power but a letter already received, go back to the guide on tax office requirements; they are linked problems, not the same procedure.

Frequently asked questions

Is authorising the gestoría the same as giving them my electronic certificate?

No. The AEAT register of powers lets the attorney act with their own certificate, DNIe, Cl@ve or eIDAS identification on the enabled procedures. Handing over your certificate and its private key cedes a different, wider control; it is not the Electronic Office mechanism for representation before the tax agency.

Which general powers can I tick when I authorise?

In the electronic registration of a general power, the AEAT contemplates the codes GENERALLEY58, GENERALDATPE and GENERALNOT. GENERALNOT covers receipt of notifications and requires the attorney’s confirmation before it takes effect. You may grant a power to one or more natural or legal persons, and you may also choose specific procedures instead of the general block.

How long does an AEAT register power last?

In the electronic registration flow, if you do not change the end date, the AEAT indicates a duration of five years, which is the maximum for that flow. Law 39/2015 likewise sets a maximum validity of five years for powers entered in electronic registers of powers of attorney, renewable. After registration, check the entry and note the real end date.

Can I revoke the power if I change gestoría?

Yes. Revocation only takes effect when it is communicated reliably to the AEAT, by appearance, by a document with a notarially authenticated signature, or online through the Electronic Office. The attorney may also resign. If you change advisers, revoke or limit the old power before you treat the handover as closed.

Does a notification power mean I stop seeing tax office letters?

Not automatically. The attorney may consult notifications on your behalf after confirming GENERALNOT or a specific receipt power, but you can still access them as the holder. The operational risk is that someone opens the deadline and you do not find out in time; agree who watches the inbox and how they alert you.

Does the AEAT electronic register replace every other form of representation?

No. That register covers electronic dealings with the State Tax Agency and is not a general public register. The General Tax Law still requires reinforced accreditation for appeals, waivers, recognition of obligations or refunds, and the Administration may require proof of representation at any time.