Templates and records · UNE 19602 · Clause 8.2

UNE 19602 tax due diligence template

Checking that a supplier, a partner or a transaction does not bring tax risk into the company: invoices without substance, opaque jurisdictions, prices out of line with the market.

In one sentence

Tax due diligence assesses the tax risk of business partners, suppliers, transactions and the most exposed staff —the supplier’s substance, tax residence, arm’s-length prices, consistency of invoicing— and records the checks made and the decision reached; UNE 19602 covers it in section 8.2 and expands on it in Annex A.

Content reviewed on 17 October 2026

Where the standard requires it: UNE 19602 · Clause 8.2 The UNE 19602:2019 section is cited where it has been checked; otherwise each template points to the relevant part of the Academy.
Type of information: Mandatory record Procedure required in section 8.2; the record is its evidence
Who fills it in: Purchasing and finance The tax compliance body validates cases with red flags
When: Before the transaction or onboarding And periodically for recurring high-risk third parties
How long it is kept: At least 6 years UNE 19602 sets no period. Accounting records are kept for six years (art. 30 of the Spanish Commercial Code), the tax authority can audit for four years (art. 66 of the General Tax Act) and unused tax losses for up to ten (art. 66 bis).

What the standard requires

What UNE 19602 demands and what it leaves to your judgement

UNE 19602 calls for due diligence procedures proportionate to tax risk, covering both business partners and the staff most exposed. Its Annex A gives guidance on how to apply them.

It is the same control as ISO 37301 third-party due diligence seen through a tax lens: the question is not only who the third party is, but whether the transaction with them has substance, is invoiced correctly and is taxed where it should be.

Typical red flags are suppliers without the means to deliver what they invoice, payments to accounts in countries other than where the transaction takes place, prices far from market levels, or intermediaries with no clear role.

Read it in context: Tax controls and whistleblowing channel, in the UNE 19602 Academy

Structure

Fields the template should include

Third party or transaction and its amount
Tax risk level
Tax residence and whether it is a low-tax jurisdiction
Substance: resources, genuine activity, years trading
Tax standing: certificate of being up to date with tax obligations
Red flags and how they were resolved
Decision, who made it and any conditions

Example

Example: onboarding a subcontracted haulier

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Third party	Transportes Ribera (fictitious) · subcontracted routes · €180,000 a year expected
Risk	Medium: a sector with cases of invoicing without real resources
Residence	Spain
Substance	Own fleet of 6 vehicles verified; 4 years trading
Tax standing	Certificate of being up to date with the tax authority, current
Red flag	Asks to invoice through a second company owned by the same person · refused
Decision	Approved by the tax compliance committee, 2 April 2026; certificate renewed every 12 months

At the audit

Mistakes auditors commonly flag

The tax compliance certificate is requested and nothing else is checked.
Red flags spotted with no documented decision.
It is applied only to suppliers, not to one-off transactions or exposed staff.
Due diligence is done at onboarding and never revisited.

In Kimobox

How this record is kept in Kimobox

1Due diligence on each relevant third party is recorded from the supplier portal.
2The supplier uploads its certificate and the platform tracks its validity: if it expires, the supplier is no longer approved.
3Due diligence and tax controls are documented directly on the process map.

Frequently asked questions

What people ask us before getting started

Is it the same as ISO 37301 due diligence?

They share a method, not a focus. ISO 37301 looks at compliance risk in general —bribery, sanctions, reputation—; tax due diligence concentrates on the substance and taxation of the transaction. A single third-party file with both sections avoids doing the work twice.

Who counts as exposed staff?

Anyone who makes or prepares decisions with a significant tax effect: finance, the finance director, high-value purchasing. For them, due diligence covers their selection, their training and the absence of conflicts of interest.

Keep your UNE 19602 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

UNE 19602:2019 — Sistemas de gestión de compliance tributario. Requisitos con orientación para su uso (Tax compliance management systems. Requirements with guidance for use) UNE, Spanish Association for Standardisation · February 2019
Ley 58/2003, General Tributaria (Spanish General Tax Act), arts. 66, 66 bis and 179.2.d BOE-A-2003-23186 · Consolidated text