Your gestor says handing over your digital certificate is fine. Spain disagrees.

Ask your gestor — administrative agent — whether it is safe to hand over your digital certificate, and you will probably hear what we heard last week: it is perfectly safe, not illegal, everyone does it, and the government has never charged a soul for handing it over.

They are right on all counts. The certificado digital — digital certificate is the file you use to prove who you are to the Spanish state online, and giving it away is, by long custom, simply how things are done here. They also left out the part that matters.

A digital certificate is not a login. It is your legal identity online, and by the issuer's own terms, it is personal and non-transferable. Anyone holding the file is considered to be you: file your taxes, sign documents, open the binding post sitting in your Sede Electrónica — the government's online office, and act in your name anywhere the state is involved.

Here is the sting. Before the law, everything done with it is deemed authorised by you. If it is used to file an incorrect return, claim a refund, or sign something you never saw, the bill and any penalty will land on you. And the moment you hand the file over, the body that issued it stops being liable to you. You are on your own with whatever happens next.

Your gestor is right that nobody has gotten charged for sharing their file yet. Though ceding your certificate is "not in conformity with current law" under three instruments — Ley 59/2003 (firma electrónica), EU Reg 910/2014 (eIDAS), and the data-protection law (LOPD 3/2018) — and the certificates are, by the FNMT's own terms, "personal e intransferible." The Ministry's 2019 nota, the Banco de España, the FNMT, and INCIBE all say: don't do it. That part is well-sourced. The legal point, stated plainly by a tax-law source: a legitimate adviser works through apoderamiento before the AEAT, with no need for the client's personal keys, and the crucial difference, "if the gestor makes an error, the responsibility falls on them, not the client."

So true, as of now, no one has been charged for sharing their certificate. But what has been charged is what the sharing makes possible.

In a case decided in Valladolid, the manager and a salesperson at an accounting firm were convicted of forgery and attempted fraud, each receiving 7 months in prison. It started the ordinary way: a woman came in to have her self-employed tax returns done and was told to get a digital certificate from Hacienda — the tax office — so the firm could handle it for her. The certificate was the door. The theft and conviction were real.

It is not only the courts. The data-protection authority has fined gestorías €3,000 and €4,000 for letting client information slip, and the tax agency is warning that this very Renta season, your certificate or Cl@ve, in the wrong hands, is enough to file false returns and claim refunds in your name. Confirmed June 2026. None of this needs your gestor to be a crook. It needs only that the key exists and that you handed it over.

There is a legitimate way to let a professional act on your behalf, and almost nobody uses it. It is an apoderamiento — a registered power of representation, set up through the state's Apodera portal (apodera.redsara.es) or the tax agency's own register.

You authorise your gestor to do specific things, on specific portals, for a set time. You can keep it narrow, one procedure only. You can see what was done and revoke it in a moment. And when the work runs through an apoderamiento, a mistake is the gestor's responsibility, not yours. They get every power they genuinely need and none they do not. A good gestor can also use their own representative certificate. If yours insists on holding your personal one instead, that tells you something.

Apoderamiento — a registered authorisation to act on your behalf. Set it up at the Apodera portal or the tax agency's register. Scope it to one procedure, give it an end date, revoke it whenever you like.

Sede Electrónica — a public body's official online office. Where binding notices now land, with deadlines that run whether or not you have opened them.

Your gestor is not wrong that everyone does it. Everyone speeding does not move the limit past 120. The certificate is the single key that opens your whole life with the Spanish state, and there is a legal, scoped, revocable way to lend it that protects you and inconveniences no honest professional. Set up an apoderamiento, and keep your own certificate to yourself.

If you would rather not work out which powers to grant and how, that is the safe version of what we do. Our Navigator acts for you as a registered representative, scoped to what you approve, revocable at any time, and never holds your certificate. We start every client by getting into the Sede Electrónica and telling you, in two sentences, what is actually sitting there. One client in Marbella had a notice she could not open for three weeks; it turned out she had eight days left on it, not thirty. €49 a month, no lock-in.

Onwards — A. and your duly authorised WaypointSur team.