Compliance questions — deep-dive Q&A for Italy buyers
Everything compliance: SdI e-invoicing, IVA 22%, CSRD reporting, GDPR, ISO 9001/14001, anti-bribery — and how Corp-Merch passes your audit.
SdI e-invoicing in Italy
All invoices to Italy domestic accounts go via SdI in the country-mandated XML format. We're a registered participant with valid certificates; XML signed (QES per eIDAS Reg 910/2014); archived 10 years. Audit pulls: GET /v1/invoices/{id}/xml returns the original signed XML plus the SdI acknowledgement receipt. We've passed SdI validation 99.97% on first submission across our Italy base.
ESG & CSRD
For CSRD-bound customers (1000+ employees), we provide: Scope 3 cradle-to-gate emissions per SKU (kg CO2e), supplier ESG scorecards (GOTS / OEKO-TEX / Fair Wear), recycled content claims with backing documentation. All claims align with EU Green Claims Directive. Our annual sustainability report is freely available and covers our Italy supplier base.
GDPR, ISO, anti-bribery
GDPR: ROPA available; DPA template signed before any project. ISO 9001:2015 + ISO 14001:2015 + ISO 27001:2022 (corporate); ISO 45001 (health & safety) coming 2026. Anti-bribery: ISO 37001-aligned policy; no anonymous tip ever ignored. Sanctions screening on every supplier and customer (Refinitiv World-Check, monthly refresh). SOC 2 Type II audited annually.
FAQ
Can you fill our compliance questionnaire?
Yes — within 5 working days for SIG Lite or CAIQ. Longer questionnaires (CSRD ESRS, BSI) within 10 days. We've completed 800+ in the last 24 months.
Where are invoices stored?
Italy-resident archive (encrypted at rest, AES-256). Available via API for 10 years; legally compliant with EU Council Directive 2001/115/EC.
Do you screen suppliers for sanctions?
Yes — all suppliers screened against Refinitiv (OFAC, EU, UN, UK sanctions, PEP). Monthly refresh; immediate suspension on hit. Audit trail on the API: GET /v1/suppliers/{id}/screening_history.
What about NIS2 directive?
In scope — we have an Information Security Officer, incident response plan tested 2x/year, and reporting workflow to CSIRT-Italy. Customer-facing incident notification within 24 hours of confirmed material breach.
Anti-bribery checks for gifts?
Each gift order screened against your AML/anti-bribery policy if provided. Default ceiling EUR 100 per recipient; override with approval workflow.