How to Verify VAT Numbers: Formats, VIES Limitations, and Country‑by‑Country Compliance Guide
1 The Problem Isn't Knowledge — It's Reliability
Every finance team knows they should verify VAT numbers. Most try. The issue is that the system they depend on — the EU's VIES portal — is unreliable, limited, and increasingly insufficient for what regulators now expect.
VIES goes down multiple times per month. Not for minutes — for hours. During filing periods and year-end closes, country databases become intermittently unavailable. Over a bad three-day stretch in January 2023, VIES couldn't validate Belgian VAT numbers roughly 32% of the time. Germany was equally bad.
10% of VIES API requests take over one second — and some take over 50 seconds. If you're validating during checkout, onboarding, or invoice processing, that's a workflow-breaking delay.
VIES doesn't contain all valid VAT numbers. Several EU countries only activate numbers for VIES after a separate cross-border registration. A business can be fully VAT-registered domestically in Germany or Spain but invisible to VIES. A "not found" doesn't always mean fraud — it might mean incomplete registration.
2 What Verification Actually Means
Validation checks structure: Is DE123456789 the right format? Does it have 9 digits after the DE prefix? This catches typos.
Verification checks reality: Is this number actively registered with the tax authority right now? Does the entity name match the supplier on your invoice? This catches fraud.
Full verification means confirming three things in sequence:
- Format correctness — matches the country's structure rules
- Active registration — live in the tax authority's registry
- Entity match — registered name and address match your supplier
If your process only does step 1, you're validating — not verifying. Validation alone doesn't protect you from anything that matters.
MonitorPay's VAT Check performs all three steps in a single API call — format, live registry, and entity match.
3 Country-by-Country Traps That Break Your Process
VAT verification isn't one system. It's 27+ separate national databases with different rules, formats, and failure modes.
The MS_MAX_CONCURRENT_REQ error occurs in Germany in 95% of all cases of this error type across all EU member states. During filing periods, German VIES checks are essentially a lottery.
Spain already runs SII (near-real-time invoice reporting). Verifactu adds QR code and digital fingerprint requirements — January 2027 for corporates, July 2027 for sole traders. A "valid" number that isn't SII-activated will cause invoice rejection.
Fix → Verify both domestic NIF and SII activation statusOnly FatturaPA XML invoices are legally valid — PDFs aren't recognized. Non-EU businesses trying to register for VIES now need a bank guarantee. They may appear valid domestically but won't clear VIES.
Fix → Query Agenzia delle Entrate directly for non-EU entitiesAll B2B invoices must flow through certified PDPs or the PPF portal starting September 2026. Every invoice requires a verified TVA number. Unverified? The invoice won't enter the system.
Fix → Automated real-time VAT check at invoice creationRomanian VAT numbers can be 2 to 10 digits after RO. No fixed length. If your regex expects consistency, Romania will break it. Also now requires monthly SAF-T for foreign VAT-registered businesses.
In 2020, the NL changed its VAT format for sole proprietors. Legacy ERP rules from before 2020 reject valid Dutch numbers. More common than you'd think in large enterprises.
Fix → Update ERP validation rules or use API that handles format changesEU VAT Formats Reference
| Country | Code | Format | Example | Watch Out For |
|---|---|---|---|---|
| Germany | DE | DE + 9 digits | DE123456789 | VIES unreliable; query BZSt |
| France | FR | FR + 2 chars + 9 digits | FRXX123456789 | e-invoicing Sept 2026 |
| Italy | IT | IT + 11 digits | IT12345678901 | FatturaPA only; bank guarantee |
| Spain | ES | ES + char + 7d + char | ESX1234567X | SII + Verifactu 2027 |
| Netherlands | NL | NL + 9d + B + 2d | NL123456789B01 | Format changed 2020 |
| Belgium | BE | BE + 10 digits (0 prefix) | BE0123456789 | e-invoicing Jan 2026 |
| Poland | PL | PL + 10 digits | PL1234567890 | KSeF 2026 |
| Romania | RO | RO + 2–10 digits | RO1234567890 | Variable length |
| Austria | AT | AT + U + 8 digits | ATU12345678 | AI fraud detection |
| Czech Rep. | CZ | CZ + 8–10 digits | CZ12345678 | Verify on date of supply |
| Sweden | SE | SE + 12 digits | SE123456789012 | Peppol B2B Jan 2026 |
| Hungary | HU | HU + 8 digits | HU12345678 | Instant mismatch detection |
| Ireland | IE | IE + 7d + 1-2 chars | IE1234567X | Old format circulates |
| Greece | EL | EL + 9 digits | EL123456789 | Code is EL, not GR |
| Denmark | DK | DK + 8 digits | DK12345678 | — |
| Finland | FI | FI + 8 digits | FI12345678 | — |
| Portugal | PT | PT + 9 digits | PT123456789 | — |
| Croatia | HR | HR + 11 digits | HR12345678901 | — |
| Bulgaria | BG | BG + 9–10 digits | BG123456789 | ~10% VIES downtime |
| Luxembourg | LU | LU + 8 digits | LU12345678 | — |
Non-EU Registries
| Country | Tax ID | Format | Registry |
|---|---|---|---|
| United Kingdom | VAT | GB + 9 or 12 digits | HMRC |
| Switzerland | UID/MWST | CHE- + 9d + suffix | Federal UID |
| Norway | MVA | 9 digits + MVA | Brønnøysund |
| India | GSTIN | 15 chars | GST Portal |
| Brazil | CNPJ | 14 digits | Receita Federal |
| Australia | ABN | 11 digits | ABN Lookup |
| Canada | BN/GST | 9d + RT0001 | CRA |
| UAE | TRN | 15 digits | Federal Tax Auth |
| South Africa | VAT | 10 digits | SARS |
For UK, Swiss, and non-EU suppliers, VIES returns nothing. MonitorPay covers 150+ countries through one API endpoint.
4 The Real Cost: Worked Examples
You sell €500,000 to a Dutch buyer and zero-rate the invoice. An audit reveals the number was deregistered before the transaction.
Hungary has the EU's highest VAT rate at 27%.
€200,000 invoice from a supplier with a valid-looking Italian VAT number. You reclaim €44,000 in input VAT. The supplier is a "missing trader." Reclaim clawed back.
Supplier's VAT number was valid 18 months ago. Company dissolved. Nobody re-checked. You wire €75,000.
The loss isn't caused by not knowing what a VAT number is. It's caused by not checking — or checking once and assuming it stays valid.
5 The 2026–2028 E-Invoicing Cliff
Everything above was about audit risk. What's coming next is operational: invoices will be rejected by systems, not flagged by auditors.
| Country | Mandate | Date | If VAT Number Is Invalid |
|---|---|---|---|
| Belgium | B2B e-invoicing (Peppol) | Jan 2026 | Invoice rejected by receiving system |
| France | B2B e-invoicing (PPF/PDP) | Sept 2026 | Invoice won't enter clearance system |
| Germany | Mandatory sending (>€800K) | Jan 2027 | Non-compliant; up to €5,000 fine |
| Spain | Verifactu + B2B | Jan 2027 | Audit trail breaks; fines up to €50K/yr |
| Poland | KSeF 2.0 | 2026 | Invoice rejected by clearance system |
| Germany | Mandatory sending (all) | Jan 2028 | Non-compliant; up to €5,000 fine |
| EU-wide | ViDA Digital Reporting | July 2030 | Real-time rejection of cross-border invoices |
The shift: from "verify to avoid audit risk" to "verify or your invoice doesn't exist." Invalid VAT number = invoice rejected at transmission. No workaround.
6 Why VIES Alone Can't Be Your Strategy
| VIES Limitation | Impact | What You Need |
|---|---|---|
| Down multiple times/month | Fails during filing periods | National registry fallback |
| Germany ~32% unavailable (bad periods) | Can't verify largest EU partner | Direct BZSt integration |
| 10%+ requests >1s (up to 50s) | Blocks checkout/onboarding | Sub-second SLA + caching |
| Not all valid numbers listed | False negatives block suppliers | National registry cross-check |
| One number at a time | Can't batch-verify 5,000 suppliers | Bulk API endpoint |
| EU only | No UK/Swiss/global coverage | Multi-registry API (150+ countries) |
| No monitoring | Deregistrations go undetected | Webhooks on status changes |
| No audit trail | Screenshots don't pass SOC 2 | Timestamped verification logs |
MonitorPay VAT Check — 150+ Countries. Sub-Second. Reliable.
Replace VIES dependency with a single API that queries national registries directly.
- Routes around VIES via BZSt, AEAT, SdI, HMRC, and 150+ registries
- Format + active status + entity match in one call
- Bulk endpoint: thousands per batch
- Continuous monitoring with webhook alerts
- Full audit trail — SOC 2 ready
- First 100 checks free. From €0.10/check.
7 Where VAT Verification Fits in Your Stack
| Layer | Catches | When | MonitorPay Product |
|---|---|---|---|
| 1. IBAN Validation | Malformed bank accounts | Every payment | IBAN Validation |
| 2. Payee Match | Invoice name ≠ account holder | Every payment | Payee Verification |
| 3. Account Ownership | Account → different entity | Onboarding + high-value | Ownership Check |
| 4. VAT Verification | Deregistered/fake/mismatched IDs | Onboarding + pre-invoice | VAT Check |
| 5. Continuous Monitoring | Post-verification changes | Always-on | Monitoring |
Sample API Response
{
"vatNumber": "DE123456789",
"valid": true,
"status": "ACTIVE",
"countryCode": "DE",
"companyName": "Mustermann GmbH",
"companyAddress": "Musterstraße 1, 10115 Berlin",
"requestDate": "2026-02-22T14:30:00Z",
"source": "national_registry",
"sourceNote": "BZSt direct (VIES bypassed)"
}
8 The Operational Playbook
At onboarding: Verify before the vendor master record is created. Compare the registered entity name against the contract. Flag mismatches. Reject inactive numbers. Store results with timestamps.
Before each VAT return: Re-verify every supplier on the upcoming return. The Czech Republic mandates verification on date of supply for input deductions. Estonia and Latvia recommend the same.
Continuously: The UN's 2025 VAT/GST guidance calls for continuous monitoring. MonitorPay's monitoring fires webhook alerts on deregistrations before your next payment run.
During M&A and ERP migrations: Inherit a vendor file? Run bulk validation before migrating it into your systems.
9 What to Require from Any Verification Tool
Direct registry access. If it just wraps VIES, you inherit VIES's problems. It should query BZSt, HMRC, Agenzia delle Entrate directly.
Global coverage. One API, not 30 integrations.
Bulk processing. 5,000+ checks per batch, not one at a time.
Continuous monitoring. Webhook alerts on status changes.
Structured output. JSON with status, entity, source, timestamp.
Audit trail. Every check. Every result. Big 4–ready.
10 The Deadline Is the Mandate
When Belgium, France, and Poland route invoices through government clearance platforms in 2026, an unverified VAT number creates invoice rejection — not audit risk. Your customer doesn't receive the invoice. You don't get paid. No manual workaround.
Build verification into your workflows now, or scramble to integrate while dealing with rejected invoices and confused customers.
Start With 100 Free Checks
150+ countries. Direct registry access. Bulk processing. Continuous monitoring. Full audit trail. One API. Integrate in under a day.
Frequently Asked Questions
MS_MAX_CONCURRENT_REQ error accounts for 95% of cases. During filing periods, availability drops significantly. The fix: query BZSt directly. MonitorPay does this automatically.