EU VAT (per country) Validator

EU VAT number validation: country-specific formats and the VIES system

A VAT number (Value Added Tax identification) is the fiscal identifier that every business registered for VAT inside the European Union carries on invoices, customs declarations and intra-community supply records. Validating one is not a single algorithm — each of the 27 member states publishes its own length, character set and check-digit rule, and a robust validator must first split the country prefix (the two ISO-3166 letters) from the body, then dispatch to the right routine. This page runs the math entirely in your browser, with no upload to VIES.

The legal basis is Council Directive 2006/112/EC and the VIES (VAT Information Exchange System) portal operated by DG TAXUD. VIES is the only official source of truth for whether a number is currently active — local syntactic validation (what this tool does) is necessary but not sufficient before you can issue a tax-free intra-community invoice.

Per-country format cheat sheet

• DE Germany: DE + 9 digits, mod 11 check (e.g. DE123456789).
• FR France: FR + 2 alphanumeric key + 9 digits SIREN (FR12345678901); key derived from SIREN mod 97.
• IT Italy: IT + 11 digits, Luhn-style check (IT12345678901).
• ES Spain (NIF-IVA): ES + 9 characters, one letter + 7 digits + one letter, or DNI/NIE layouts.
• NL Netherlands: NL + 9 digits + B + 2 digits suffix (NL123456789B01) — the post-2020 scheme is randomised.
• PT Portugal: PT + 9 digits — equal to the personal/business NIF.
• IE Ireland: 8 or 9 characters, may contain +, * or two letters in legacy stock.
• PL Poland: PL + 10 digits, weighted mod 11.
• BE Belgium: BE + 10 digits starting with 0 or 1, mod 97 check.
• GB United Kingdom: post-Brexit it is no longer an EU VAT number — except for Northern Ireland, which uses the XI prefix and remains in VIES.

Check-digit algorithms in use

Most EU countries pick a variant of mod 11 or mod 97 for the check digit. Italy uses the same Luhn double-and-sum that powers credit cards. Spain mixes letters into the body, so its routine is closer to a hash than to arithmetic. Germany weights positions 2,4,8,5,10,9,7,3,6 with a multiplicative cascade, while Belgium computes 97 - (body mod 97) on the first eight digits. A general-purpose validator therefore needs a dispatch table indexed by country code.

// Pseudocode: dispatch by ISO country code
function validateVAT(raw) {
  const cc   = raw.slice(0, 2).toUpperCase()
  const body = raw.slice(2).replace(/[\s.-]/g, '')
  const rule = VAT_RULES[cc]            // per-country regex + check fn
  if (!rule) return { ok: false, reason: 'unknown country' }
  if (!rule.regex.test(body)) return { ok: false, reason: 'bad format' }
  return { ok: rule.check(body), country: cc }
}

VIES, OSS and intra-community supply

A Brazilian seller exporting through Mercado Livre EU, Magazine Luiza Marketplace B2B export or a direct B2B contract must put the customer's VAT number on the invoice to qualify for the reverse-charge mechanism — VAT then becomes the buyer's obligation, not the seller's. Issuing a tax-free invoice against a fictitious VAT number is a classic carousel-fraud red flag, so the European Commission mandates a real-time VIES lookup before shipment. The free SOAP endpoint (ec.europa.eu/taxation_customs/vies/services/checkVatService) is rate-limited but unauthenticated; production stacks usually cache the response per (country, number) for 24 hours.

For digital services to EU consumers, the OSS (One-Stop Shop) regime — which replaced the older MOSS (Mini One-Stop Shop) in July 2021 — lets a single VAT registration collect VAT for all 27 member states. Even non-EU sellers (including Brazilian SaaS shops) can register under the non-Union OSS scheme.

GDPR, post-Brexit GB and tooling

VAT numbers identify a legal person and therefore qualify as personal data under GDPR Art. 4(1) when the registrant is a sole trader. Logs containing VAT IDs need the same retention controls you apply to CPF or e-mail. After Brexit, GB-prefixed numbers stopped appearing in VIES on 1 January 2021; only XI (Northern Ireland) remains. The legacy GB number is still validatable syntactically — its 9-digit body uses the historical mod-97 algorithm — but a VIES lookup will return "service unavailable for this member state".

• Libraries: node-vat and jsvat for JavaScript, python-stdnum for Python, valvat for Ruby — all bundle the per-country dispatch.
• EU OSS portal: oss.europa.eu for registration and quarterly returns.
• CFE Tax Advisers Europe: independent body tracking national VAT implementations.

FAQ

Is VIES free? Yes. The SOAP and REST endpoints have no fee, only soft rate limits. Production callers should cache and back off on HTTP 429.

What happened to GB after Brexit? United Kingdom VAT (GB prefix) left VIES on 1 January 2021. Northern Ireland kept the protocol via the dedicated XI prefix.

Does a valid checksum prove the company exists? No. Syntactic validation only catches typos. VIES proves the number is registered today, and even then it does not certify the trading name on the invoice.

How do I prevent carousel fraud? Cross-validate the VAT against VIES every time you ship, keep the SOAP response as evidence, and watch for invoices with frequent number rotations from the same buyer address.

Can a Brazilian SaaS use OSS? Yes — register for the non-Union OSS scheme in any one member state (often Ireland or Malta) and collect destination-country VAT through a single quarterly return.