Guide · Updated June 2026 · 12 min read

The Complete Guide to Audit-Proof EU VAT Validation

Why “valid / invalid” isn’t evidence, what a VIES consultation number actually is, what to do when VIES is down, and how to build a VAT validation flow that survives a tax audit.

1. Why zero-rating creates an evidence problem

When you sell B2B across an EU border and your customer supplies a valid VAT number, you usually issue the invoice at 0% under the reverse-charge mechanism (Article 196 of the VAT Directive 2006/112/EC) — the buyer accounts for VAT locally. That 0% is a claim: you verified the buyer's VAT number at the time of supply.

The problem appears years later, in an audit. The tax office doesn't ask whether the number was valid — it asks you to prove that you checked. If you can't, the zero-rating can be disallowed and the VAT (plus interest, sometimes penalties) lands on you, the seller.

The trap: most VAT-check APIs and libraries return a boolean. "True" on the day of the sale is worth nothing in an audit three years later if there's no record of the check itself.

2. What a consultation number is (and why auditors ask for it)

When you validate a VAT number through VIES (the European Commission's VAT Information Exchange System) and you identify yourself with your own VAT number, VIES issues a consultation number (also called a request identifier — e.g. WAPIAAAAW1234567).

That identifier is the official, retrievable record that a specific validation happened at a specific moment, requested by a specific taxpayer. Member-state tax administrations can look it up. It is the piece of evidence auditors actually accept — which is why the SOAP/REST interfaces expose it (the requestIdentifier field), and why serious validation libraries surface it.

What a defensible record contains

The VAT number checked, and your own requester VAT number
The consultation number returned by VIES
A timestamp of the check
The response (valid/invalid + returned company name and address where available)
Immutable storage — a log you can export, not a screenshot folder

3. The second problem: VIES goes down. A lot.

VIES is a relay: it queries each member state's national database. When a national endpoint is overloaded or in maintenance, validations for that country fail. In practice:

Outages cluster around VAT filing periods and year-end, exactly when finance teams batch-check numbers.
Germany's BZSt interface is the most frequent offender (industry trackers attribute roughly half of all VIES interruptions to it), with Italy and Spain next.
Outages are routine enough that the Commission publishes planned ones — e.g. scheduled upgrade interruptions on 15 June 2026, 09:00–16:00 CET.
Billing platforms document the failure mode for their merchants — Recurly, for instance, has a standing help article for the "VIES VAT number validation service unavailable" error.

If your checkout or invoicing flow hard-depends on a live VIES response, an outage either blocks legitimate customers or silently drops your evidence trail. Both are expensive.

Sane failure policy

Retry with backoff — many VIES errors (MS_MAX_CONCURRENT_REQ, SERVICE_UNAVAILABLE) are transient.
Fall back to the national registry of the relevant member state where one is publicly queryable — most member states operate their own, and they don't share VIES's downtime pattern.
Allow-and-flag — accept the transaction, mark it for re-validation, and re-run the VIES check (capturing the consultation number) as soon as the service returns. Blocking checkout on a third-party outage is the worst option.
Log everything — including the failed attempts. "We tried at 14:02, VIES was in scheduled maintenance, we re-validated at 16:31 with consultation number X" is a defensible story.

4. Building it yourself: the honest checklist

You can absolutely build this in-house. Here's what "done properly" requires:

Component	Gotchas
VIES SOAP/REST client	Identify yourself with your own VAT number or you get no consultation number; handle per-country quirks and error codes
Retry + rate limiting	VIES throttles; concurrent batch checks fail with MS_MAX_CONCURRENT_REQ
National-registry fallbacks	One integration per member state you care about; formats differ wildly
Immutable audit log	Append-only storage, export for accountants, retention policy (checks must outlive the statutory audit window — often 10 years)
Re-validation jobs	Numbers lapse; periodic re-checks for recurring billing relationships
Name/address capture	Some member states return them, some don't; needed for invoice accuracy and KYB

Open-source libraries (valvat for Ruby, DragonBe/vies for PHP, and others) handle the first row well. The remaining rows — fallbacks, durable evidence storage, re-validation — are where in-house builds usually stop, and where audits later hurt.

5. The audit-proof validation flow, end to end

1. Customer enters VAT number at checkout / onboarding 2. Validate via VIES, identifying yourself (requester VAT number) → capture: consultation number, timestamp, response, company data 3. If VIES is down → national registry fallback, or allow-and-flag → re-validate via VIES when it returns; capture consultation number 4. Persist everything to an append-only audit log 5. Re-validate recurring customers periodically (e.g. quarterly) 6. On audit: export the log → hand it over → done

One API call per check, one exportable log. That's the whole discipline — the hard part is doing it on every transaction, through every outage, for years.

6. Quick answers

Is a screenshot of the VIES website enough for an audit?

It's better than nothing, and many teams rely on it today — but it's weak evidence: not machine-verifiable, easy to lose, and it usually lacks the consultation number. The consultation number is the identifier tax administrations can actually verify on their side.

Do I need to re-validate existing customers?

Yes, periodically. VAT registrations lapse and get revoked. For subscription businesses, validating once at signup and zero-rating for years afterwards is a common audit finding.

What if the buyer’s number is valid but VIES returns no company name?

Some member states withhold name/address. The validation and its consultation number still stand; capture what's returned and note the member-state limitation in your log.

Does Stripe Tax / my billing platform handle this for me?

Most platforms validate the number, but storing point-in-time, exportable consultation-number evidence under your control is typically still your job. Check what your platform actually retains and for how long — then check who owns that data if you migrate.

Or make it one API call

Vatnode returns the official consultation number on every check, falls back when VIES is down, and keeps the immutable, exportable audit log — so your zero-rating is defensible by default.

Get your free API key

Sources & further reading: VIES (European Commission) · Your Europe — checking VAT numbers · Council Directive 2006/112/EC, Art. 196 · industry outage analyses (Fonoa, viesapi.eu). This guide is general information, not tax advice — confirm specifics with your tax advisor.