VAT compliance evidence: what tax auditors actually accept (and how to produce it)

The audit moment

A Finanzamt audit letter arrives. The auditor wants every cross-border B2B invoice you issued in the last seven years, with proof that the buyer's VAT number was valid at the time you invoiced and that you took reasonable steps to confirm the buyer was who they claimed to be. You have fourteen days to respond.

For each invoice, the auditor expects three things in your file:

• A timestamped record of when the validation actually happened.
• The source registry that returned the answer, with its identifier for the consultation.
• For German-resident sellers making VAT-free intra-EU supplies, per-field evidence under §18e UStG that the buyer's name and address matched what the foreign member state has on file.

If you have been validating with VIES alone and storing nothing, the answer to the audit is "we checked at signup," which is not the answer the auditor asked for. This guide walks through what auditors actually accept, the four tiers of evidence you can produce, and how to retain it correctly.

What VAT validation evidence means under EU law

EU VAT validation has two layers. The first is existence: confirming the number is registered. The second is qualified confirmation: confirming the number is registered AND that the buyer's company details match the records held by the issuing member state.

The existence layer is established by Article 31 of Council Regulation (EU) No 904/2010, which obliges each member state to allow electronic confirmation by another member state's tax authority that a given VAT identification number is valid. This is the foundation of VIES, the VAT Information Exchange System.

The qualified-confirmation layer is German law. §18e UStG requires sellers making VAT-free intra-EU supplies to obtain a qualifizierte Bestätigungsmitteilung (qualified confirmation) from the Bundeszentralamt für Steuern (BZSt) confirming both validity AND a per-field match on the buyer's name, street, postcode, and town. The qualified confirmation is the legal evidence that protects the seller's good-faith position if the buyer's VAT is later found to be fraudulent.

Retention is set by domestic tax law. §147 AO mandates ten years for German tax records. Most other EU member states require six to ten years; the longest applicable period applies to a seller doing business in multiple jurisdictions.

The regulatory direction of travel is toward more frequent reference of this evidence, not less. The Council of the EU adopted the VAT in the Digital Age (ViDA) package on 11 March 2025, with entry into force on 14 April 2025 and a phased rollout through January 2035. ViDA shifts cross-border B2B reporting from the current quarterly recapitulative statement toward near-real-time digital reporting, which means the validation evidence underlying each invoice is referenced directly by the reporting layer rather than reconstructed years later under audit pressure.

VIES alone proves a number existed at the time of the call. The audit-grade story is VIES plus a retained record plus, for German sellers, the qualified confirmation. The rest of this guide covers what each layer looks like and how to produce it.

The four tiers of VAT evidence

Tax authorities accept four tiers of VAT validation evidence, escalating in rigour from no validation at all to per-field qualified confirmation.

Tier 1 is the floor and the most common default. VIES is asynchronous, the SOAP service can be down for hours, and a valid response with no retained record proves nothing six months later. VIES results carry an official consultation number only when the seller's own VAT is supplied in the request (the requester_vat_number parameter on /v1/validate). Without that parameter, the call is anonymous and produces no consultation reference for the audit file.

Tier 2 is what auditors actually want. The retained record contains the request payload, the full response body, the registry source (VIES, HMRC, BFS UID, Brønnøysund, BZSt), the timestamp at which the registry returned the answer, the latency, and the HTTP status. Retention runs for as long as domestic tax law requires, which in Germany is ten years. This tier maps to vatverify's audit_log.

Tier 3 is German-specific. The BZSt qualified confirmation returns A/B/C/D match codes for each of name, street, postcode, and town. A means the field matches the foreign member state's records. B means it does not match. C means the field was not requested. D means the foreign member state does not return that field. A confirmation where every requested field returned A is the strongest available evidence under §18e UStG. The deep technical reference for this flow lives in the BZSt §18e qualified confirmation guide.

What tax auditors actually ask for

An auditor reconstructing your past invoices will ask for every one of the following per validated VAT number.

1. An immutable timestamp. The exact ISO-8601 datetime when the registry returned its answer. Not the invoice date, not the order date, the validation moment.
2. The source registry. VIES, HMRC, BFS UID, Brønnøysund, or BZSt. An auditor reviewing a 2024 transaction needs to know which registry was queried in 2024, because registry schemas and behaviour change over time.
3. A consultation or request identifier. For VIES with a requester VAT, this is the verify_id returned by the registry. For BZSt this is the bzst_id returned in the qualified confirmation response. For HMRC, the consultation reference. The identifier proves the registry acknowledged a specific query.
4. The exact request payload. What VAT number was queried, with what country prefix, on what date. Reconstructing the request after the fact is harder than retaining it.
5. Per-field match codes when §18e applies. For German sellers, the A/B/C/D grid for name, street, postcode, town. A blanket valid: true boolean is insufficient evidence under §18e; the auditor wants the per-field grid.
6. The full response body. Not a summary. The auditor wants to see the company name, registered address, and validity dates exactly as the registry returned them.
7. Retention duration matching local tax law. For Germany, §147 AO mandates ten years. For most EU member states, six to ten years. Truncating logs after thirty days is a finding.
8. Reproducibility. If asked to re-query the same VAT number today, the result might differ because the company might have deregistered or moved. The retained record is the canonical evidence; live re-validation is supplementary.

How vatverify produces each evidence layer

vatverify produces each evidence tier through a specific endpoint or stored artifact. The full chain looks like this.

/v1/validate produces tier 1 evidence

A call to /v1/validate returns validity, the company name and registered address, the source registry, and a verified_at timestamp. When you supply your own VAT number as requester_vat_number, VIES upgrades the consultation to a named lookup and returns an official verify_id accepted by tax auditors as proof of a specific query.

curl "https://api.vatverify.dev/v1/validate?vat_number=IE6388047V&requester_vat_number=DE100000001" \
  -H "Authorization: Bearer $VATVERIFY_API_KEY"

The response includes data.valid, data.company, data.country, data.verify_id, data.verified_at, and a meta.source of vies, hmrc, bfs, brreg, or bzst.

audit_log retention promotes tier 1 to tier 2

Every call to /v1/validate, /v1/validate/batch, and /v1/decide writes an immutable row to your audit log containing the request body, the response body, the registry source, the timestamp, the latency, and the HTTP status. The retrieval endpoint is GET /v1/audits with cursor pagination and filters on date range, endpoint, and the valid flag.

Audit-log retention scales with plan: seven days on Starter, thirty days on Pro, ninety days on Business. For longer retention windows, archive the audit response into your own storage at the time of the call. The request_id returned in every response is the foreign key for cross-referencing.

/v1/confirm produces tier 3 evidence for German sellers

POST /v1/confirm is the German-specific endpoint. It applies to sellers established in Germany making VAT-free intra-EU supplies. The endpoint wraps BZSt's eVatR service and returns a qualifizierte Bestätigungsmitteilung with per-field A/B/C/D match codes for name, street, postcode, and town. Confirmations are retained for ten years independently of plan tier, matching the §147 AO retention requirement for §18e UStG legal evidence. The record remains retrievable by confirmation_id even after a plan downgrade.

curl -X POST "https://api.vatverify.dev/v1/confirm" \
  -H "Authorization: Bearer $VATVERIFY_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 00000000-0000-4000-8000-000000000001" \
  -d '{
    "vat_number": "FR44732829320",
    "company": {
      "name": "Airbus SAS",
      "street": "2 Rond-Point Emile Dewoitine",
      "postcode": "31700",
      "town": "Blagnac"
    }
  }'

The response includes data.qualified (true when every requested field returned A), data.matches (the per-field grid), data.confirmation_id, and meta.bzst_id (BZSt's own request identifier, independent of vatverify's request_id).

Retrieving evidence years later

Two endpoints retrieve evidence after the fact. GET /v1/audits returns the audit-log trail filterable by date range and endpoint, scoped to the API key that produced the records. GET /v1/confirmations/:id returns a specific BZSt qualified confirmation by its confirmation_id. Confirmations remain readable for ten years from creation; audit-log entries remain readable for the plan-tier retention window from creation.

ViDA: what changes from 2026 onward

The Council of the EU adopted the VAT in the Digital Age (ViDA) package on 11 March 2025. Entry into force was 14 April 2025, with a phased rollout through January 2035. The package has three parts.

Digital reporting and e-invoicing

Mandatory structured e-invoicing for cross-border B2B transactions in the EU. Upon entry into force on 14 April 2025, member states are able to introduce domestic mandatory e-invoicing under specific conditions without prior Commission authorisation. Cross-border digital reporting requirements take effect later in the rollout, ultimately replacing the current quarterly recapitulative statement with near-real-time data submission.

For sellers, the implication is that the validation evidence underlying each invoice is referenced more directly by the reporting layer. Truncated audit logs that worked under quarterly reconciliations no longer work when the reporting cadence shrinks to per-invoice.

Platform economy

From 1 July 2028, platforms providing short-term accommodation rental and passenger transport services become deemed suppliers for VAT purposes in many cases, meaning the platform charges and remits VAT rather than the underlying provider.

For platforms onboarding EU-resident providers, this shifts VAT validation from a provider responsibility to a platform responsibility. Validation at signup AND at each invoice becomes the operational default.

Single VAT registration

From 1 January 2027, an extended scope of the One Stop Shop (OSS) and Import One Stop Shop (IOSS) schemes reduces the need for foreign VAT registrations across multiple member states. Legislative clarifications for OSS and IOSS users take effect on the same date.

The validation requirements themselves do not change with single VAT registration. More transactions flow through OSS reporting, which means more retained validation evidence is referenced by the reporting layer rather than less.

Pre-built audit infrastructure with immutable timestamps, retained request bodies, source registry per call, and retrievability years later is what ViDA's reporting cadence assumes you have. Retrofitting under regulator pressure is harder than building it once at the right layer.

Common mistakes that fail an audit

Five mistakes show up repeatedly in VAT audit findings. Each is preventable with retained validation evidence.

1. VIES-only validation for German-resident sellers. §18e UStG requires a qualified confirmation from BZSt for VAT-free intra-EU supplies. A VIES-only check is insufficient evidence; the auditor will assess your good-faith protection on a per-customer basis without it.
2. Not retaining the consultation number. VIES returns a verify_id only when the seller's VAT is supplied in the request. Without that identifier retained alongside the response, you cannot prove which exact consultation the registry acknowledged.
3. Truncating logs after thirty days. §147 AO mandates ten years for German tax records. Most other EU member states require six to ten years. A thirty-day log retention period is below the floor for a German audit and well below it for cross-border activity.
4. No per-field match capture for §18e cases. The qualified confirmation returns A/B/C/D match codes per field. A valid: true boolean alone is insufficient evidence under §18e; the auditor wants the per-field grid.
5. Validating once at signup, not per invoice. A VAT number can be deregistered between signup and the next invoice. Validation evidence applies to the date of the transaction, not the date of the customer relationship.

Audit-readiness checklist

The shortest version of this guide. Save this list.

• Validate every VAT number at the time of the transaction, not at signup.
• Retain the request, response, timestamp, source registry, and consultation identifier.
• Retain for ten years for German records. Six to ten years for most other EU member states. The longest applicable period applies.
• For German-resident sellers making VAT-free intra-EU supplies, use BZSt §18e qualified confirmation (POST /v1/confirm), not VIES alone.
• Capture per-field A/B/C/D match codes for every §18e call.
• Test that you can retrieve a specific past validation by request_id or confirmation_id. If you cannot, the retention is theoretical.
• Document your retention policy and link it from your customer-facing terms.
• Re-validate when a customer's invoice details change.

FAQ

Quick answers to the questions that come up most often when teams start documenting VAT compliance evidence.

How long do I need to retain VAT validation records?

For German records, §147 AO mandates ten years. Most other EU member states require six to ten years. The longest applicable retention period applies; if you do business in multiple member states, retain to the longest.

What is the difference between VIES and BZSt qualified confirmation?

VIES tells you a VAT number exists. BZSt's qualified confirmation tells you the number exists AND the buyer's company name, street, postcode, and town match what the foreign member state has on file. Only BZSt returns the per-field A/B/C/D match grid required for §18e UStG good-faith protection.

Does my SaaS company need §18e qualified confirmation?

Only if you are a German-resident seller making VAT-free intra-EU supplies. If you are not in Germany, VIES validation through /v1/validate is sufficient. If you are in Germany and you invoice EU customers without charging VAT, §18e applies.

Is a screenshot of VIES enough for a tax audit?

No. Screenshots are not immutable, are not timestamped at the protocol level, and do not contain the consultation number. A retained API response with a verify_id and timestamp is the correct evidence form.

What is a VAT consultation number?

The official identifier VIES returns when you query with your own VAT number supplied as the requester. It uniquely identifies the consultation in the registry's records. Tax auditors accept it as proof of a specific query.

When does ViDA take effect?

The ViDA package was adopted by the Council on 11 March 2025 and entered into force on 14 April 2025, with phased rollout through January 2035. Specific provisions take effect on different dates: legislative clarifications for OSS and IOSS users on 1 January 2027, platform-economy rules for short-term accommodation and passenger transport on 1 July 2028.

What is a bzst_id and why does it matter?

It is the request identifier BZSt returns in every qualified confirmation response. Independent of vatverify's request_id and confirmation_id. Three immutable references attached to a single confirmation event strengthen the evidence chain.

Can I produce audit evidence retroactively?

Only if you retained the original validation. Re-querying VIES today does not prove what the registry returned six months ago, because companies deregister and addresses change. Retain at the time of the call.

Does vatverify retain my validation history?

Yes. Every call to /v1/validate, /v1/validate/batch, and /v1/decide is written to an immutable audit log with the request, response, timestamp, source registry, and HTTP status. Audit-log retention scales with plan up to ninety days. BZSt qualified confirmations created via /v1/confirm are retained for ten years independently of plan tier.

Which countries require qualified confirmation?

Germany, via §18e UStG, has a codified qualified-confirmation requirement and a registry endpoint (BZSt) that returns per-field match codes. Other member states accept VIES as the standard. For German-resident sellers making VAT-free B2B supplies, qualified confirmation is the legal evidence.

Next steps

Three places to go from here:

• Building? See the /v1/confirm API reference for BZSt §18e qualified confirmation, including request envelope, idempotency, and the four match codes.
• German seller? The §18e qualified confirmation guide walks through the request envelope, the per-field A/B/C/D codes, and the retry semantics for transient BZSt failures.
• Ready to start? The Business plan includes ten-year retention on /v1/confirm records and access to BZSt qualified confirmation. /v1/validate is free up to 500 requests per month for everything else.