DAC7 Compliance for Marketplace Platforms: VAT Verification Requirements

DAC7 — EU Directive 2021/514 — came into force on 1 January 2023 and imposes mandatory data collection, VAT validation, and annual reporting obligations on digital marketplace platforms operating in the EU. If your platform facilitates transactions between sellers and buyers — whether property rentals, freelance services, product sales, or gig economy work — and you meet the reporting thresholds, you must collect and validate seller VAT numbers and submit an annual report to your national tax authority. This guide explains what DAC7 requires, which platforms are in scope, and how to implement the VAT validation component of the compliance workflow.

What is DAC7?

DAC7 is the seventh amendment to the EU Directive on Administrative Cooperation in tax matters (DAC). Its full title is Council Directive (EU) 2021/514 amending Directive 2011/16/EU. It extends automatic exchange of information between EU tax authorities to include income earned by sellers on digital marketplace platforms — the same type of data that the OECD's Model Rules for Reporting by Platform Operators (which DAC7 implements in EU law) requires globally.

The practical effect: if you operate a platform that connects sellers with buyers for property rentals, personal services, goods, and transportation, you must report seller income data to your EU member state's tax authority annually. That tax authority shares the data automatically with other EU member states. The data includes the seller's name, address, tax identification number, VAT number, total consideration earned, and the number of transactions. The goal is to ensure that gig economy income and marketplace sales are properly declared and taxed.

DAC7 went live for reporting periods starting 1 January 2023. The first annual reports were due by 31 January 2024. Platforms that began operating after 1 January 2023 must report from their first full calendar year of operation. Late or incomplete reports carry penalties that vary by member state — some impose per-record fines, others impose percentage-of-undeclared-income penalties.

Which Platforms Are In Scope?

DAC7 applies to 'Platform Operators' — defined as entities that make available, by any means, a digital interface that allows sellers to be connected with users for the provision of relevant activities. Relevant activities include rental of immovable property (Airbnb-type rentals), personal services (Fiverr, Upwork-type platforms), sale of goods (eBay, Amazon Marketplace-type platforms), and rental of any mode of transport (car sharing, bike rental platforms).

The directive specifically excludes platforms where the platform itself is the seller (not merely a facilitator), platforms that only process payments without facilitating the transaction itself, and platforms that only list sellers without enabling transactions. There is also an exclusion for 'low-risk' platforms where the operator can demonstrate that all sellers are large enterprises (annual revenue above €1 billion with a significant EU presence).

Thresholds that trigger reporting for individual sellers: a seller must be reported if they earn more than €2,000 in consideration OR complete more than 30 transactions in the calendar year. This threshold is per seller, not per platform. A seller who earns €1,500 from your platform and €700 from a competitor's platform is over threshold on the combined figure — both platforms report their portion independently, and the tax authorities reconcile.

What Data Must You Collect from Sellers?

DAC7 requires platforms to collect and verify a specific set of seller data at onboarding and to maintain it in a current, verified state throughout the seller's active period. The required data includes: full legal name (and trading name if different), primary address, date of birth (for individual sellers), national tax identification number or equivalent, VAT identification number where applicable, financial account identifier (bank account or payment platform account to which consideration is paid), and business registration number for corporate sellers.

The verification requirements are the most operationally significant part. It is not enough to collect the data — you must verify it. For VAT numbers, this means VIES validation. For national tax identification numbers, this typically means a self-certification from the seller (you are not expected to connect to 27 national tax registries for TIN verification). For addresses, verification can be by reference to government-issued documents or an existing due diligence process. For financial accounts, standard payment platform KYC suffices.

Re-verification is required: you must re-verify collected data at least every 3 years, or when you have reason to believe the data may have changed. A seller who updates their address or banking details triggers a re-verification cycle. For VAT numbers specifically, re-validate via VIES whenever the seller updates their tax details and as part of your annual data quality check before the reporting deadline.

VAT Number Validation in the DAC7 Context

For DAC7 purposes, VAT number validation serves two functions: it verifies that the seller is a registered EU business (relevant for determining whether they are a reportable seller under DAC7 vs a non-EU seller), and it provides the VAT identification number that must appear in the annual report. Unlike validation in a checkout context, DAC7 VAT validation does not gate a transaction — it is part of the seller onboarding and data maintenance process.

Implement VAT validation at seller onboarding as a required step for any seller who declares themselves as a VAT-registered EU business. Store the validation result with a timestamp — you need to demonstrate in your compliance records that you validated the number and when. Use TaxID's API for the validation call and store the full response including company_name, address, status, request_id, and checkedAt. This record is your evidence of due diligence.

interface SellerOnboardingData {
  name: string;
  address: string;
  taxId: string;
  vatNumber?: string;
  bankAccount: string;
}

export async function onboardSeller(
  sellerId: string,
  data: SellerOnboardingData
): Promise<{ success: boolean; warnings: string[] }> {
  const warnings: string[] = [];

  if (data.vatNumber) {
    const country = data.vatNumber.slice(0, 2).toUpperCase();
    const res = await fetch(
      `https://taxid.dev/api/v1/validate/${country}/${data.vatNumber}`,
      { headers: { Authorization: `Bearer ${process.env.TAXID_API_KEY}` } }
    );
    const vatData = await res.json();

    // Store full validation record for DAC7 audit trail
    await db.sellerVatValidation.create({
      data: {
        sellerId,
        vatNumber: vatData.vat ?? data.vatNumber,
        status: vatData.status,
        isValid: vatData.valid,
        companyName: vatData.company_name,
        address: vatData.address,
        requestId: vatData.request_id,
        validatedAt: new Date(),
        source: 'onboarding',
      },
    });

    if (vatData.status === 'service_unavailable') {
      warnings.push('VAT validation pending — EU system temporarily unavailable. Will re-validate automatically.');
    } else if (!vatData.valid) {
      warnings.push('VAT number could not be verified in VIES. Seller registered without VAT status.');
    }
  }

  await db.seller.create({ data: { id: sellerId, ...data, onboardedAt: new Date() } });
  return { success: true, warnings };
}

Annual Reporting: What to Include

The DAC7 annual report must be submitted to your national tax authority by 31 January following the reporting year. It covers all reportable sellers — those who earned more than €2,000 or completed more than 30 transactions in the calendar year. For each reportable seller, the report includes all the data collected at onboarding plus the total consideration paid and number of transactions in each quarter of the year, broken down by the type of activity (property rental, services, goods, transport).

For VAT numbers specifically, the report must include the most recently verified VAT identification number. If a seller updated their VAT number during the year, include the current one. If a seller did not provide a VAT number, include the national tax identification number instead (or a note if neither is available). If you attempted to validate a VAT number and received service_unavailable, document the attempt with a timestamp — this demonstrates good faith in meeting the verification requirement even when the EU system was unavailable.

The report format is XML following the OECD Common Reporting Standard schema, adapted for DAC7. Each EU member state's tax authority provides technical specifications and a submission portal. You must submit to the authority of the EU member state where your platform is established (registered). If you are established outside the EU but have EU sellers, you must register in an EU member state of your choice (most platforms choose Ireland or Luxembourg for this purpose) and submit there.

Penalties for Non-Compliance

DAC7 penalties are set by individual EU member states rather than at the EU level, so they vary. Germany imposes fines of up to €50,000 per report for late or incomplete submission. France can impose fines of €5,000 to €50,000 depending on the severity of non-compliance. Some member states (notably the Netherlands) include criminal liability provisions for wilful non-compliance. The directive requires member states to set 'effective, proportionate, and dissuasive' penalties, so no member state has a 0-penalty regime.

The reputational risk is arguably larger than the fine risk for most platforms. DAC7 non-compliance can trigger a full tax authority audit of the platform's own tax affairs — separate from the DAC7 reporting obligation. Platforms that demonstrate good data collection practices, including robust VAT validation with audit trails, are generally treated more favourably in compliance reviews than those that have minimal records.

Technical Architecture for DAC7 Compliance

A DAC7-compliant data collection system has three main components: the seller onboarding flow (collecting and verifying data), the ongoing maintenance system (re-verifying data at the required intervals), and the annual report generation pipeline (aggregating transaction data per reportable seller and producing the XML report). Each component has distinct requirements, and the VAT validation API touches all three.

At onboarding, validate the VAT number in real time and store the full API response including the request_id for traceability. If VIES is unavailable, queue the number for re-validation and mark the seller record as pending_vat_verification. Block sellers from receiving payments until the VAT number is either confirmed or explicitly exempted (for sellers who are not VAT-registered). Requiring a valid VAT number before first payment is the most defensible compliance posture and simplifies the annual report — all payable sellers have verified tax data.

For the re-verification requirement (every 3 years minimum), run a quarterly sweep of all active sellers whose VAT validation is more than 30 days old or whose last re-verification was more than 2.5 years ago. The quarterly sweep provides a safety margin before the 3-year deadline and catches status changes early. If a re-validation returns inactive, flag the seller record for review, contact the seller to update their details, and suspend new payments until the situation is resolved. Log every re-validation with a timestamp — this is your evidence of compliance if an authority conducts a review.

The annual report requires aggregating transaction data per seller per quarter. Design your transaction schema with DAC7 reporting in mind from the start: store a seller_id on every transaction, store the consideration amount and transaction date, and index by (seller_id, year, quarter) for efficient aggregation. Generating the report should be a query, not a custom extraction job. If you are building the platform in 2026, the time to add these indexes is at schema design, not 3 months before the January 31 reporting deadline.

Multi-Country Seller Considerations

Many marketplace sellers operate across multiple EU countries — a German freelancer selling services to French and Spanish buyers, or an Italian goods seller shipping to all 27 member states. For DAC7 purposes, the seller's VAT number is the key identifier, and it is tied to a single EU member state. A German seller has a DE-prefix VAT number regardless of where their buyers are located. Validate the seller's VAT number against the VIES entry for their registered country, not against the countries where their buyers are.

For sellers registered in multiple EU member states (which is unusual but legally possible for large companies with subsidiaries), they may provide VAT numbers from different countries at different times. Store each validated VAT number with its own validation record and timestamp. If a seller updates their VAT number from a DE prefix to a NL prefix, validate the new number and store it as an additional record — do not overwrite the historical record. The annual DAC7 report should reference the VAT number that was active during the reporting period.

Non-EU sellers present a specific challenge under DAC7. Sellers based outside the EU may not have an EU VAT number at all, but they may still be reportable if they sell goods to EU buyers or rent EU property. For non-EU sellers, DAC7 requires collection of the national tax identification number from their home country (if one exists). Your collection flow needs to handle both paths: EU sellers who have a VAT number to validate against VIES, and non-EU sellers who provide a national TIN that cannot be validated via VIES. Store non-EU TINs with a note indicating they could not be VIES-validated and include them in the report with an appropriate indicator.

DAC7 compliance is ultimately a data quality and process problem, not just a technical one. The VAT validation API call is straightforward — the hard part is building a reliable collection workflow, a re-verification schedule, and a reporting pipeline that runs on time every year. Start building these processes early, before you hit the reporting threshold, so that DAC7 compliance is a routine operation rather than an emergency scramble in January.