Format-Valid vs Actually Valid: What a Real VAT Check Confirms

A VAT number can be perfectly formatted and still be worthless. DE123456789 has the right prefix, the right length, and the right character pattern — and none of that tells you whether it was ever issued or is registered today. Format is about the shape of the string. Validity is about whether a tax authority recognises it. Those are two different questions, and conflating them is the single most common mistake in VAT validation.

This guide separates the three states a VAT ID can be in, what a format check actually proves, and what a live check against VIES adds on top. The scope is the EU-27 plus XI (Northern Ireland), which is the area VIES covers. If you want the broader background first, see what a VAT ID is.

"Valid" means two different things

When someone says a VAT number is "valid", they usually mean one of two unrelated things:

• Format-valid — the string is well-formed. It has the correct country prefix and matches that country's character pattern. A regex can decide this offline, in microseconds, with no network call.
• Actually valid — the number is registered in a national VAT database and active for intra-EU trade right now. Only a live lookup can decide this.

A number can be format-valid and not actually valid. It cannot be actually valid without being format-valid, but that's a weak guarantee — passing the format check gets you nothing except permission to ask the real question. Keep the two words apart and most of the confusion disappears.

It helps to break "actually valid" down further, because there are really three states, not two.

State 1 — malformed (fails the format check)

The string doesn't match any valid pattern for its country. Wrong prefix, wrong length, illegal characters, a typo that drops a digit. This is the cheapest failure to catch: you reject it locally before it ever reaches a network.

// Approximate per-country envelope — NOT a single canonical pattern.
// This only proves the string could exist. It proves nothing about registration.
const VAT_SHAPE: Record<string, RegExp> = {
  DE: /^DE\d{9}$/,
  FR: /^FR[A-Z0-9]{2}\d{9}$/,
  EL: /^EL\d{9}$/, // Greece is EL, not GR
  XI: /^XI\d{9}$/, // Northern Ireland, goods only
  // ...per-country patterns differ; lengths and character sets vary
}

function isWellFormed(vatId: string): boolean {
  const cc = vatId.slice(0, 2).toUpperCase()
  const pattern = VAT_SHAPE[cc]
  return pattern ? pattern.test(vatId.toUpperCase()) : false
}

Two things this snippet is deliberately not: it is not exhaustive, and it is not authoritative. Per-country patterns differ — some national portions are all digits, some include letters, and lengths vary — so treat any regex table as an approximation, never a canonical rule. There is no "all EU numbers are two letters plus nine digits" pattern; the character after the prefix is the beginning of a country-specific string, not a fixed template. A full per-country reference lives in EU VAT number formats.

Two prefixes catch people out here:

• Greece uses EL, not GR. The VAT convention diverges from the ISO country code on purpose — don't "correct" it to GR.
• Northern Ireland uses XI under the Windsor Framework, and only for goods. NI supplies of services follow UK rules under a GB number, which is outside VIES.

State 2 — well-formed but not registered

This is the state that catches everyone. The string passes every format rule and is still not a real VAT number. It was never issued, or it was issued and later cancelled, or someone transposed two digits into a value that happens to be well-formed but belongs to nobody.

A format check is structurally blind to this. It inspects characters; it has no knowledge of what any tax authority has actually registered. A fabricated number and a genuine one are indistinguishable to a regex as long as they share the same shape. This is exactly why "it looks right" is not a basis for zero-rating an invoice — the number can look right and still return invalid the moment you actually ask.

State 3 — registered and active

The number exists in the relevant national VAT database and is enabled for intra-EU trade at the moment you query it. This is the only state that supports relying on the number. VIES returns valid here, and typically the trader's name and address as the member state holds them.

The important qualifier is at the moment you query it. State 3 is not a permanent property of a number — it's a snapshot. A registration that is active today can be cancelled tomorrow, which is why every real check is time-stamped and why ongoing relationships get re-validated rather than checked once and trusted forever.

What a format/regex check actually proves (and doesn't)

A format check is a filter, not an answer. Held to what it can genuinely do, it is useful:

• It proves the string could plausibly be a VAT number for a given country — right prefix, plausible length, legal characters.
• It rejects typos, pasted whitespace, wrong-country prefixes, and obviously broken input instantly, offline, at zero cost.
• It saves a pointless network round-trip: there is no reason to ask VIES about a string that can't possibly be a VAT number.

What it does not prove is everything that matters for relying on the number:

• It does not prove the number was ever issued.
• It does not prove the number is still active.
• It does not prove the number belongs to the business you're dealing with.

Treat format validation as the cheap first gate. It earns its place by being fast and free — but it hands off to a live check the instant you need to trust the number for anything.

What VIES confirms — and its limits

VIES is the European Commission's system for checking EU VAT numbers. The official Your Europe VIES page describes it as "a search engine, not a database" — and that phrasing is the key to understanding what it does and doesn't guarantee. VIES holds no data of its own. When you query it, it routes the request to the relevant member state's national VAT database live and relays the answer back.

What that means in practice:

• A valid result means the number is currently registered and enabled for intra-EU transactions in that member state's database, as of the query timestamp. Some numbers are additionally cross-checked against national registries.
• An invalid result means the number is not registered in the relevant national database — either it never was, or the registration has ended.
• The returned trader name and address are whatever the member state chooses to return; VIES doesn't vouch for anything beyond that.

The limits matter as much as the confirmation. VIES is not a legal certification. The European Commission's VAT identification numbers guidance is explicit that the data comes from national databases the Commission doesn't control, so it can't accept responsibility for its accuracy. National databases can be briefly unavailable or momentarily out of step. So a VIES result is a strong, externally-issued snapshot — not a guarantee, and always qualified by "as of the query timestamp." For how the routing, downtime, and national fallbacks fit together, see how VIES works.

Why the distinction matters for reverse charge and audits

This is not pedantry. The format-vs-valid distinction has direct financial consequences on cross-border B2B supplies.

When you sell to another VAT-registered business in a different member state, a valid buyer VAT ID is one of the conditions for not charging local VAT — the supply can be zero-rated or fall under the reverse-charge mechanism, which relies on a live check rather than a plausible-looking string. If you zero-rate against a number that was merely format-valid and turns out never to have been registered, the exposure is yours, not the buyer's. "It matched the pattern" is not a defence a tax authority accepts.

That's why the evidence auditors care about is a time-stamped live check, not a format assertion. The record that holds up is: this number was checked against VIES on this date, this is what came back, and — where available — this is the reference VIES itself issued. That server-issued reference is proof of the check; it's useful audit evidence, though vatstack and others return it too, so it's not unique to any one provider. The point stands regardless: a format check produces no such evidence, because nothing external was ever asked.

This is general information about EU VAT and VIES, not tax advice. Whether a specific transaction qualifies for zero-rating, exemption, or reverse charge depends on facts we can't assess here — confirm the treatment of your own transactions with a qualified tax adviser.

How to run a real check

For a single number, use a free VAT number checker: paste the VAT ID in and you get the live VIES result, time-stamped.

To check numbers programmatically — on signup, on every invoice, or across an existing customer base — call a VAT validation API from your own code. The pattern is: cheap format pre-check first, then a live lookup for anything that passes.

const res = await fetch('https://api.vatnode.dev/v1/vat/DE123456789', {
  headers: { Authorization: `Bearer ${process.env.VATNODE_API_KEY}` },
})

const data = await res.json()
// {
//   "valid": true,                  // the actual answer — state 3
//   "vatId": "DE123456789",
//   "countryCode": "DE",
//   "countryName": "Germany",
//   "companyName": "Example GmbH",
//   "companyAddress": "Musterstr. 1, ...",
//   "checkId": "chk_...",
//   "verifiedAt": "2026-07-27T08:30:00.000Z",  // as-of timestamp
//   "source": "VIES",
//   "consultationNumber": "WAPIAAAAX9999999"
// }

The format pre-check happens before this call and only decides whether the call is worth making. The valid field is the answer that matters — and verifiedAt is what makes it evidence rather than a guess, because it pins the result to a moment. Store the whole record; don't reduce it to a boolean.

FAQ

Does a correctly formatted VAT number mean it's valid?

No. Matching the country format only proves the string is well-formed. Whether the number is registered and active can only be confirmed by a live check against VIES.

What does a VAT format check actually tell you?

It tells you the number could exist — that it has the right country prefix, length, and character pattern. It cannot tell you the number was ever issued or is still active.

What does VIES confirm?

VIES confirms whether an EU VAT number is currently registered and valid in the relevant member state's database at the time of the query; some numbers are also cross-checked against national registries. It does not vouch for company details beyond what the member state returns.

Can a VAT number be valid one day and invalid the next?

Yes. Registrations get cancelled or change, so a number that validated in the past can later fail — which is why the check is time-stamped and, for ongoing relationships, periodically repeated.

Is format validation useless then?

No — it's a cheap first gate that rejects typos instantly and avoids wasting a VIES call, but it must be followed by a live check before you rely on the number.