Attestation Rulebook for attestations of type VAT ID

Category: QEAA or PuB-EAA, as stated in attestation_legal_category

• Author(s):
  • Sierd Westerfield, Tax Administration Netherlands

Written against: ARF version 3.0.0, WE BUILD template version 1.0 (generic)

Feedback:

• mail the author

Table of contents

• 1 Introduction
  • 1.1 Document scope and purpose
  • 1.2 Document structure
  • 1.3 Key words
  • 1.4 Terminology
• 2 Compliance
  • 2.1 Compliance statement
  • 2.2 Regulatory basis
  • 2.3 Traceability
• 3 Attestation attributes
  • 3.1 Introduction
  • 3.2 Mandatory attributes
  • 3.3 Optional attributes
  • 3.4 Conditional attributes
• 4 Metadata
  • 4.1 Mandatory metadata
  • 4.2 Optional metadata
  • 4.3 Conditional metadata
  • 4.4 Code lists
  • 4.5 Integrity rules
• 5 Formats
  • 5.1 SD-JWT VC-based encoding
  • 5.2 ISO/IEC 18013-5-compliant encoding
  • 5.3 W3C Verifiable Credentials Data Model-based encoding
• 6 Protocols
  • 6.1 Issuance
  • 6.2 Presentation
• 7 Issuance
  • 7.1 Binding
  • 7.2 Issuance Policy
  • 7.3 Lifecycle management
  • 7.4 Embedded disclosure policy
• 8 Revocation
• 9 Presentation
  • 9.1 Presentation Policy
  • 9.2 Presentation modes
  • 9.3 Transactional data
  • 9.4 Use cases
• 10 Trust Framework
• 11 References
  • 11.1 List of Alternative Nomenclatures for Activity types

1 Introduction

1.1 Document scope and purpose

The VAT-ID attestation is an official document issued by a recognized authority, such as the Tax Administration, that verifies the validity of a VAT-ID. This attestation serves as proof of the company’s or administrative unit’s VAT-ID and its corresponding validity period. It contains only information directly related to the VAT-ID.

The VAT-ID attestation can be utilized by a company to substantiate its identity and ownership of the provided VAT-ID. The recipient of the attestation can trust its authenticity, eliminating the need for external verification through the VAT Information Exchange System (VIES) or the request for a physical VAT-ID Certificate.

The most practical applications of the VAT-ID attestation are within procurement processes. Both the buyer and seller provide proof of their VAT ID. This eliminates the necessity of relying on external databases to verify the validity of the VAT ID.

In tender procedures, proof of the VAT ID is required. For instance, companies seeking to participate in the WeBuild project were required to submit a VAT ID Certificate to the commission. For companies based in the Netherlands, the Tax Agency was contacted to request the proof. The Tax Agency provided the proof on paper, affixed with a stamp. The company then scanned the document and uploaded it to the commission as part of its application submission.

The VAT-ID attestation also provides information on:

• The address of the economic operator.
• The economic activities in which the economic operator engages. These activities are referenced in both NACE codes, local equivalents, and a concise description of the activity.
• The period in which the VAT-ID is valid.

The VAT-ID attestation seeks to replace the traditional paper-based proof with an attestation. The VAT-ID Attestation is expected to enhance both the efficiency and security of the process.

1.2 Document structure

This Rulebook follows the generic WE BUILD attestation rulebook template. Chapter 2 states how it complies with the ARF and the applicable Regulations. Chapters 3 and 4 define the attributes and metadata in an encoding-independent manner. Chapter 5 states the formats in which this attestation is issued. Chapters 6 to 9 cover protocols, issuance, revocation and presentation. Chapter 10 sets out the trust framework, and chapter 11 lists references.

1.3 Key words

This document uses the capitalised key words 'SHALL', 'SHOULD' and 'MAY' as specified in [RFC 2119], to indicate requirements, recommendations and options.

In addition, 'must' (non-capitalised) indicates an external constraint, a requirement not mandated by this document but by an external document. The word 'can' indicates a capability. Other words such as 'will', 'is' and 'are' are statements of fact.

1.4 Terminology

This document uses the terminology specified in Annex 1 of the ARF.

2 Compliance

2.1 Compliance statement

This Rulebook complies with the applicable requirements of Topic 12, Attestation Rulebooks, in Annex 2 of the Architecture and Reference Framework, version 3.0.0. It uses the terminology of Annex 1 of the ARF.

2.2 Regulatory basis

The VAT-ID attestation is issued as a QEAA or a PuB-EAA (section 3.1). The paragraph for the category stated in attestation_legal_category applies.

QEAA

This attestation includes the data required by Annex V of Regulation (EU) 2024/1183, points a, b, c, e and h, satisfying EW-DM-12-014, EW-DM-12-016, EW-DM-12-019, EW-DM-12-021 and EW-DM-12-023 respectively. It is issued by a qualified trust service provider.

PuB-EAA

This attestation includes the data required by Annex VII of Regulation (EU) 2024/1183, points a, b, c, e and h, satisfying EW-DM-12-014, EW-DM-12-017, EW-DM-12-019, EW-DM-12-021 and EW-DM-12-023 respectively. It is issued by or on behalf of a public sector body responsible for an authentic source.

2.3 Traceability

Every applicable requirement mapped to the section that satisfies it. Requirements marked not applicable carry a stated reason.

3 Attestation attributes

Attributes are defined here in an encoding-independent manner (EW-DM-12-007). The encoding of each attribute is given in chapter 5.

3.1 Introduction

The VAT-ID attestation is an attestation provided by an authentic source such as a TAX-Administration. The attestation proves the VAT-ID of the company or administrative unit within the company and the validity period of that VAT-ID. The VAT-ID attestation only contains information directly related to the VAT-ID. The VAT-ID attestation can be used by a company to prove that the company really is the company with that number. The receiver of the attestation can trust the content and there is no need for checking the VAT-ID at VIES (VAT Information Exchange System)1 or request a (paper) VAT-ID Certificate.

The VAT-ID attestation contains some information for which the TAX-agency usually is not the authentic source. We choose to include the information because:

• it is currently on the paper certificate,
• the information might be relevant to the receiver of the attestation. Alternatively the holder should present multiple attestations at once.

Both the attributes of the address and the economic activity usually are not administered by the TAX Agency but at the business register. However the TAX-Administration might hold different addresses and have specific economic activities registered for an administrative unit in the case that an economic operator has multiple administrative units.

*According to Annex V point a) and Annex VII point a) of the [European Digital Identity Regulation] an indication, at least in a form suitable for automated processing, that the attestation has been issued as a QEAA or Pub-EAA SHALL be defined. Similarly, according to ARB_12 of [Topic 12] of Annex 2 of the ARF a similar indication SHOULD be defined for non-qualified EAA.

This document defines the attribute "VAT-ID" which SHALL either be issued as QEAA or a PuB-EAA

vat_id_attestation
├─ administrative_unit                            [1]
│   ├─ vat_id                                     [1]       (VAT-ID of the administrative unit)
│   ├─ name                                       [1]       (name of the administrative unit)
│   ├─ organisation_type                          [0]       (type of organisation in free text)
│   ├─ validity_period                            [1..n]    (period(s) for which the vat-id is valid)
│   │   ├─ start_date                             [1]       (start date of the validity period of the vat-id)
│   │   └─ end_date                               [0]       (end date of the validity period of the vat-id)
│   ├─ registered_eu_cross_border_transactions    [1]       (Boolean that describes if the VAT-ID may be used EU cross border transactions)
│   ├─ economic_operator                          [1]       (Reference to the Economic Operator that owns the VAT ID)
│   │   ├─ legal_person                           [0]
│   │   │   ├─ legal_identifier                   [1]
│   │   │   ├─ legal_name                         [1]
│   │   ├─ natural_person                         [0]
│   │   │   ├─ family_name                        [1]
│   │   │   ├─ given_name                         [1]
│   │   │   ├─ birth_date                         [1]
│   │   │   ├─ birth_place                        [0]
│   │   │   ├─ tin                                [0]
│   │   │   └─ personal_administrative_number     [0]
│   ├─ address                                    [0]       (the postal address registered for the administrative unit)
│   │   ├─ po_box                                 [0]
│   │   ├─ thoroughfare                           [0]
│   │   ├─ location_designator                    [0]
│   │   ├─ post_code                              [0]
│   │   ├─ post_name                              [0]
│   │   ├─ admin_unit_l1                          [0]
│   │   └─ admin_unit_l2                          [0]
│   └─ economic_activity                          [0..n]    (reference to the economic operator)
│       ├─ economic_activity_nomenclature         [1]       (nomenclature used to describe the economic activity)
│       ├─ economic_activity_nomenclature_version [0]     (version of the nomenclature)
│       ├─ economic_activity_id                   [1]       (id used in the nomenclature)
│       └─ economic_activity_description.         [1..n]    (object using language:, value)
└─ issuer                                         [1]   
    ├─ issuing_country                            [1]
    ├─ issuing_authority                          [1]        (the organisation that issues the vat-id, this may differ from the attestation issuing organisation)
    ├─ attestation_issuing_date                   [1]        (date on which the attestation is issued)
    └─ attestation_issuing_organisation           [1]

3.2 Mandatory attributes

Mandatory attributes are stated per object of the data model in section 3.1.

3.2.1 VAT-ID Attestation

3.2.2 administrative_unit

3.2.3 Economic Operator

There SHALL be a reference from the Administrative Unit to the Economic Operator. However the the Economic Operator can either be a Legal Person or a Natural Person. The economic operator object SHALL be filled to one of the two, not to both.

3.2.4 Legal person

3.2.5 Natural person

3.2.6 Validity Period

3.2.7 Address

No mandatory attributes

3.2.8 Economic Activity Type attributes

3.3 Optional attributes

Optional attributes are stated per object of the data model in section 3.1.

3.3.1 administrative_unit

3.3.2 Economic Operator

3.3.3 Legal person

If the Legal person is filled, there are no optional attributes

3.3.4 Natural person

3.3.5 Validity Period

3.3.6 Address

3.3.7 Economic Activity Type attributes

3.4 Conditional attributes

No conditional attributes are defined for this attestation type.

4 Metadata

Metadata describes the attestation rather than its subject.

4.1 Mandatory metadata

Legal category. This Rulebook retains the attestation_legal_category attribute. Section 4.1 of the generic template replaces it with the category attribute of [ETSI TS 119 472-1]. EW-DM-12-029, legacy ARB_25, of ARF version 3.0.0 is a SHALL that still requires the legal category attribute, so the template and the ARF disagree. The attribute is left as written and the deviation is recorded for the rulebook quality assurance group.

4.2 Optional metadata

4.3 Conditional metadata

No conditional metadata are defined for this attestation type.

4.4 Code lists

4.5 Integrity rules

5 Formats

5.1 SD-JWT VC-based encoding

The VAT-ID attestation uses the SD-JWT VC format to allow for selective disclosure of attributes.

Verifiable Credential Type (vct): uri:eu.eudi.vat.1

5.1.1 Attribute Encoding Table

Notes:

• MUST: The claim SHALL be selectively disclosable, the holder MAY choose to disclose or withhold this claim when presenting the credential to a Relying Party.
• MUST NOT: The claim SHALL NOT be selectively disclosable, it is always present in plain text in the JWT header/payload and cannot be withheld by the holder, as it is required for credential verification and trust establishment.
• iat and exp follow RFC 7519 standard JWT claim naming conventions.

5.1.2 Status Claim

The revocable attestation (SD-JWT VC per HAIP [7]) carries the status reference in its signed payload. The claim is not selectively disclosable.

{
  "status": {
    "status_list": {
      "idx": 422,
      "uri": "https://status-provider.example.com/statuslists/1"
    }
  }
}

• uri — the Status Provider's URI from which the Status List Token can be retrieved
• idx — the index of this attestation's entry within the status list, assigned per ISS-RV-03

5.2 ISO/IEC 18013-5-compliant encoding

Currently there is no usecase defined where proximity use of the VAT-ID attestation. For now there will be no ISO/IEC 18013-5-compliant encoding.

5.3 W3C Verifiable Credentials Data Model-based encoding

This Rulebook does not define a W3C Verifiable Credentials Data Model encoding; the format is not permitted for a QEAA or PuB-EAA.

6 Protocols

6.1 Issuance

This attestation is issued using OpenID for Verifiable Credential Issuance [OpenID4VCI], as profiled by [HAIP].

6.2 Presentation

This attestation is presented using OpenID for Verifiable Presentations [OpenID4VP]. Only remote presentation is in scope, consistent with chapter 5, which records the mdoc encoding as out of scope.

7 Issuance

7.1 Binding

The attestation SHALL be non-device-bound. The relying party SHOULD check the ownership of the VAT-ID using the method described above. Device binding might create a false sence of trustworthyness. Because the VAT-ID can be issued to an intermediary organisation, using a mandate, presenting the VAT-ID is no proof of ownership. The VAT-ID attestation will not be revoked by the issuer, when the mandate is revoked.

7.2 Issuance Policy

General obligations on Attestation Providers are out of scope of this Rulebook. They are specified in Topic 10 of Annex 2 of the ARF, in the applicable Implementing Regulations, and in [ETSI TS 119 471]. This Rulebook states only obligations specific to this attestation type.

The VAT-ID attestation may only be issued to the wallet of the organisation that holds the VAT-ID, or to the wallet of an Agent (natural or legal person) that can prove that he is allowed to act upon the holder for this service. Although many of the information in the attestation is public information, the attestation itself should be considered private. In order to issue the VAT-ID attestation to the Economic Operator itself the issuing party SHOULD: Verify the identity of the Economic Opereator and issue the VAT-ID attestation to the wallet of that Economic Operator.

If an agent wishes to receive the attestation of another economic operator, the issuing party SHOULD:

• Check the identity of the Agent
  • check if the agent has a mandate with the right scope and actors
    • the mandate is not revoked
    • the mandate is currently valid

7.3 Lifecycle management

The issuer sets the validity period of the attestation and reissues it when the underlying facts change, revoking the superseded attestation as described in chapter 8.

7.4 Embedded disclosure policy

This attestation defines no embedded disclosure policy.

8 Revocation

The VAT-ID Attestation SHOULD preferably be issued as a longlived attestation. In order to make sure the attestation reflects the current situation, the issuer MUST have revocation in place. An issuer must revoke the attestation following an event that would render any part of the content invalid.

When the attestation is issued by a QTSP outside the Authentic Source it should receive information from the authentic source in case attributes of the attestation change at the source. If the QTSP cannot receive this information, the attestation MUST be shortlived.

9 Presentation

9.1 Presentation Policy

To verify and validate a received presentation of an attestation of this type, the following steps SHALL be performed:

1. verify the signature over the attestation using a trust anchor obtained as described in chapter 10;
2. verify that the attestation is within its validity period;
3. check revocation status as described in chapter 8, unless the attestation is short-lived, or its remaining lifetime is below the revocation time threshold;
4. verify device binding where section 7.1 records the attestation as device-bound;
5. request only those attributes that are necessary for the stated purpose of the transaction, and, where the trust model for this attestation requires Relying Party registration, only those attributes it is registered and authorised to request.

Obligations specific to this attestation type, carried over from the previous version of this Rulebook:

The VAT-ID provides proof that the Economic Operator, registered in the attestation, is the owner of the VAT-ID. It does not prove that the party that presents the attestation also is the owner of the attestation. The VAT-ID attestion can also be issued to an Agent ( Intermediary party), if they have the right mandate to receive the attestation. However the mandate may be revoked by the owner, but the VAT-ID attestation will (likely) not be revoked. Therefore the attestation itself (even if holderbinding is active) is not proof that the presenter actually holds, or may present the attestation.

The relying party SHOULD:

• Check the status of revocation and expiry date of the attestation.

• Check the validity period in the attestation.

• Check if the Economic Operator in the Attestation is:

  • equal to the owner of the EBW (via EBWOID, PID, or other means) OR
  • has a mandate with the right scope and actors
    • the mandate is not revoked
    • the mandate is currenty valid

If the relying party does not perform all verification aspects, he MUST accept the risks involved.

9.2 Presentation modes

Remote presentation is in scope. Proximity presentation is not in scope, consistent with chapter 5, which records that no mdoc encoding is defined.

9.3 Transactional data

This Rulebook defines no transactional data.

9.4 Use cases

The VAT_ID attestation aims to be used in two general usecases, but it could be used elsewhere. The first usecae is where the relying party requires proof that the Economic Operator has a valid VAT-ID. In the 'paper' world, the relying party would request a 'Certificate of the VAT-ID' relyably issued by the relevant Tax Authority. The Economic Operator requests the Certificate, and it will be sent to the registered address of the Economic Operator. The Certificate is printed on paper of the Tax Authority and or contains stamps, signature or other ways to proof its validity.

The second usecase is where a seller needs proof, in case of intra-communitairy business, that the buyer will pay tax in his own country and that it can sell services or goods without TAX. In the current world the seller needs to check with VIES and keep proof in its administration. The VAT-ID attestation will provide the proof, and a check with VIES is not necessary anymore.

10 Trust Framework

The trust anchor is obtained as described in the branch below that corresponds to the legal category under which the attestation was issued.

PID, QEAA, PuB-EAA and attestations resolved via Trusted Lists

The trust anchor is obtained from a Trusted List, as described in section 6.6.3.6 of the ARF main document. The Provider may sign the attestation with an intermediate signing certificate, in which case the trust anchor is used to verify that certificate rather than the attestation directly.

Trust anchor location

The attribute or metadata carrying the trust anchor location contains at least the URL at which a machine-readable version can be found or looked up.

11 References

11.1 List of Alternative Nomenclatures for Activity types

Generated by DUCK.AI using ChatGPT 5.1 mini

*The UK is no longer an EU member; included due to extensive historical mappings.