WE BUILD Attestation Rulebook of type VAT ID

• Author(s):
  • Sierd Westerfield, Tax Administration Netherlands

Provide a contact email address and/or a link to an issue tracking system that can be used for providing feedback, e.g.:

Feedback:

• mail the author

Table of Contents

• 1 Introduction
  • 1.1 Document scope and purpose
  • 1.2 Document structure
  • 1.3 Key words
  • 1.4 Terminology
• 2 Attestation attributes and metadata
  • Chapter overview and requirements
  • 2.1 Introduction
  • 2.2 VAT-ID Attestation
  • 2.3 administrative_unit
  • 2.4 Economic Operator
  • 2.5 Legal_person
  • 2.6 Natural person
  • 2.7 Validity Period
  • 2.8 Address
  • 2.9 Economic Activity Type attributes
  • 2.10 Metadata
  • 2.11 Display
  • 2.12 Code lists
  • 2.13 Integrity rules
• 3 Attestation encoding
  • 3.1 ISO/IEC 18013-5-compliant encoding
  • 3.2 SD-JWT VC-based encoding
• 4 Attestation usage
  • 4.1 Usecases
  • 4.2 Issuing requirements
  • 4.3 Verification needs
• 5 Trust anchors
• 6 Revocation
• 7 Compliance
• 8 References
  • 8.1 List of Alternative Nomenclatures for Activity types

1 Introduction

1.1 Document scope and purpose

The VAT-ID attestation is an official document issued by a recognized authority, such as the Tax Administration, that verifies the validity of a VAT-ID. This attestation serves as proof of the company’s or administrative unit’s VAT-ID and its corresponding validity period. It contains only information directly related to the VAT-ID.

The VAT-ID attestation can be utilized by a company to substantiate its identity and ownership of the provided VAT-ID. The recipient of the attestation can trust its authenticity, eliminating the need for external verification through the VAT Information Exchange System (VIES) or the request for a physical VAT-ID Certificate.

The most practical applications of the VAT-ID attestation are within procurement processes. Both the buyer and seller provide proof of their VAT ID. This eliminates the necessity of relying on external databases to verify the validity of the VAT ID.

In tender procedures, proof of the VAT ID is required. For instance, companies seeking to participate in the WeBuild project were required to submit a VAT ID Certificate to the commission. For companies based in the Netherlands, the Tax Agency was contacted to request the proof. The Tax Agency provided the proof on paper, affixed with a stamp. The company then scanned the document and uploaded it to the commission as part of its application submission.

The VAT-ID attestation also provides information on:

• The address of the economic operator.
• The economic activities in which the economic operator engages. These activities are referenced in both NACE codes, local equivalents, and a concise description of the activity.
• The period in which the VAT-ID is valid.

The VAT-ID attestation seeks to replace the traditional paper-based proof with an attestation. The VAT-ID Attestation is expected to enhance both the efficiency and security of the process.

1.2 Document structure

• Chapter 2, which describes the attestation attributes and metadata in an encoding-independent manner.
• Chapter 3, which specifies how the attestation attributes and metadata are encoded in case the attestation complies with [ISO/IEC 18013-5] and/or [SD-JWT VC] and/or [W3C VCDM v2.0]. Each encoding SHALL be specified in a separate section, or even in a separate chapter.
• Chapter 4, which specifies attestation usage.
• Chapter 5, which defines how trust anchors for attestation verification can be obtained.
• Chapter 6, which defines attestation revocation mechanisms.
• Chapter 7, which provides compliance information.

1.3 Key words

This document uses the capitalised key words 'SHALL', 'SHOULD' and 'MAY' as specified in [RFC 2119], i.e., to indicate requirements, recommendations and options specified in this document.

In addition, 'must' (non-capitalised) is used to indicate an external constraint, i.e., a requirement that is not mandated by this document, but, for instance, by an external document. The word 'can' indicates a capability, whereas other words, such as 'will', and 'is' or 'are' are intended as statements of fact.

1.4 Terminology

This document uses the terminology specified in Annex 1 of the ARF.

2 Attestation attributes and metadata

Chapter overview and requirements

Requirements for QEAA

• An attribute as meant in Annex V point a) of the [European Digital Identity Regulation] SHALL be included (see ARB_11 in [Topic 12]). See also section 2.1.
• One or more attributes or metadata representing the set of data meant in Annex V point b) of the [European Digital Identity Regulation] SHALL be included (see ARB_13 in [Topic 12])
• One or more attributes representing the set of data meant in Annex V point c)
  of the [European Digital Identity Regulation] SHALL be included (see ARB_16 in [Topic 12]).
• One or more attributes or metadata representing the set of data meant in Annex V point e) of the [European Digital Identity Regulation] SHALL be included (see ARB_18 in [Topic 12]).
• One or more attributes or metadata representing the location meant in Annex V point h) of the [European Digital Identity Regulation] SHALL be included. This location SHALL indicate at least the URL at which a machine-readable version of the trust anchor to be used for verifying the QEAA can be found or looked up (see ARB_20 in [Topic 12]).

Requirements for PuB-EAA

• An attribute as meant in Annex VII point a) of the [European Digital Identity Regulation] SHALL be included (see ARB_11 in [Topic 12]). See also section 2.1.
• One or more attributes or metadata representing the set of data meant in Annex VII point b) of the [European Digital Identity Regulation] SHALL be included (see ARB_14 in [Topic 12]).
• One or more attributes representing the set of data meant in Annex VII point c) of the [European Digital Identity Regulation] SHALL be included (see ARB_16 in [Topic 12]).
• One or more attributes or metadata representing the set of data meant in Annex VII point e) of the [European Digital Identity Regulation] SHALL be included (see ARB_18 in [Topic 12]).
• one or more attributes or metadata representing the location meant in Annex VII point h) of the [European Digital Identity Regulation] SHALL be included. This location SHALL indicate at least the URL at which a machine-readable version of the qualified certificate that signed the PuB-EAA can be found or looked up. (see ARB_20 in [Topic 12])

2.1 Introduction

The VAT-ID attestation is an attestation provided by an authentic source such as a TAX-Administration. The attestation proves the VAT-ID of the company or administrative unit within the company and the validity period of that VAT-ID. The VAT-ID attestation only contains information directly related to the VAT-ID. The VAT-ID attestation can be used by a company to prove that the company really is the company with that number. The receiver of the attestation can trust the content and there is no need for checking the VAT-ID at VIES (VAT Information Exchange System)1 or request a (paper) VAT-ID Certificate.

The VAT-ID attestation contains some information for which the TAX-agency usually is not the authentic source. We choose to include the information because:

• it is currently on the paper certificate,
• the information might be relevant to the receiver of the attestation. Alternatively the holder should present multiple attestations at once.

Both the attributes of the address and the economic activity usually are not administered by the TAX Agency but at the business register. However the TAX-Administration might hold different addresses and have specific economic activities registered for an administrative unit in the case that an economic operator has multiple administrative units.

*According to Annex V point a) and Annex VII point a) of the [European Digital Identity Regulation] an indication, at least in a form suitable for automated processing, that the attestation has been issued as a QEAA or Pub-EAA SHALL be defined. Similarly, according to ARB_12 of [Topic 12] of Annex 2 of the ARF a similar indication SHOULD be defined for non-qualified EAA.

This document defines the attribute "VAT-ID" which SHALL either be issued as QEAA or a PuB-EAA

vat_id_attestation
├─ administrative_unit                            [1]
│   ├─ vat_id                                     [1]       (VAT-ID of the administrative unit)
│   ├─ name                                       [1]       (name of the administrative unit)
│   ├─ organisation_type                          [0]       (type of organisation in free text)
│   ├─ validity_period                            [1..n]    (period(s) for which the vat-id is valid)
│   │   ├─ start_date                             [1]       (start date of the validity period of the vat-id)
│   │   └─ end_date                               [0]       (end date of the validity period of the vat-id)
│   ├─ registered_eu_cross_border_transactions    [1]       (Boolean that describes if the VAT-ID may be used EU cross border transactions)
│   ├─ economic_operator                          [1]       (Reference to the Economic Operator that owns the VAT ID)
│   │   ├─ legal_person                           [0]       
│   │   │   ├─ legal_identifier                   [1]       
│   │   │   ├─ legal_name                         [1]       
│   │   ├─ natural_person                         [0]       
│   │   │   ├─ family_name                        [1]       
│   │   │   ├─ given_name                         [1]       
│   │   │   ├─ birth_date                         [1]       
│   │   │   ├─ birth_place                        [0]       
│   │   │   ├─ tin                                [0]       
│   │   │   └─ personal_administrative_number     [0]       
│   ├─ address                                    [0]       (the postal address registered for the administrative unit)
│   │   ├─ po_box                                 [0]  
│   │   ├─ thoroughfare                           [0]  
│   │   ├─ location_designator                    [0]  
│   │   ├─ post_code                              [0]  
│   │   ├─ post_name                              [0]  
│   │   ├─ admin_unit_l1                          [0]  
│   │   └─ admin_unit_l2                          [0]  
│   └─ economic_activity                          [0..n]    (reference to the economic operator)
│       ├─ economic_activity_nomenclature         [1]       (nomenclature used to describe the economic activity)
│       ├─ economic_activity_nomenclature_version [0]     (version of the nomenclature)
│       ├─ economic_activity_id                   [1]       (id used in the nomenclature)
│       └─ economic_activity_description.         [1..n]    (object using language:, value)
├─ issuer                                         [1]   
│   ├─ issuing_country                            [1]
│   ├─ issuing_authority                          [1]        (the organisation that issues the vat-id, this may differ from the attestation issuing organisation)
│   ├─ attestation_issuing_date                   [1]        (date on which the attestation is issued)
│   └─ attestation_issuing_organisation           [1]
└─ display                                        [1]       Items to be displayd on the card in the wallet
    ├─ title                                      [1]       Name of the card displayed in wallet (VAT-ID)
    ├─ organisation_name                          [1]       legal_name of the organisation that owns the VAT-ID
    ├─ subtitle                                   [0]       
    ├─ issuer_logo                                [0]       
    ├─ issuer_name                                [1]       issuing_organisation
    ├─ background_color                           [0]       
    └─ text_color                                 [0]       

2.2 VAT-ID Attestation

2.2.1 Mandatory attributes

2.3 administrative_unit

2.3.1 Mandatory attributes

2.3.2 Optional attributes

2.4 Economic Operator

2.4.1 Mandatory attributes

There SHALL be a reference from the Administrative Unit to the Economic Operator. However the the Economic Operator can either be a Legal Person or a Natural Person. The economic operator object SHALL be filled to one of the two, not to both.

2.4.2 Optional attributes

2.5 Legal person

2.5.1 Mandatory attributes

2.5.2 Optional attributes

If the Legal person is filled, there are no optional attributes

2.6 Natural person

2.6.1 Mandatory attributes

2.6.2 Optional attributes

2.7 Validity Period

2.7.1 Mandatory attributes

2.7.2 Optional attributes

2.8 Address

2.8.1 Mandatory attributes

No mandatory attributes

2.8.2 Optional attributes

2.9 Economic Activity Type attributes

2.9.1 Mandatory attributes

2.7.2 Optional attributes

2.10 Metadata

2.10.1 Mandatory metadata

2.10.2 Optional metadata

2.11 Display

2.11.1 Mandatory Display items

2.11.2 Optional display items

  "display": [
    {
      "name": "title",
      "locale": "en-EN",
      "label": "VAT-ID: "
    },
    {
      "name": "title",
      "locale": "nl_NL",
      "label": "BTW-Nummer: "
    }
  ]

2.12 Code lists

2.13 Integrity rules

3 Attestation encoding

3.1 ISO/IEC 18013-5-compliant encoding

Currently there is no usecase defined where proximity use of the VAT-ID attestation. For now there will be no ISO/IEC 18013-5-compliant encoding.

3.2 SD-JWT VC-based encoding

The VAT-ID attestation uses the SD-JWT VC format to allow for selective disclosure of attributes.

Verifiable Credential Type (vct): uri:eu.eudi.vat.1

3.2.1 Attribute Encoding Table

Notes:

• MUST: The claim SHALL be selectively disclosable — the holder MAY choose to disclose or withhold this claim when presenting the credential to a Relying Party.
• MUST NOT: The claim SHALL NOT be selectively disclosable — it is always present in plain text in the JWT header/payload and cannot be withheld by the holder, as it is required for credential verification and trust establishment.
• iat and exp follow RFC 7519 standard JWT claim naming conventions.

3.2.2 Status Claim

For SD-JWT VC-compliant Ownership attestations, the attestation MUST include a status claim if the technical validity period is greater than 24 hours. This claim enables Relying Parties to determine if a credential has been revoked via a status list mechanism, as specified in SD-JWT VC.

The status claim SHALL be a JSON object with the following members:

• type (string): SHALL be "status-list".
• status_list_credential (string, URI): The URI of the Status List Credential document that contains the status bitstring.
• status_list_index (integer, >= 0): The zero-based index into the status list bitstring that corresponds to this credential.
• status_purpose (string): SHALL be "revocation" for this attestation.

Example:

{
  "status": {
 "type": "status-list",
 "status_list_credential": "https://issuer.example.com/status/ownership/2025",
 "status_list_index": 456,
 "status_purpose": "revocation"
  }
}

4 Attestation usage

4.1 Usecases

The VAT_ID attestation aims to be used in two general usecases, but it could be used elsewhere. The first usecae is where the relying party requires proof that the Economic Operator has a valid VAT-ID. In the 'paper' world, the relying party would request a 'Certificate of the VAT-ID' relyably issued by the relevant Tax Authority. The Economic Operator requests the Certificate, and it will be sent to the registered address of the Economic Operator. The Certificate is printed on paper of the Tax Authority and or contains stamps, signature or other ways to proof its validity.

The second usecase is where a seller needs proof, in case of intra-communitairy business, that the buyer will pay tax in his own country and that it can sell services or goods without TAX. In the current world the seller needs to check with VIES and keep proof in its administration. The VAT-ID attestation will provide the proof, and a check with VIES is not necessary anymore.

4.2 Issuing requirements

The VAT-ID attestation may only be issued to the wallet of the organisation that holds the VAT-ID, or to the wallet of an Agent (natural or legal person) that can prove that he is allowed to act upon the holder for this service. Although many of the information in the attestation is public information, the attestation itself should be considered private. In order to issue the VAT-ID attestation to the Economic Operator itself the issuing party SHOULD: Verify the identity of the Economic Opereator and issue the VAT-ID attestation to the wallet of that Economic Operator.

If an agent wishes to receive the attestation of another economic operator, the issuing party SHOULD:

• Check the identity of the Agent
  • check if the agent has a mandate with the right scope and actors
    • the mandate is not revoked
    • the mandate is currently valid

4.3 Verification needs

The VAT-ID provides proof that the Economic Operator, registered in the attestation, is the owner of the VAT-ID. It does not prove that the party that presents the attestation also is the owner of the attestation. The VAT-ID attestion can also be issued to an Agent ( Intermediary party), if they have the right mandate to receive the attestation. However the mandate may be revoked by the owner, but the VAT-ID attestation will (likely) not be revoked. Therefore the attestation itself (even if holderbinding is active) is not proof that the presenter actually holds, or may present the attestation.

The relying party SHOULD:

• Check the status of revocation and expiry date of the attestation.

• Check the validity period in the attestation.

• Check if the Economic Operator in the Attestation is:

  • equal to the owner of the EBW (via EBWOID, PID, or other means) OR
  • has a mandate with the right scope and actors
    • the mandate is not revoked
    • the mandate is currenty valid

If the relying party does not perform all verification aspects, he MUST accept the risks involved.

The attestation SHALL be non-device-bound. The relying party SHOULD check the ownership of the VAT-ID using the method described above. Device binding might create a false sence of trustworthyness. Because the VAT-ID can be issued to an intermediary organisation, using a mandate, presenting the VAT-ID is no proof of ownership. The VAT-ID attestation will not be revoked by the issuer, when the mandate is revoked.

5 Trust anchors

Mechanisms for the provision of a trust anchor that SHALL be used for the verification of an attestation SHALL be defined in this section.

It is noted that the ARF specifies the following for QEAAs and Pub-EAAs:

To do this for [...] QEAAs the Relying Party Instance uses a trust anchor of the Provider obtained from a Trusted List. Note that the PID Provider or QEAA Provider may use an intermediate signing certificate to sign the PID or attestation, and use the trust anchor to sign the signing certificate, instead of signing the PID or attestation directly with the trust anchor.

For PuB-EAAs, the Relying Party Instance verifies a PuB-EAA by first verifying the signature of the PuB-EAA Provider over the PuB-EAA, using the PuB-EAA Provider certificate issued by a QTSP. Subsequently, the Relying Party Instance verifies the signature over this certificate, using the corresponding trust anchor from the QTSP Trusted List. Note that both the PuB-EAA Provider and the QTSP may use an intermediate signing certificate. All other things being equal, the verification of a PuB-EAA will therefore involve one or more extra certificates, compared to the verification of a PID or QEAA.

6 Revocation

The VAT-ID Attestation SHOULD preferably be issued as a longlived attestation. In order to make sure the attestation reflects the current situation, the issuer MUST have revocation in place. An issuer must revoke the attestation following an event that would render any part of the content invalid.

When the attestation is issued by a QTSP outside the Authentic Source it should receive information from the authentic source in case attributes of the attestation change at the source. If the QTSP cannot receive this information, the attestation MUST be shortlived.

7 Compliance

In this section explicitly state how this specific rulebook complies with the general EUDI framework, ARF, and relevant regulations

[RULEBOOK AUTHOR TO DEFINE]

8 References

8.1 List of Alternative Nomenclatures for Activity types

Generated by DUCK.AI using ChatGPT 5.1 mini

*The UK is no longer an EU member; included due to extensive historical mappings.