Fighting E-Commerce VAT Fraud: New EU Compliance Obligations for Payment Service Providers

Aleksandra Bal

Aleksandra Bal is a senior product manager, EU indirect tax reporting solutions, at Vertex Inc. Email: aleksandra.bal@ vertexinc.com

The opinions expressed in this article are those of the author and do not necessarily reflect the views of any organizations with which the author is affiliated.

In this article, the author discusses new EU reporting obligations for payment service providers that are meant to provide EU states with payment data that will help them detect noncompliant foreign sellers.

In April 2016 the European Commission published its VAT action plan (COM(2016) 148 final), setting out the path to the creation of a single and fraud-proof EU VAT area. In the action plan, the commission committed to implement measures to adapt the VAT system to the digital economy and tackle the VAT gap.¹

The commission delivered on its first promise in December 2017, when the new VAT rules for e-commerce transactions were enacted. Those rules will remove some of the elements of the VAT system that increased compliance costs for businesses involved in cross-border sales of goods² and distorted competition for the benefit of non-EU sellers.³ An important feature of the new legislative framework is the involvement of online marketplaces in the VAT collection process. Although the new rules seek to close some of the loopholes allowing businesses to legally avoid VAT, they do not provide any way to tackle illegal VAT evasion on e-commerce transactions.

To prevent VAT fraud in the e-commerce sector and fulfill its commitment to reducing the VAT gap, the European Commission decided to apply a “follow the money” approach and enacted new reporting obligations for payment service providers (PSPs) that will take effect January 1, 2024. Those measures are intended to give member states detection and control instruments that will help verify whether VAT liabilities on cross-border business-to-consumer (B2C) supplies have been correctly settled. By imposing new reporting obligations on payment intermediaries, tax administrations will be able to compare payment data with other VAT-relevant information that they already possess to detect noncompliant sellers.

New VAT Rules for E-Commerce

The new rules for e-commerce transactions, commonly referred to as the e-commerce VAT package, will take effect January 1, 2021.⁴ They will have a broad impact on all EU and non-EU businesses engaged in e-commerce sales of goods in B2C settings.

A key element of the e-commerce VAT package is the provision establishing the liability of online marketplaces that facilitate some transactions. Online platforms will be deemed the supplier of goods sold to private individuals in the EU in two situations: intra-EU sales of goods made by non-EU businesses, and importation of goods up to €150.⁵ Consequently, online platforms will have to collect and pay VAT on those sales.⁶

The e-commerce VAT package extends the mini one-stop shop (MOSS) to intra-EU distance sales of goods and to all supplies of services to nontaxable customers. Under that extended MOSS, businesses will charge the customer’s country’s VAT and report it via a quarterly return to their home tax administration. The distance sales regime⁷ will be abolished, and multiple local VAT registrations will no longer be required.

Another important new measure removes the VAT exemption for importation of low-value consignments. Currently, the importation of goods of a total value not exceeding €10 (or €22, if a member state chooses) is exempt from VAT. That exemption enables EU customers to purchase third-country goods VAT free, whereas the same goods supplied in the EU are subject to tax. To keep the administrative burden on customs authorities manageable, there will be a hybrid scheme for goods imported from third countries up to a value of €150:

• Non-EU suppliers selling goods to EU nontaxable customers will be able to apply the one-stop shop (OSS) and declare and pay VAT monthly. In that case, no VAT will be due on importation.

• If the supply of goods is facilitated by a platform, the platform will be responsible for VAT remittance because it will be deemed to have purchased and sold the goods in question. The platform will be able to register for the OSS and pay VAT monthly.

• If no platform is involved and the supplier does not elect to use the OSS, the transporter of the goods (for example, the postal service) will be liable for collecting and remitting VAT.

With the e-commerce VAT package, the European Commission hopes to simplify cross-border trade, ensure fair competition for EU businesses, and reduce VAT fraud.⁸ While the package eliminates some opportunities for fraud and closes a few loopholes that cause VAT revenue loss, it does not contain any provisions to help tax administrations detect fraudulent transactions and noncompliant sellers. In its 2019 report, the European Court of Auditors concluded that although the new provisions are meant to resolve some of the framework’s weaknesses, several issues that prevent effective VAT collection have not been addressed.⁹

VAT Fraud in the E-Commerce Sector

The European Commission has estimated that EU members lose around €5 billion of VAT revenue annually on cross-border e-commerce B2C supplies of goods.¹⁰ E-commerce VAT fraud can be committed in many ways and affects both intra-EU transactions and goods shipped by third-country sellers.¹¹

Businesses selling goods online may fail to register for VAT in the country of destination because they are either unaware of the obligation to register or intend to evade VAT. The tax authorities in the destination country have limited ability to detect noncompliant businesses because the relevant transaction data is stored in another country. Even if they come across indications that a foreign seller is avoiding local VAT, they need to cooperate with other tax authorities or request the relevant payment data from payment intermediaries or online platforms involved, which may be a long and tedious process. Enforcing local rules on companies established abroad is difficult, especially if there are no cooperation agreements between the countries involved.

For the EU distance-selling regime, the supplier might not register in the state of destination if its sales exceed the threshold to avoid additional compliance obligations or to charge the country of origin’s lower VAT. The origin state has little incentive to ensure that the distance-selling regime is applied correctly because the potentially uncollected VAT belongs to another member state (which unfortunately has limited opportunities to undertake controls).

In the EU, the importation of low-value goods is exempt from VAT because the cost of handling VAT collection would outweigh the expected revenue. That exemption made sense when the volume of remote sales was low, but as the number of online sales increased, member states realized that they were voluntarily giving up a large amount of VAT revenue. Moreover, the exemption has been exploited: Non-EU sellers deliberately undervalue their shipments of goods to benefit from VAT-free imports. According to a 2016 study by Copenhagen Economics, 65 percent of consignments from non-EU countries sent through the postal channel are noncompliant, which results in a revenue loss of €1.3 billion annually.¹²

The purpose of the new compliance obligations for PSPs is to help EU states detect foreign noncompliant sellers that fail to register in the country of destination or undervalue their shipments. Making payment data available to tax administrations should allow faster and more precise risk analysis of cross-border e-commerce transactions.

New Compliance Obligations for PSPs

The new legislation will apply to PSPs defined as credit institutions, electronic money institutions, post office giro institutions, payment institutions, the European Central Bank and national central banks, and member states or regional or local authorities when not acting in their capacity as public authorities.

PSPs will have to record information on payment transactions if:

• the payer and payee are in different EU states, or the payee is outside the EU and the payer is within; and

• the total number of payments received by a payee exceeds the 25-per-quarter limit (which applies per PSP).

To determine the location of the payer and payee (and the cross-border nature of a payment transaction), some assumptions are used:

• the payer (consumer) and the payee (business) are deemed resident in the member state corresponding to the international bank account number (IBAN) or bank identifier code (BIC) of their bank accounts;

• the threshold of 25 transactions that triggers the reporting obligation should give an indication that payments were received as part of the payee’s economic activity; and

• payments for noncommercial reasons should be excluded from the scope of reporting.

A PSP must record the following information for each transaction and store it for three years:

• the BIC or any other code that unambiguously identifies the PSP;

• the name of the payee or the business;

• any VAT identification number of the payee;

• the IBAN or any other payment account number identifier that unambiguously identifies the payee’s individual payment account;

• the BIC or any other business identifier code that unambiguously identifies the PSP acting on behalf of the payee if the payee receives funds without having a payment account;

• the payee’s address in the PSP’s records;

• any executed payment transactions; and

• any executed payment refunds for payment transactions recorded based on the above entry.

PSPs must transmit that data to the member state of their establishment no later than the end of the month following the quarter the information relates to. Member states will forward that information to a central electronic system of payment information (CESOP), where it will be stored for five years. CESOP will store, aggregate, and analyze all payment data provided by EU states. It will perform some basic data-cleansing tasks and remove duplicate records.

The payment data stored in CESOP will be used by member states to verify information reported by marketplaces and other remote sellers to detect foreign suppliers that sell goods to local consumers but fail to fulfil their VAT compliance obligations. It will be available only to Eurofisc liaison officials,¹³ and only for inquiries into suspected or detected VAT fraud.

How the New Reporting Will Work

Two examples illustrate how the new measures will work:

• A consumer residing in the Netherlands orders books from a German company and uses his Dutch bank account to transfer the remuneration for the books to the seller’s German bank account.

• A consumer residing in the Netherlands orders books from a third country (Switzerland) and transfers the remuneration from his Dutch bank account to the seller’s Swiss bank account.

In the first example, the payer and payee are in two different member states, so the transaction falls within the scope of the new recordkeeping and reporting obligations. Assuming that there have been more than 25 payments in a quarter to the German company’s bank account, the Dutch bank must record its own BIC; the name, IBAN, address, and VAT identification number of the German company; payment data (transaction currency, amount, and date); and the member state of origin of the funds. The same data will be recorded by the German bank. Both the Dutch and German banks will report the same payment information to their respective national authorities, which in turn will forward it to CESOP.

The second example also falls within the scope of the new recordkeeping and reporting obligations because the payer is in an EU member state and the payee is in a non-EU country. The Dutch bank will record the same information as in the first example. However, because the Swiss bank is not subject to any recordkeeping obligations, it will record no information.

The new rules impose recordkeeping and reporting obligations on the PSPs of both the payer and the payee. In an intra-EU scenario, each payment transaction is reported from both sides. The data is then matched and adjusted in CESOP. When the seller resides in a third country, the payment information will be provided only by the payer’s PSP.

Evaluating the New Rules

Although collecting payment information and comparing it with other VAT-relevant data seems an effective way to fight VAT fraud, it is unclear whether the new measures will ensure effective VAT collection on cross-border e-commerce transactions. The provisions contain several features that undermine their efficiency and make them easy to circumvent. Further, they do not address the main causes of the slow progress in the fight against VAT fraud.

First, the recordkeeping and reporting obligations apply only to cross-border payments. The cross-border nature of a payment is determined based on the residence of the payer and payee, which in turn depends on the IBAN or BIC of the PSP processing the payment. The assumption that the payer and payee reside in the countries corresponding to the bank account used could exclude some cross-border transactions from the reporting obligations. If a foreign seller uses an account maintained by a bank in the customer’s country, the payment is seen as domestic and not covered by the new rules, which can be circumvented completely if payments for domestic transactions are processed by non-EU PSPs. The assumption that the payer and payee reside in the country of the bank account they use seems to run counter to initiatives to promote the EU as a single payment area and stimulate the cross-border use of PSPs.

Second, CESOP will provide only information that funds have been transferred from one EU state to another or to a third country. It will not mention the reason for the fund transfer, nor will it make a distinction between business-to-business (B2B) and B2C supplies. Thus, it will record financial transfers (dividends and interest), bank transfers between private individuals, and payments for B2B supplies of goods and services. It is questionable whether the broad scope is compatible with the general data protection regulation (Regulation (EU) 2016/679), which contains the principle that data collection should be limited to data that is absolutely necessary for achieving the purpose for which it is processed.

Third, the threshold of 25 payments imposes an additional compliance burden on PSPs. They will have to monitor the number of payments for a given payee, and if the threshold is exceeded, retroactively record all transactions that took place in a quarter.

The short data retention period imposes another limitation on the use of CESOP data: The system will store payment information for five years. That is much shorter than the storage period under MOSS, which is 10 years. If tax authorities carry out MOSS audits after the five-year period, they will no longer be able to use payment information to cross-check the relevant VAT data.

The new reporting obligations for PSPs are based on a data collection method tailored to account-based bank transfers. That method is less suitable for payment methods such as PayPal or credit cards, which are prominent in e-commerce transactions.¹⁴

Finally, to answer whether the new compliance obligations will help close the e-commerce VAT gap, it is useful to recall the main reasons for the lack of effectiveness in fighting
e-commerce VAT fraud:

• lack of resources for tax authorities compared with the volume of transactions to be verified;

• lack of willingness to cooperate among EU tax authorities;

• lack of cooperation between customs and tax authorities;

• absence of tools to enforce the VAT rules on remote suppliers from outside the EU; and

• lack of cooperation from big platforms and marketplaces.¹⁵

The new reporting obligations fail to address the first problem. As a result of the new compliance obligations for PSPs, tax administrations will receive a huge volume of data that will need to be processed to produce valuable insights. While CESOP will perform some basic data checks, it is still unclear whether payment information stored in the system will be compared with other sources. Because CESOP will store information on payments unrelated to e-commerce (for example, B2B supplies of goods and services), it would make sense to cross-check CESOP data with the information reported in recapitulative statements (EC sales lists) to exclude B2B transactions from further investigation. Building a central repository of payment data will not help fight e-commerce VAT fraud on its own if the lack of resources (identified by tax administrations as the main cause of the slow progress in combating VAT fraud) continues to prevent efficient use of the collected information. It is therefore important that member states deploy appropriate technology solutions allowing automatic verification and cross-checking of CESOP data with other sources.

The new measures will not solve the second, third, or fourth problems because they are meant merely to provide tax administrations with information on noncompliant businesses. Getting the right data is only the first step in the VAT collection process. The next question is how to enforce the VAT compliance obligations — that is, how to collect VAT from noncompliant remote sellers. That can be done by improving cooperation among tax administrations and focusing on joint operations, which the new rules do not address.

The e-commerce VAT package somewhat addresses the last problem. Beginning January 1, 2021, online marketplaces will be involved in VAT collection on some e-commerce transactions. That means the online platform (and not the seller) will be liable for the remittance of VAT to the tax administration. However, under the new rules, it is still possible that payments will not be received by the platform, but instead processed directly between suppliers and customers. In that case, CESOP will not identify the person responsible for VAT remittance (the platform), but will provide information on the seller, which is not responsible for collecting VAT.

Concluding Remarks

The new recordkeeping and reporting obligations for PSPs seek to provide member states with detection and control instruments to correctly assess VAT liabilities on cross-border B2C supplies. EU states will transmit payment data received from PSPs in their territories to the CESOP database, which will allow tax administrations to cross-check those payment data with VAT information they possess or obtain from other sources.

The new rules may provide tax administrations with more information on who may be liable for VAT remittance, but they will not ensure effective VAT collection because they do not address the main causes of the lack of effectiveness in the fight against e-commerce VAT fraud.

Reliance on voluntary compliance by the supplier remains the biggest problem for collecting VAT on remote supplies. Enacting legislation that will subject supplies by nonresidents to local VAT and prescribe new reporting obligations for financial intermediaries seems a relatively easy task compared with the challenge of how to collect the tax due. Therefore, there is still a long way to go before the
e-commerce VAT problem is solved.