VAT ID verification for Shopify B2B: how VIES works and why the consultation ID matters

VAT ID verification is the process of confirming that a customer's VAT identification number is currently registered with the tax administration of an EU member state — not merely that it looks like one. For a Shopify store selling wholesale, that distinction decides whether a B2B applicant is a real, registered business or a plausible-looking string of characters. The EU's official lookup service is VIES, and one detail of a VIES check — the consultation ID — matters far more than most merchants realise.

What a VAT ID is (and what it is not)

Every business registered for VAT in the EU receives a VAT identification number: a two-letter country prefix followed by a country-specific pattern of digits and letters — DE123456789 for Germany, FR12345678901 for France, NL123456789B01 for the Netherlands. The number identifies the business for cross-border VAT purposes, and it is the key that unlocks the most common B2B tax treatment in Europe: an intra-Community supply, where the seller can zero-rate the invoice and the buyer self-accounts for VAT in their own country.

That tax treatment is exactly why verification matters. If the buyer's VAT ID turns out to be invalid, expired or someone else's, the tax office can come back to the seller for the VAT that was never charged. A VAT ID on an application form is a claim; verification turns it into evidence.

How a VIES lookup actually works

VIES — the VAT Information Exchange System, run by the European Commission — is often described as a database, but it is not one. It is a relay: when you query a VAT number, VIES forwards the request in real time to the national VAT registry of the member state in the country prefix and returns that registry's answer. There is no central copy of the data, which has two practical consequences:

• The answer is authoritative. A "valid" response comes from the member state's own registry at the moment you asked, not from a cached mirror.
• Availability is only as good as 27 national systems. If one member state's registry is down for maintenance — which happens routinely, often overnight — VIES cannot answer for that country, no matter how healthy the rest of the system is.

Simple vs. qualified confirmation

Tax practice distinguishes two levels of confirmation. A simple confirmation answers one question: is this VAT number valid right now? A qualified confirmation goes further: it also returns (or checks) the name and address registered to the number, so you can confirm the VAT ID actually belongs to the business that applied — not to some unrelated company whose number was copied off an invoice.

German merchants know this distinction from national law: the confirmation procedure for foreign VAT IDs is anchored in § 18e of the German VAT Act (UStG), under which the Federal Central Tax Office (BZSt) confirms the validity of another member state's VAT ID and, on request, the registered name and address. Whichever route you use — the BZSt procedure or VIES directly — the principle is the same: for audit purposes, a qualified, documented check is worth far more than a quick validity ping. For a wholesale application, always compare the registered name against the company name the applicant typed into your form.

The consultation ID: proof you actually checked

Here is the detail that separates a serious verification setup from a casual one. When you query VIES and identify yourself with your own VAT number as the requester, VIES issues a consultation ID (a request identifier such as WAPIAAAAY…). That ID is the official, legally recognised record that a specific check on a specific number took place at a specific time.

Why it matters: tax audits happen years after the sale. If an auditor questions a zero-rated B2B invoice from three years ago, "we checked the VAT ID at the time" is an assertion — a stored consultation ID is proof. The buyer's number may have been deregistered since; the consultation ID pins your good faith to the date of the check. A verification process that throws this identifier away is doing the work and discarding the receipt.

Two practical notes: VIES only issues a consultation ID when the requester supplies their own member state and VAT number with the query, and the ID should be stored with the application it belongs to, not in a log file that rotates away. Anmelda does both by default — every VIES check runs with a requester identity and the consultation ID is stored on the application record, so the proof is still there when the audit letter arrives.

Format check vs. registry check

A surprising number of "VAT validation" tools only check the format: the right country prefix, the right number of characters, sometimes a checksum. A format check is useful as a first gate — it catches typos instantly, before any network call — but it verifies nothing about the real world. DE123456789 is perfectly formatted and almost certainly not a registered business.

A robust pipeline does both, in order: validate the format locally (instant feedback, no wasted lookups), then confirm against the registry (the actual verification). Treat any tool that stops at step one as a typo filter, not a verification.

How often should you re-check?

Validity is a snapshot: a VAT number that was registered in January can be deregistered by June — businesses close, merge and lose their registration. A pragmatic cadence is to verify at application time (always, with the consultation ID stored) and to re-verify before events that matter: a large first order, reactivating a dormant wholesale account, or a periodic review of your active B2B customers. Each re-check earns its own consultation ID, extending the documented chain of good faith rather than leaving it anchored to a single date years in the past.

When VIES is down — and it will be

Because VIES relays to national registries, downtime is a normal operating condition, not an exception. The service publishes explicit error codes for it: MS_UNAVAILABLE (the member state's registry is offline), MS_MAX_CONCURRENT_REQ and GLOBAL_MAX_CONCURRENT_REQ (load limits), SERVICE_UNAVAILABLE and TIMEOUT. Member-state registries are routinely taken offline for nightly maintenance windows.

The critical design decision: these codes mean "try again later", never "this VAT number is invalid". A workflow that shows a wholesale applicant as "failed verification" because the Spanish registry was down at 2 a.m. will reject legitimate buyers and poison your approval data. The correct behaviour is to queue the check and retry automatically until the registry answers — which is how Anmelda's verification engine treats every one of those codes, distinguishing "the source said no" from "the source didn't answer".

Beyond the EU: Switzerland and the UK

European wholesale rarely stops at the EU border, and neither should verification. Switzerland and the UK each have an official, queryable register:

The pattern is the same in all three: an official register, a structured identifier, and an answer worth storing. What differs is what is confirmed — VIES confirms VAT registration, Zefix and Companies House confirm corporate existence and status. For Swiss and UK applicants, register status is your equivalent of the VIES check.

Putting it into a Shopify wholesale workflow

Verification is one stage of a longer funnel: a buyer applies, the registers are checked, a human (or a rule) approves, and the buyer becomes a native Shopify B2B company with the right catalog and terms. We walk through the full funnel in our guide to the wholesale application workflow, and compare provisioning approaches in native B2B vs. tag-based workarounds.

The short version of what good looks like: format-check instantly, registry-check automatically on submission, retry through downtime instead of failing applicants, compare the registered name against the application, and store the consultation ID with the application record. That is precisely the pipeline Anmelda ships for Shopify — VIES, Zefix and Companies House checks queued on submission, with the consultation ID kept as audit-ready proof.