Tax ID / VAT Number: Data Point Intelligence Guide

A tax number is the identifier the state actually uses to track economic activity, which makes it a far better join key than a company name and a far more sensitive one for individuals.

Understanding the Tax ID / VAT Number as an intelligence artifact

A tax identification number is a registration issued by a revenue authority to a person or entity for tax purposes. The family includes the US EIN and TIN, EU VAT registration numbers, the UK UTR and VAT number, Brazilian CNPJ and CPF, Indian PAN and GSTIN, and many national equivalents. Formats are jurisdiction-specific and usually structured, with country prefixes on EU VAT numbers, embedded regional or entity-type codes in several national schemes, and check digits that allow offline validation.

The critical distinction is whether the number identifies an entity or a natural person. Entity numbers such as VAT registrations and EINs are routinely published on invoices, filings and websites and are effectively public business identifiers. Personal tax numbers are sensitive PII with the same handling profile as national ID numbers. Registration status is also dynamic: numbers are issued, suspended and deregistered, and validation services usually confirm only the current state.

Why it matters

Tax numbers are the connective tissue of financial investigation. A VAT number links invoices, customs declarations, trade data and corporate filings to one registered entity, which is why VAT fraud investigations are built on them. In due diligence, a valid and active registration is evidence of genuine economic substance, while an invalid or deregistered number on a live invoice is a strong indicator of a fraudulent or dormant counterparty. Numbers also bridge cleanly into company registry and sanctions data.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Structural validity and check digits, which allow immediate offline rejection of fabricated numbers on invoices and documents.
Current registration status, where a deregistered or suspended number on an active invoice is a serious counterparty red flag.
Name and address returned by an official validation service versus the name and address the counterparty presented to you.
Registration date relative to the transactions in question, since a very recent registration is common in carousel-type fraud.
Embedded regional or entity-type codes that reveal the registering office or the legal form of the registrant.
Multiple tax registrations across jurisdictions for one group, mapping where it genuinely conducts taxable activity.
Appearance in sanctions listings, where tax numbers are published as identifiers alongside registration and passport numbers.
Mismatch between the tax number's jurisdiction and the stated place of incorporation, banking or delivery.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

EU VIES — Official European Commission service validating VAT numbers and returning registered name and address
HMRC VAT number checker — UK official validation confirming registration status and registered business details
IRS Tax Exempt Organization Search — US nonprofit records keyed to EIN with filings, status and revocation history
SEC EDGAR — US filings that disclose registrant EINs, linking the tax identifier to full disclosure documents
National tax authority portals — Jurisdiction-specific registration lookups such as Brazil's CNPJ and India's GSTIN verification services
OpenCorporates — Cross-reference from tax identifiers to company registration records and officer data where published
OFAC and EU sanctions lists — Designation records that publish tax and registration numbers as entity identifiers
GLEIF — Entity reference data bridging tax registration to LEI and home registry identifiers

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Classify entity versus personal — Determine immediately whether the number identifies a business or a natural person, because the handling obligations diverge sharply.
Validate structure offline — Apply the jurisdiction's format and check-digit rules locally before any external query, filtering out transcription errors and fabrications.
Confirm through the official service — Use the revenue authority's own validation endpoint, which is authoritative, and record the response and timestamp as evidence.
Compare returned identity — Check the officially registered name and address against what the counterparty supplied, treating any divergence as a material discrepancy.
Bridge to the company registry — Pivot from the validated tax registration to national company registry records for officers, ownership, filing history and current entity status.
Screen for exposure — Match the number and the resolved entity against sanctions and enforcement lists, which publish tax identifiers directly.
Retain the evidence of check — Store the validation reference and date, since many compliance regimes require proof that verification was actually performed.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Pivots to these data points

Company / Organization — A legal entity — corporation, LLC, NGO, or business.
Patent — An intellectual property filing granting invention rights.
Legal Entity Identifier — A 20-character global identifier for a legal entity participating in financial transactions.
Corporate Filing — A regulatory or corporate filing (SEC, Companies House, court).

Inside the platform: where Tax ID / VAT Number lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

datapoint.php?dp=dp_tax_id — Data point hub
search.php — Advanced search, filter and pivot
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Enrichment Runner
Enrichment → Local
Correlate Infrastructure
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Classify entity versus personal is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Confirm through the official service turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Retain the evidence of check feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Tax ID / VAT Number

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Defence procurement uses tax registrations to test whether a supplier is a real trading entity with fiscal substance rather than a paper vehicle assembled for one contract. An active VAT registration validated against the revenue authority's own service, matching the name and address supplied, is cheap and strong evidence of substance; an invalid or deregistered number on a live invoice is a serious finding. In deployed environments the same check applies to local contractors and logistics providers. Constraints are handling: business registrations are quasi-public identifiers designed for disclosure, whereas personal tax numbers encountered in personnel or local national files carry the same sensitivity as national identity numbers and must be segregated accordingly.

🕵 National intelligence

Tax identifiers link entities across customs declarations, trade data, corporate filings and financial records without name matching, which makes them a high-value join key in financial and proliferation analysis. Requirements-driven use includes tracing procurement networks that move controlled goods through intermediaries, identifying missing-trader structures, and connecting a front company to its declared fiscal identity in a jurisdiction of interest. Sanctions listings publish tax numbers in identifier blocks precisely because they defeat transliteration ambiguity. Handling divides sharply: entity numbers can be processed routinely, while personal tax numbers require the same authority, minimisation and access control as any other government-issued personal identifier.

👮 Law enforcement

In law enforcement, tax registrations are evidence and investigative leads at once. VAT fraud, missing-trader and carousel cases are built directly on registration status, chains of invoices and the mismatch between declared and actual trade. Validation responses from an official service, captured with a timestamp, evidence what a counterparty could have known at a point in time, which is central to proving knowledge in fraud cases. Access to underlying tax records requires specific legal process and often a dedicated gateway, since revenue data is protected by taxpayer confidentiality statutes in most jurisdictions. Personal tax numbers in a case file demand the same handling controls as national identity numbers.

🔍 Private investigation and corporate security

Corporate investigators use tax numbers for counterparty verification, invoice fraud detection and supply chain due diligence. Validating a VAT number through the official service and comparing the returned registered name and address against what the counterparty supplied catches a large share of invoice redirection and shell counterparty fraud for almost no cost, and the validation reference is retainable evidence that the check was performed. Limits are firm: query official services only for a legitimate business purpose and within their terms, never attempt to obtain protected tax records, and treat any personal tax number encountered in disclosure or KYC material as sensitive PII with restricted access and a deletion schedule.

📰 Journalism and OSINT media

For journalists, business tax registrations are a verification tool that turns a claimed company into a fiscal identity with an official registered name and address. That is useful when a story concerns invoicing structures, procurement or entities with similar names, and the validation is free and reproducible by any reader. Never publish personal tax numbers, which enable identity theft and tax fraud and are protected in many jurisdictions. Be precise about what validation proves: an active registration confirms fiscal registration status, not that the entity trades honestly, and a deregistered number confirms status at the date checked rather than at the date of the transaction under scrutiny.

🌍 NGO, humanitarian and human rights

Accountability and anti-corruption work uses tax registration data to test whether contractors awarded public money are real trading entities and to link entities across procurement and customs records. In tax justice work, the identifiers connect corporate structures to fiscal jurisdictions and to declared activity. Because business registrations are designed for public disclosure on invoices and filings, this research carries little risk. Personal tax numbers are different and should never be collected, held or published in beneficiary or witness records unless strictly necessary, because their exposure creates identity theft risk that falls on people least equipped to remediate it.

🎓 University and research

Tax identifiers support research on trade, tax compliance, procurement integrity and firm-level economics, usually as the linking key between customs, corporate and administrative datasets. Access to administrative tax microdata is normally through a secure research facility with disclosure control, an approved protocol and output checking, and researchers never receive raw personal identifiers. Where analysis uses public business registrations, document the validation method and query date, since registration status changes. Publish linkage rates and validation failure rates, and state explicitly how personal and entity identifiers were separated in the data model, since conflating them is both an analytic and an ethical failure.

Playbook: working Tax ID / VAT Number end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Classify entity versus personal immediately

Determine at first sight whether the identifier belongs to a business or a natural person, because the handling obligations diverge sharply and the decision governs every subsequent step. VAT registrations and employer identification numbers are quasi-public and appear on invoices and filings; personal tax numbers are sensitive PII with identity theft consequences. A good output is a typed record with the class recorded. Stop and apply the restricted personal identifier workflow, including lawful basis and access control, before a personal number enters any system.

Phase 2 — Identify the scheme and jurisdiction

Establish which national scheme the string conforms to from its prefix, length, character set and separator convention rather than from the nationality claimed in the file. EU VAT numbers carry a country prefix; several national schemes encode entity type or region. A good output is a recorded scheme identification with the reasoning. Where the string matches no published scheme, treat it as an internal reference or a fabrication and record that finding rather than proceeding to validate it against an unrelated service.

Phase 3 — Validate structure offline

Apply the jurisdiction's format rules and check digit algorithm locally before any external query, which filters transcription errors and obvious fabrications instantly and without disclosing anything. Many schemes publish their algorithm, and several use ISO/IEC 7064 variants. A good output is a validation result recorded with the algorithm used. Note where a scheme has no check digit, because that absence changes how much weight structural validation can carry and should be stated rather than assumed.

Phase 4 — Confirm through the official service

Use the revenue authority's own validation endpoint, which is authoritative and usually free, and record the response, the reference where one is issued, and the timestamp. Third-party validators are convenient but are not the authority and may cache stale results. A good output is a retained validation record that evidences the check was performed on a specific date. Respect the service's usage terms, since bulk automated querying beyond stated limits is a breach and can result in blocking.

Phase 5 — Compare the returned identity

Check the officially registered name and address returned by the validation service against what the counterparty supplied on its invoice, contract or onboarding form, and treat any divergence as a material discrepancy requiring explanation. This single comparison catches a large proportion of invoice redirection and shell counterparty fraud. A good output is a documented comparison with the discrepancy described precisely. Stop and escalate before payment where the registered entity is not the entity you believe you are dealing with.

Phase 6 — Check registration status and history

Establish whether the registration is currently active, suspended or deregistered, and where the service exposes it, when the status changed. A number that was valid at contract signature and deregistered before invoicing is a specific and common fraud pattern. A good output is a status record with dates and the check date. Note that most services confirm only the current state, so evidencing status at a past date usually requires the validation record you captured at the time, which is why retention matters.

Phase 7 — Bridge to the company registry

Pivot from the validated tax registration to the national company registry record for officers, ownership, filing history, accounts and current entity status. The tax registration confirms fiscal identity; the registry supplies the corporate picture. A good output is a linked registry record with its own retrieval date. Where the tax registration exists but the registry shows a dissolved or dormant entity, the mismatch is a finding that deserves explicit reporting rather than quiet reconciliation.

Phase 8 — Test economic substance

Combine the validated registration with evidence of real activity: premises, employees, trade and customs records, procurement history, professional licences, web presence and its age, and filed accounts. A valid registration is necessary but not sufficient evidence of substance, since registrations are obtainable by entities with no operations. A good output is a substance assessment listing each indicator and its source. This is what distinguishes a compliance checkbox from an actual counterparty risk judgement.

Phase 9 — Screen for designation and enforcement

Match the number and the resolved entity against sanctions, enforcement and debarment sources, since designation lists publish tax identifiers directly in identifier blocks and an exact identifier match is far stronger than a transliterated name match. A good output is a screening record with list versions and dates. Route any hit to compliance and counsel immediately, because sanctions consequences attach independently of your commercial or investigative conclusion.

Phase 10 — Trace across trade and customs data

Where available, use the identifier to join customs declarations, trade statistics and procurement records, which is how VAT fraud, transhipment and export control circumvention become visible. Chains of invoices between entities sharing officers or addresses, with goods that never move, are the classic missing-trader pattern. A good output is a transaction network keyed on validated identifiers rather than on names, with the data source recorded per edge.

Phase 11 — Segregate and control personal numbers

Where personal tax numbers must be held, store them separately from business identifiers, encrypt at rest, tokenise for joining, restrict access to named roles, log every read and apply a deletion schedule tied to the documented purpose. Never use them to enrich unrelated datasets or to re-identify individuals outside the authorised purpose. A good output is an analytic dataset containing no cleartext personal tax numbers that still supports the joins the investigation requires.

Phase 12 — Retain the evidence of check

Store the validation reference, the response content and the date, because many compliance regimes require proof that verification was actually performed rather than an assertion that it was. Retention also preserves the ability to evidence what the register said at the time of a transaction, which is central to demonstrating good faith. A good output is a verification record attached to the counterparty file and to the specific transaction it supported, retained for the regime's required period.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
EU VIES	Open	Official European Commission service validating VAT numbers across member states and returning registered name and address.	Authoritative confirmation that an EU VAT registration is active and matches the counterparty's claimed identity.
HMRC VAT number checker	Open	UK official service confirming VAT registration status and returning the registered business name and address.	Authoritative UK validation producing a retainable reference evidencing the check was performed.
IRS Tax Exempt Organization Search	Open	US records of exempt organisations keyed to employer identification number with filings, status and revocation history.	Verifies US nonprofit status and exposes revocations, with links to annual information returns.
SEC EDGAR	Open	US registrant filings that disclose employer identification numbers, linking the tax identifier to full disclosure documents.	Bridges from an EIN to detailed corporate disclosure, subsidiaries and related party information.
Receita Federal CNPJ services	Open	Brazilian federal revenue services validating corporate taxpayer registrations and returning registered activity and status.	Confirms Brazilian entity registration, economic activity codes and current fiscal status.
Indian GST and PAN verification services	Open	Official Indian services confirming goods and services tax registration status and taxpayer identity for entities.	Validates Indian business registrations and links them to registered address and constitution.
OpenCorporates	Registration	Cross-jurisdiction company records, several of which include tax registration identifiers alongside registry numbers.	Bridges a validated tax registration to a company record where the registries publish both identifiers.
OFAC Sanctions List Search	Open	US designations with structured identifier blocks that frequently include tax identification and registration numbers.	Exact identifier screening that defeats the transliteration ambiguity affecting name-based matching.
EU and UK consolidated sanctions lists	Open	European and UK designations with entity identifiers, registration numbers and addresses for listed entities.	Jurisdiction-specific identifier screening for entities in scope of European and UK regimes.
GLEIF	Open	Openly licensed legal entity reference data with home registry identifiers and group relationship records.	Cross-references a fiscal identity to a verified legal entity and its consolidated group structure.
UN Comtrade	Open	International trade statistics by reporter, partner and commodity, used to test whether claimed trade flows are plausible.	Corroborates or contradicts claimed trading activity underlying a VAT registration at aggregate level.
OECD tax transparency resources	Open	International standards and country reporting on exchange of tax information, taxpayer identification and transparency.	Context for how taxpayer identification numbers function internationally and what exchange regimes exist.
Europol and national fraud authority reporting	Open	Law enforcement analysis of VAT fraud typologies including missing trader and carousel structures.	Reference typologies for recognising the invoice and registration patterns characteristic of VAT fraud.
National tax authority portals	Open	Jurisdiction-specific registration lookups, taxpayer status services and published guidance on identifier formats.	The authoritative validation source for each national scheme, which third-party checkers only proxy.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Tax ID / VAT Number. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

Offline format and check digit validator — Applies jurisdiction-specific structure rules locally before any query. Limitation: several schemes have no check digit, so structural validation proves little.
VIES and national validation clients — Query official services and capture the response and reference as evidence. Limitation: rate limits and downtime make bulk validation unreliable at scale.
Counterparty onboarding platform — Enforces validation at onboarding and retains the evidence of check. Limitation: value collapses if revalidation is never performed after onboarding.
Invoice matching and fraud detection — Compares supplier registration and bank details against the validated record before payment. Limitation: only catches changes it is configured to compare.
Entity resolution platform — Joins trade, procurement and corporate data on validated identifiers rather than names. Limitation: a single upstream error propagates as a confident false merge.
Tokenisation and vault — Separates personal tax numbers from analytic data while preserving joins. Limitation: only effective if analysts have a tokenised join faster than the workaround.
Customs and trade data platforms — Surface shipment records associable with registered traders for substance testing. Limitation: coverage and identifier availability vary greatly by country.
Sanctions screening engine — Matches identifiers against designation lists with versioned snapshots. Limitation: identifier fields in list data are inconsistently populated and formatted.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Enrichment Runner — Walks the indicator set through a chosen provider in time-boxed, cursor-based batches that resume rather than restart.
Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Classify entity versus personal before anything else. A VAT number is a public business identifier printed on every invoice; a personal tax number is sensitive PII with identity theft consequences, and treating them under one policy fails in both directions at once.
Validation confirms registration, not honesty. An active VAT number tells you the entity is fiscally registered and matches a name and address; it says nothing about whether the goods exist, the trade is real or the counterparty intends to pay tax.
The name and address comparison is where the value is. Most people validate the number and stop, but the fraud signal is the mismatch between the officially registered identity and what the counterparty put on its invoice or contract.
Status is a moment, not a property. Registrations are issued, suspended and deregistered, and most services confirm only the current state, so evidencing status at the transaction date depends entirely on having captured the validation record at the time.
Retain the validation reference and timestamp. Compliance regimes increasingly require proof that verification was performed rather than an assertion, and the same record evidences what a party could reasonably have known when the transaction occurred.
A valid registration with no premises, no employees, no filed accounts and a domain registered last month is a substance finding. The registration is necessary but not sufficient, and reporting it as verification without the substance test is the common weak link in due diligence.
Sanctions lists publish tax identifiers precisely because names transliterate inconsistently. An exact identifier match against an identifier block is a far stronger designation finding than a fuzzy name match and should be recorded as a different class of evidence.
Never validate a personal tax number through a public third-party checker. That is disclosure of sensitive personal data to an unknown processor, and the correct route is either an official service used for a documented purpose or no external query at all.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Tax ID / VAT Number is producing anything, and they are worth baselining before you change process or tooling.

Proportion of counterparties validated through the official service with the response and timestamp retained, rather than validated informally or not at all.
Rate of name or address discrepancies detected at validation, and the proportion resolved before payment. This is the measure that connects the control to prevented loss.
Revalidation coverage for active suppliers against the defined cadence, since deregistration after onboarding is a specific and recurring fraud pattern.
Percentage of personal tax numbers held in tokenised form with cleartext confined to a logged vault, audited rather than self-reported.
Structural validation failure rate at ingestion by source system, which surfaces upstream data quality problems worth fixing at source.
Proportion of counterparty assessments including a substance test rather than registration validation alone, which distinguishes real diligence from a checkbox.
Time from a sanctions identifier match to compliance escalation, measured in hours, since screening output is a legal trigger rather than analytic colour.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Validation confirms that a registration exists, not that the entity you are dealing with is the one entitled to use it.
Hijacked and cloned VAT numbers are a standard technique in missing trader fraud, where a real registration is used by an impostor.
Formats collide across jurisdictions, so a number valid under one country's rules may be meaningless or misread under another's.
Validation services usually return current status only and cannot confirm whether a registration was valid at the transaction date.
Personal tax numbers are frequently exposed in leaked datasets and treating them as ordinary business identifiers is a compliance failure.
Deregistration is often retroactive to an earlier date, so a currently invalid number may have been genuinely valid when used.

Legal and ethical considerations

Business tax registrations are quasi-public identifiers designed for disclosure on invoices and filings, but personal tax numbers are highly sensitive PII carrying identity theft and tax fraud risk, and are explicitly protected in many jurisdictions. Separate the two classes in storage and access control. Query official validation services only for a legitimate business purpose and respect their usage terms. Retain validation evidence for compliance, minimise storage of personal numbers, encrypt them at rest and apply defined deletion schedules once the verification purpose ends.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Tax ID / VAT Number, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 4 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Does a valid VAT number mean the company is legitimate?

No. It means the entity is registered for VAT in that jurisdiction and, where the service returns them, that the registered name and address match what you were given. Registrations are obtainable by entities with no genuine operations, and missing-trader fraud depends on exactly that. Validation is a necessary first check that catches fabricated numbers and identity mismatches cheaply. Substance is a separate test: premises, employees, filed accounts, trade records, licences and the age of the digital footprint. Report the two findings separately, because conflating them is how weak due diligence passes review.

What is the difference between an entity and a personal tax number?

Handling obligations, primarily. Entity numbers such as VAT registrations and employer identification numbers are designed for disclosure: they appear on invoices, websites, contracts and public filings, and validating them through official services is routine. Personal tax numbers identify natural persons, enable identity theft and tax fraud, and are explicitly protected in many jurisdictions with criminal penalties for unauthorised disclosure. Store them separately, tokenise them for joining, restrict and log access, and apply a deletion schedule. A single policy covering both classes will be either uselessly restrictive or dangerously permissive.

Can I validate a number in bulk?

Within the service's stated terms only. Official validation endpoints are designed for transactional use and impose rate limits, and exceeding them or circumventing controls is a breach that typically results in blocking and may have contractual or legal consequences. For portfolio revalidation, batch queries over time within the limits, cache responses with their timestamps, and revalidate on a risk-based cadence rather than continuously. Where a commercial provider offers bulk validation, confirm what it actually queries, since some cache results rather than checking the authority in real time.

How do I evidence that a number was valid at the time of a transaction?

By having captured the validation response and its timestamp at the time. Most official services confirm only the current state and do not expose history, so a check performed today cannot evidence status six months ago. This is why the validation record is retained per transaction rather than once per counterparty: a supplier deregistered between contract and invoice is a well-established fraud pattern, and the contemporaneous record is what demonstrates what you knew and when. Where a reference number is issued by the service, retain that too, since it is the strongest form of the evidence.

What should I do if the registered name does not match the invoice?

Stop and escalate before payment. A mismatch between the officially registered entity and the name on the invoice or contract is a material discrepancy with a small number of explanations: a trading name being used, a group entity invoicing on behalf of another, an administrative error, or fraud. Each requires a different response and none should be assumed. Request an explanation in writing, verify the explanation against registry records, and where bank details also changed, treat it as a suspected invoice redirection until proven otherwise, since that combination is the standard pattern.

Are tax numbers useful for entity resolution across datasets?

Yes, and for business identifiers they are among the best keys available, because they are printed on invoices and customs declarations and therefore appear in trade, procurement and financial datasets that share no other identifier. Validate structurally before joining to avoid propagating transcription errors, and record the jurisdiction, since number formats collide across schemes. For personal tax numbers the same power exists and is precisely why joining on them requires a lawful basis, tokenisation and access control rather than being treated as a routine data engineering decision.

How do VAT fraud patterns show up in this data?

As inconsistencies between registration, invoicing and physical trade. The recurring signals are chains of invoices between entities sharing officers, addresses or formation agents; registrations created shortly before large trading volumes and deregistered shortly after; declared goods that do not appear in customs or transport records; and entities whose declared turnover is wildly inconsistent with their filed accounts, premises and employee count. Individually each has innocent explanations; together they form the missing-trader pattern that revenue authorities and Europol have documented in detail and that these identifiers make visible.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

EU VAT Directive establishes the VAT identification number system and the obligation to verify counterparty registrations for intra-community supplies.
ISO/IEC 7064 provides check character algorithms used by several national taxpayer identification schemes for offline validation.
OECD Common Reporting Standard defines taxpayer identification number use in automatic exchange of financial account information.
FATF Recommendations on customer due diligence require verification of legal entity identity, of which tax registration validation forms part.
GDPR Article 87 and national provisions permit member states to impose specific conditions on processing of national identification numbers, including personal tax numbers.
National taxpayer confidentiality statutes restrict access to and disclosure of tax records, defining the legal gateways available to investigators.
ISO 17442 LEI provides the complementary legal entity identifier that links a fiscal registration to a verified corporate identity.
EU e-invoicing and customs declaration standards embed trader identification numbers, enabling identifier-based linkage across trade data.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

VIES VAT number validation — European Commission. Official EU service confirming VAT registration status and registered entity details.
Check a UK VAT number — HM Revenue and Customs. UK official validation service returning registration status and registered business details.
Tax Exempt Organization Search — US Internal Revenue Service. US exempt organisation records keyed to employer identification number with status history.
Sanctions List Search — US Department of the Treasury, Office of Foreign Assets Control. Designations with identifier blocks that include tax and registration numbers.
Global LEI Index — GLEIF. Verified legal entity reference data complementing fiscal identifiers.
Comtrade international trade statistics — United Nations. Trade flow data used to test the plausibility of claimed trading activity.
Tax transparency and exchange of information — OECD. International standards on taxpayer identification and information exchange.
VAT fraud typologies — Europol. Law enforcement analysis of missing trader and carousel fraud structures.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: structured validation of business tax registrations with registry bridging, sanctions screening and audit-ready verification records. Explore the platform, or browse the rest of the library by following any tag above.