Home / Use cases / AML & Compliance

VAT Validation for Anti-Money Laundering (AML) Compliance

AML frameworks require businesses to verify the identity and tax registration of counterparties before entering high-value transactions. Use the TaxID API to validate VAT numbers as part of your AML due diligence workflow, with a full audit trail per transaction.

Implementation steps

1. 1

   Trigger validation at transaction initiation

   Call GET /api/v1/validate/:country/:vat from your server when a new counterparty relationship or high-value transaction is initiated. Do not rely on prior validation records — always validate in real time at the point of due diligence, since VAT registrations change.

2. 2

   Cross-reference returned company details

   Compare the company_name and address returned by the API against the counterparty's self-declared company name and registered address. A mismatch is a risk signal. Exact string matching is too strict — normalise for formatting and legal suffixes (GmbH, Ltd, SRL), but flag substantial name differences for manual review.

3. 3

   Handle service_unavailable as pending — not cleared

   If the API returns service_unavailable, do not proceed as though the counterparty is validated. Queue the transaction for re-validation within 24 hours and hold any risk decision until VIES recovers. Do not log service_unavailable responses as 'verified' in your compliance records.

4. 4

   Store the full response as a compliance record

   Persist the complete API response — status, company_name, address, request_id, and validated_at — with the transaction record. EU AML regulations require due diligence records to be retained for 5 years. The request_id uniquely identifies the VIES query and can be referenced in audit documentation.

5. 5

   Re-validate for ongoing relationships

   For counterparties with recurring transactions, re-validate VAT status monthly or before high-value transactions. A status change from active to inactive or invalid in an established relationship is a significant risk signal warranting immediate review.

Code example

const res = await fetch(
  'http://localhost:3000/api/v1/validate/DE/DE123456789',
  { headers: { 'Authorization': 'Bearer YOUR_API_KEY' } }
);
const { valid, status, company_name, company_address } = await res.json();

if (valid) {
  console.log(`Valid EU business: ${company_name}`);
} else if (status === 'service_unavailable') {
  // VIES is temporarily down — retry or allow with manual check
  console.log('VIES unavailable — check back in a few minutes');
} else {
  console.log('Invalid VAT number — charge local tax rate');
}

import requests

res = requests.get(
    "http://localhost:3000/api/v1/validate/DE/DE123456789",
    headers={"Authorization": "Bearer YOUR_API_KEY"}
)
data = res.json()

if data["valid"]:
    print(f"Valid: {data['company_name']}")
elif data["status"] == "service_unavailable":
    print("VIES temporarily unavailable")
else:
    print("Invalid VAT number")

API response

The TaxID API returns a consistent JSON response for every validation request:

{
  "valid": true,
  "status": "active",
  "country_code": "DE",
  "vat_number": "123456789",
  "company_name": "Example GmbH",
  "company_address": "Musterstraße 1, 10115 Berlin",
  "request_date": "2026-05-10T00:00:00.000Z",
  "cached": false,
  "request_id": "req_01j..."
}

Error handling

The API uses a consistent Stripe-style error format. Always handle service_unavailable separately — VIES has occasional downtime and you should not reject valid customers during outages.

Evaluating EU VAT APIs? Compare TaxID vs Vatstack, Vatlayer, Avalara →

Related use cases