Overcoming the hurdles of VAT and VAT MOSS in the EU

In September 2017 I founded the company to take Report URI from being a free project that I ran out of my own pocket to being a sustainable, commercial service. During that process I had to overcome many, many hurdles and the single hardest thing has to have been VAT MOSS.

VAT MOSS

There are two things in life that are absolutely certain, taxes and death. In the UK and across the European Union we have VAT, Value Added Tax, added to the value of goods and services that are bought and sold for use or consumption. I should start out by saying I have no objection to taxes, of course everyone would prefer that they were lower, but I understand their purpose and the requirement for them. What I do have an objection to is the absolutely staggering level of complexity and difficulty in paying taxes. If you're going to force me to pay you some money, you should at least offer me the courtesy of making it as simple as possible. This is the apparent reason that the VAT Mini One Stop Shop (VAT MOSS) was created, to simplify the process of paying taxes for Report URI.

Historically, if we were selling to a consumer in another member state of the EU we would charge the VAT rate of our country. For us in the UK selling to a business or consumer in any of the other 27 member states we would charge 20% UK VAT, simple. The problem with that was the varying VAT rates across Europe and the incentive that provided certain companies to register in certain countries.

Anyone in Europe that's purchased from large sites like Amazon will have noticed at some point that they were registered in Luxembourg and that's because they have the lowest rate of VAT so could charge the lowest rate to their EU consumers. To fight this problem and remove the unfair advantage, the EU introduced new rules for the 'place of supply' for digital services. This meant that large cloud hosting providers like Amazon and Microsoft couldn't sell their digital services from Luxembourg just for the low VAT rate and instead had to charge their customers the VAT rate of the country that the customer resides in and this is where things start to get really tricky.

Place of supply

The problems with charging the rate of VAT in the consumer's country start with the requirement that you first need to establish which country that is and no, simply asking them is not sufficient. The regulations dictate that you must acquire 2 pieces of non-contradictory evidence to show which member state the customer is normally located in. The pieces of evidence that will be accepted include:

• the billing address of the customer
• the Internet Protocol address of the device used by the customer
• customer’s bank details
• the country code of the SIM card used by the customer
• the location of the customer’s fixed land line through which the service is supplied
• product coding information which electronically links the sale to a particular jurisdiction

It doesn't look so bad at first but we can rule out the SIM card, fixed land line and product coding because we simply don't have them at our disposal. Next is up is bank details, but we only take credit cards through our site so that leaves the IP address and billing address. The billing address we can ask for and is fairly reliable but there were some issues with using the IP address, first of which is that we didn't want to store it and the legislation requires that we would have to store it. The second issue was that if we use the IP address and you're using a VPN or signing up for the service on a business trip, or any other scenario where you could have a foreign IP address, the IP address would fail the 'non-contradictory' requirement of the legislation, so that was out too. There was one last thing that could save us and it was another option in the legislation:

For many micro and small businesses this requirement may be challenging. For micro and small businesses that use payment service providers, we suggest the following approach:
at the point of sale, ask the consumer for details of either their:

• billing address, including the member state
• telephone number, including the member state dialling code
• when the consumer pays for the digital service, you’ll need to get from the payment service provider a notification advice containing the 2-digit country code of the consumer’s member state of residence as listed in their records

I really didn't want to take another piece of information from the customer in the form of their telephone number so when taking card payment we can query the 2 digit country code from Stripe, our payment provider, and check that it matches against the billing address that was provided. This is great and solves our evidence requirement but it meant adding additional steps to our billing flow. Rather than just accepting a card and submitting payment, we now need to take the billing address and tokenise the card with Stripe to fetch the country code for comparison before we can accept payment. If the country codes match up we can be sure we charge the correct rate of VAT and have the appropriate evidence which is then stored in Stripe.

Only collecting data when required

The next problem was that our billing system now collected all of this information from everyone even though we only needed it for EU based customers. I didn't want to simply collect it from everyone (I didn't want to collect it at all), and I also didn't like the extra steps in the billing flow, so I only wanted us to collect this information when we were legally required to do so. This did introduce yet more complexity to the billing system but it felt like the right thing to do and resulted in the best user experience for our non-EU customers. To do this we leveraged a feature on Cloudflare called IP Geolocation.

When enabled, this feature adds an additional HTTP header to requests that hit our origin servers. With this header we can know which country the request came from and we use that information to populate our payment with the appropriate country code selection. This means the form will only show all of the name and address input fields if we require them from the customer. If I hit the subscription form from my UK IP, I get the following:

But if I use a VPN and switch out to a US based IP address, I get this instead:

Of course, the geo-location may be wrong or the customer could be in a different country to normal or even using a VPN themselves, but we hope that this will get it right most of the time and you can always manually change the option as a last resort. Maintaining different types of customer (country of residence) with different records is an added overhead, but it means that we collect data only when we have no choice.

How much VAT to charge?

The next problem now of course is how much VAT do we charge the customer based on the country they live in. If they're outside the EU then we charge no VAT and if they're in the UK I know the VAT rate here is 20%, but there are 27 other member states. With there being 27 other member states, you'd naturally think there were 27 other VAT rates, right? Wrong! Right now we're tracking 47 different rates of VAT to apply to customers based on where they live in the EU. Yes, 47 separate, different rates to track, keep up to date and apply correctly. Did you know that the Royal Air Force here in the UK has two operational bases in Cyprus and UK citizens that are based there do not pay UK VAT at 20% despite it being UK territory, they pay the 19% VAT rate of Cyprus instead! The Vatican and the Netherlands Antilles are excluded from the European Community and thus not subject to the rules of its VAT territories despite their geography. Another good one is the small town of Mittelberg in Austria which is only accessible by road from Germany and as a result is charged the German VAT rate of 19% and not the Austrian VAT rate of 20% despite being in Austria!

I think you're starting to get the picture that far beyond the 28 member state rates of VAT there are countless exceptions and also reduced rates to consider and if you want to be compliant, which you have to be, you need to know of and apply all of these rates correctly.

Paying your taxes

Now we're finally collecting all of our necessary taxes, at the correct rate, from consumers that purchase our service within the EU, we of course have to pay those taxes to the tax authority in the appropriate country. Historically this would have meant registering with the 28 tax authorities in all 28 member states but the VAT MOSS scheme allows you to register with a single tax authority in a single country to file all of your VAT returns there. If you're based outside of the EU you can pick whichever country you would like to register in and if you're based in the EU you will most likely register with the country that you reside in. For me that's Her Majesty's Revenue and Customs (HMRC) here in the UK, the equivalent of the IRS in the USA. So, you register for VAT and once you have a VAT Registration Number (VRN) you can register for the VAT MOSS scheme. Now, instead of filing a quarterly return with each of the VAT authorities of the 28 member states, we can file a single quarterly return to HRMC with all of the details of the revenue and VAT details for each member state and HMRC will forward the appropriate amounts to each VAT authority across the EU on our behalf. It does simplify the paperwork somewhat but we still need to produce all of the necessary data for each and every sale and store our evidence for if we're ever challenged.

The VAT MOSS scheme does introduce another problem though and we could have really done with avoiding this too.

Losing our VAT registration threshold

Because we have to register with HMRC to get a VRN to join the VAT MOSS scheme we lose our VAT registration threshold, we have to register immediately. Right now in the UK you only have to VAT register a company if you turn over more than £85,000 ($114,000 USD) in a 12 month period. This means you can avoid the administrative overhead and costs of having to register for VAT, charging your customers VAT, collecting the VAT and then submitting and paying your VAT returns. This threshold was there to help small business, or startups like ours, avoid crippling administrative overheads and hassle of doing all of this whilst their revenue was still low. Because of the requirement to join the VAT MOSS scheme, and avoid the alternative which was to file VAT returns in 27 other countries, we had to VAT register and lose this allowance. Oh, and there's more...

VAT Reverse Charge

Companies like to avoid paying for things until they absolutely have to and the VAT Reverse Charge scheme is a way of avoiding paying your VAT until a later date. If we were to sell a subscription to an EU business at £1,000/month, the total cost would be £1,000 + VAT per month. Let's say the company was based in France, that'd make their total monthly subscription £1,200 to pay. We would collect that amount, account for the £200 VAT on our quarterly return and then pay that to HMRC who would, in turn, pay that to the French tax authority. Kind of a long and messy road for the money, but there's another way.

Under the VAT Reverse Charge scheme we can mark a transaction as 'VAT Reverse Charged' and charge them no VAT on the transaction, so the monthly fee above remains at £1,000 instead. It's crucial you mark it as 'no VAT' and not 0% VAT because those are two very different things! On top of that the VAT authorities in each country have their own requirements on the fields that have to be present on a VAT Reverse Charged invoice so you have to ensure you comply with all of them. The customer then files details of the transaction on their VAT return and pays the appropriate amount to the French tax authority next time around. This means they pay less at the point of us delivering the service, the money doesn't need to do a whole round trip across the EU and it still ends up in the right place. Sounds like a great idea, and it is, but of course it's not that simple, is it...

To do this we need to have a VRN, which we do, and we need to collect a VRN from the consumer too. Simply collecting the VRN isn't enough though and we actually have to validate the VRN against the details we were provided on the payment form. To do this, the European Commission provide the World's most unreliable API endpoint for you. With this we can call in with the provided VRN and compare it to the address details provided, which incidentally also need to match the card details provided as mentioned above, and then, only then, can we remove VAT from the subscription and mark invoices as VAT Reverse Charged. You can see this in action if you just grab any company's details that are based in the EU with a VAT number. Here it is without a valid VAT number, which would be a consumer or a non-VAT registered business:

Then if they provide their VAT number, and it validates, we can Reverse Charge the VAT and reduce the monthly cost of the subscription:

At least it's straightforward

Honestly, dealing with VAT and VAT MOSS was the single biggest nightmare for me when we were setting the company up. I knew things were going to be complicated, and there was going to be a lot we had to do that we didn't know about, but the whole VAT / VAT MOSS thing was unreal. At one point I was seriously considering registering the company in another jurisdiction to avoid the hassle. That fetches a lot of bad looks and negative press here in the UK, and I can kind of see why as it's viewed as you trying to avoid paying taxes, but I look at our local government more as a service provider. They provide various services to us that allow us to operate as a business. They're doing a terrible job of that, the process is difficult, complex and expensive so why wouldn't you look at using another provider? You'd do exactly that if it were any other service provider you use! We're a distributed company with staff in the UK, Czech Republic and Australia so far but we can register anywhere we like. In the end we didn't go down that road and we are a fully registered company right here in the UK, but HMRC and the wider EU community need to seriously look at this and ask themselves what it's doing to small businesses and startups like ours. We're really fortunate that both myself and Michal are technical and determined. We found ways around most of the problems, implemented technical measures to overcome them and ultimately came out on top due to our experience and sheer tenacity. I wonder how many other businesses didn't make it through this minefield though? All of this pain and hardship that we had to endure came about because the EU wanted to go after the big players like Amazon and get them paying more tax. That's great, and it worked, but at what cost to small businesses and startups like us?