EORI in Validation, Audits & API: EU & UK Customs & KYB Guide

1What is an EORI Number? The Legal and Regulatory Framework

An EORI number (Economic Operators Registration and Identification) is a unique identifier recognized by customs authorities to monitor and track commercial goods entering, transiting, or exiting the customs territory. Without an active EORI, businesses cannot submit import or export declarations, appoint customs representatives, or release commercial cargo from port customs control.

The regulatory structure differs fundamentally between jurisdictions:

• →European Union (EU): Mandated by Regulation (EU) No 952/2013 (Union Customs Code, UCC), Article 9, and Commission Delegated Regulation (EU) 2015/2446. The identifier consists of a 2-letter ISO country code followed by up to 15 alphanumeric characters (e.g., DE123456789012). All EU member state customs databases sync to the European Commission's central EOS DDS2 (Economic Operators System - Data Dissemination System 2).
• →Great Britain (UK): Following Brexit, Great Britain is governed by the Taxation (Cross-border Trade) Act 2018 and uses the Customs Declaration Service (CDS). UK EORIs start with the prefix GB followed by a 9-digit or 12-digit number (e.g., GB123456789000). GB EORIs are maintained strictly by HM Revenue & Customs (HMRC) and are completely separate from the EU EOS register.
• →Northern Ireland (Windsor Framework): Under the Windsor Framework and Northern Ireland Protocol, businesses moving goods between Northern Ireland and the EU, or between Northern Ireland and Great Britain, require a dedicated XI prefix EORI (e.g., XI123456789000). XI EORIs are registered with HMRC but are recognized by EU customs systems.
• →Non-EU European Nations: Countries such as Switzerland (CH) and Norway (NO) do not participate in the EU/UK EORI system. Switzerland relies on its domestic Enterprise Identification Number (UID/CHE), while Norway utilizes its Brønnøysund Register MVA system.

2VAT vs. EORI: Why Having One is Not Enough

One of the most frequent compliance mistakes in European logistics is assuming that an active VAT number automatically covers customs, or conversely, that an EORI number proves fiscal tax health. They operate under entirely separate legal mandates, serve distinct authorities, and are maintained in independent government databases.

If an EU supplier sells goods to a UK buyer, the transaction cannot be completed legally or logistically by verifying only one number. You must confirm the VAT identity to invoice without VAT under reverse charge, and you must verify the EORI to clear the freight through French, Belgian, Dutch, and British customs terminals.

3How Combining VAT + EORI Solves 95% of Vendor Due Diligence & Commercial KYB

In enterprise procurement, supply chain logistics, and B2B accounting, Know Your Business (KYB) verification is often slow, costly, and fragmented. Traditional workflows rely on static credit reports that often lag behind official government registries by weeks or months. Cross-referencing live VAT validation with live EORI verification resolves up to 95% of routine B2B counterparty validation and operational compliance checks across Europe:

1. Real-Time Legal Existence Proof

Unlike static commercial databases, an active result in VIES or EOS confirms that the business is actively recognized in real time by state revenue and customs administrations. Dormant, deregistered, or struck-off companies fail instantly.

2. Dual-Registry Identity Cross-Check

VIESAC cross-references legal company names and registered addresses across both tax and customs authorities. Discrepancies between the vendor's invoice, tax records, and customs registration immediately highlight shell entities or unauthorized intermediaries.

3. Cross-Border Trade Legitimacy

A counterparty claiming to be an exporter or distributor must hold active customs authorization. Validating their EORI ensures they have legal standing to move cargo, eliminating fraudulent brokers who vanish when shipments hit customs.

4. Carousel & MTIC Fraud Protection

Tax authorities invoke "joint and several liability" if a company trades with an entity engaged in Missing Trader Intra-Community (MTIC) VAT fraud. Stored timestamped dual verification provides defensible proof of exhaustive commercial due diligence.

Automate 95% of Your B2B Vendor Due Diligence

Validate counterparties across both revenue and customs registers before signing contracts or approving vendor invoices. Prevent joint liability and VAT fraud with point-in-time stored audit proof.

Start Free KYB Validation Try Free Online Checker

By incorporating dual VAT and EORI verification at the vendor onboarding stage, enterprises eliminate 95% of manual compliance overhead while establishing a fortified audit barrier against bad actors.

4How EORI Validation Works: EU EOS DDS2 & UK HMRC

Validating an EORI is not a simple algorithmic regex calculation; numbers must be verified against live government databases that reflect daily revocations, suspensions, and address updates.

EU EOS DDS2 Querying

For all 27 EU Member States (e.g., DE, FR, IT, ES, PL, NL, GR), VIESAC queries the European Commission DG TAXUD Economic Operators System (EOS DDS2). It verifies active status and returns registered name, street, postal code, and city.

UK HMRC Production API Querying

Great Britain registrations (GB) cannot be queried in EU EOS. VIESAC connects directly to HMRC's production Check an EORI Number API, returning authoritative UK customs validity and entity details.

Address Disclosure Transparency: Under Article 14 of the UCC Delegated Regulation, economic operators may request that their address remain confidential from public search results. When this occurs, the government registry returns the status VALID while withholding address fields. VIESAC accurately captures this distinction: the certificate documents that the operator is legally valid and active, preventing false rejections by automated procurement pipelines.

5VIESAC Hybrid Audits: Single vs. Dual Verification

One-off browser lookups might tell you that a number is valid right now, but they fail the moment a tax auditor or customs inspector asks for verifiable historical proof. VIESAC's audit architecture bridges this gap by creating immutable, structured audit records.

Every VIESAC audit generates a unique cryptographic reference number, point-in-time timestamp, raw government payload capture, and signed PDF report ready to attach to an ERP invoice or customs dispatch docket.

6Developer Guide: VIESAC EORI Validation & Hybrid Audit REST API

Engineering teams can automate EORI checks inside ERP systems (SAP, Microsoft Dynamics 365, Oracle, Odoo), transportation management systems (TMS), warehouse software (WMS), and e-commerce checkouts via the VIESAC REST API.

1. Real-Time EORI Validation

For fast synchronous lookups during form validation or order review, call the lightweight validation endpoint:

GET /api/v1/eori/validate?eori=DE123456789012
Authorization: Bearer YOUR_VIESAC_API_KEY

2. Creating a Hybrid Audit (VAT + EORI)

To run the full 95% KYB check, link to an internal order/invoice, and generate dual certificates, post to the unified audits endpoint:

POST /api/v1/audits
Authorization: Bearer YOUR_VIESAC_API_KEY
Content-Type: application/json

{
  "type": "vat_eori",
  "country_code": "DE",
  "vat_number": "123456789",
  "eori_number": "DE123456789012",
  "order_number": "PO-2026-8941",
  "invoice_number": "INV-2026-4412"
}

3. Python Integration Snippet

Integrate hybrid compliance checks into Python microservices or automation scripts:

import requests

API_KEY = "viesac_live_your_api_key_here"
HEADERS = {"Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json"}

payload = {
    "type": "vat_eori",
    "country_code": "FR",
    "vat_number": "12345678901",
    "eori_number": "FR12345678901000",
    "order_number": "ORD-FR-2026-902"
}

response = requests.post("https://viesac.eu/api/v1/audits", json=payload, headers=HEADERS)
data = response.json()

if data.get("status") == "valid" and data.get("eori_status") == "valid":
    print("KYB Verified: Both VAT and EORI active.")
    print("VAT Certificate PDF:", data.get("certificate_url"))
    print("EORI Certificate PDF:", data.get("eori_certificate_url"))
else:
    print(f"Compliance Alert: VAT={data.get('status')}, EORI={data.get('eori_status')}")

The API returns full JSON response metadata with explicit validation statuses, entity details, consultation reference tokens, and direct links to downloadable audit-ready certificates.

7Continuous Monitoring & ERP Master Data Hygiene

Validating an EORI once at vendor onboarding does not protect against deactivations, mergers, or compliance revocations six months later. If a supplier's EORI is suspended while a high-value cargo container is en route to Rotterdam or Felixstowe, the goods are instantly impounded by customs until a revised declaration is processed.

• →Bulk Master Data Scrubbing: Use VIESAC Bulk Audit to run automated batch scrubs across your entire ERP vendor master database, eliminating deactivated identifiers before billing cycles.
• →Automated Continuous Monitoring: Configure persistent monitoring periods on critical logistics partners. If their customs standing changes, automated webhooks alert compliance officers before shipments depart.
• →ViDA Preparation: As digital reporting under ViDA (VAT in the Digital Age) accelerates toward real-time transaction reporting, having unified tax and customs data hygiene is indispensable.

8Common EORI Validation Pitfalls to Avoid

• →Querying EU VIES for EORI numbers: VIES only verifies intra-EU VAT numbers. Passing an EORI (especially one with sub-branch digits or a different prefix like GR) into VIES returns an invalid error.
• →Checking Great Britain (GB) numbers in the EU EOS: Post-Brexit, HMRC manages GB registrations separately. An EU EOS check for a valid GB EORI will falsely report "not found". Always use a designated UK EORI validator.
• →Confusing Greece EL and GR: Submitting a Greek EORI with EL fails in customs portals. Greece requires GR for EORI.
• →Confusing Company Registration Numbers with EORIs: A national commercial register number (e.g., German Handelsregisternummer, French SIREN, UK Companies House number) is not an EORI.
• →Relying on Browser Screenshots: Screenshots lack cryptographic timestamping, response XML schemas, and tamper proofing. Tax and customs auditors routinely reject screenshots during formal reviews.

10Official Primary Sources and Legal Authorities

VIESAC's validation and audit infrastructure is architected directly around official statutory guidelines and primary public registries:

• →European Commission DG TAXUD: Economic Operators System (EOS DDS2) — the official EU portal for EORI validation.
• →Union Customs Code (UCC): Regulation (EU) No 952/2013 of the European Parliament and of the Council, laying down the Union Customs Code (Article 9 on EORI registration).
• →HM Revenue & Customs (HMRC): Check an EORI Number Service and the official HMRC Developer Hub EORI API.
• →Windsor Framework Guidance: UK Government guidelines for moving goods into, out of, or through Northern Ireland using the XI EORI prefix.

Disclaimer: VIESAC is an independent enterprise compliance and audit platform. References to official government registries (EU EOS DDS2, HMRC, DG TAXUD) describe technical data sources and regulatory frameworks; they do not imply official sponsorship, government endorsement, or partnership.