What I learned reading ten EU company registers

I built a free tool that checks a supplier before you pay them. The part that took most of the work, and taught me most, was reading ten national company registers instead of relying on the EU's own VIES service.

This is what I found out, mostly so the next person doesn't have to.

The problem with "the VAT number is valid"

VIES — the European Commission's VAT Information Exchange System — answers one question: is this VAT number currently registered. That sounds like the question you want answered. It isn't.

A company that has gone into liquidation keeps a cleanly resolving VAT number in VIES. So does one that has been struck off the register. Deregistration and insolvency are run by different authorities on different timetables, and the gap between "this company has stopped being a going concern" and "the VAT number stops validating" can be months.

So you can check a supplier, get a green tick, and be looking at an insolvency estate.

The national registers know. VIES doesn't ask them.

Ten registers, and what each actually gives you

I found free, public, machine-readable-enough sources for ten countries: Bulgaria, Czechia, Estonia, Finland, France, Greece, Latvia, Poland, Romania and Slovenia.

They are not equivalent, and this is the thing I'd have liked written down somewhere before I started:

• Six of them report company *state* — inactive, in liquidation, bankrupt, insolvent, terminated, ceased, struck off: Romania, Estonia, France, Greece, Bulgaria, Latvia. This is the valuable one.
• Three report whether the company is actually VAT-active — Poland, Romania, Slovenia. That matters more than it sounds, because VIES does not distinguish "this is a real company that isn't VAT-registered" from "this number belongs to nobody".
• The rest give you a name and not much more.

Czechia, for instance, is in the ten but in neither of the other two groups. It confirms a name. That's it. Worth knowing before you build a feature around it.

Poland is the interesting one

Poland is the only EU member state where you can check whether a bank account belongs to the supplier.

Not because of anything clever — because the Ministry of Finance publishes the accounts that VAT-registered businesses have declared, on what's known as the white list. It exists because paying an unlisted account has tax consequences for the payer, so there's a statutory reason for the data to be public and current.

Nowhere else in the EU can you do this from public data. In every other country, an IBAN tells you the country and the bank and nothing whatsoever about who owns it.

Where it gets ugly

Nine countries have no free company-data source I could find at all: Germany, Austria, Italy, Spain, Portugal, Lithuania, Luxembourg, Cyprus, Malta.

Seven more are gated behind an account, an API key or a payment: Hungary, Ireland, Belgium, Denmark, Croatia, Netherlands, Sweden.

Hungary deserves a specific mention. It does return a name and address through VIES. What's missing is company state — and I found six separate official routes to it, every one of them behind a CAPTCHA. That's not a technical problem, it's a policy one, and no amount of engineering fixes it.

Germany and Spain are a different flavour of annoying: VIES confirms registration for both, but neither publishes a company name through it. I tested three valid numbers for each to be sure I wasn't holding it wrong. For those two, all you can honestly show is a yes/no.

Small things that cost me time

• Greece files VAT under EL, not GR. Every list of ISO country codes will tell you GR. VIES wants EL.
• Northern Ireland is XI. Post-Brexit, NI numbers go through VIES; Great Britain numbers don't.
• GB is not available unless you hold an approved application for HMRC's VAT API. I don't. What you can do for free is verify the official check digit locally — which proves a number is impossible, never that it exists — and then link to the free checker on GOV.UK, which answers the user's actual question in ten seconds.
• Check digits are arithmetic, so they work when the registry is down. I implemented them for 19 countries. This turned out to be one of the highest-value-per-line things in the project: it catches a transposed digit immediately, offline, with no network call.
• Registers change their markup without warning. This is the real maintenance cost, and the main reason I haven't shipped an API — I'd rather a scraper break for me than in someone else's production pipeline.

The design decision I'd defend hardest

The tool shows five separate results and deliberately refuses to combine them into a score or a "safe to pay" verdict.

That's not modesty, it's the whole point. The most common invoice fraud is bank-detail redirection: a real supplier's mailbox is compromised and only the account number on the invoice changes. The company is real. The VAT number is valid. The goods were delivered. The sanctions check is clean. Every individual check passes, because everything is genuine except the destination of the money.

A single green tick would be a confident lie about the one attack that actually happens. So there are five answers, and a standing instruction to confirm bank details by phone on a number you already had.

If you're building anything in this space, that's the trap: the aggregate score is the most saleable feature and the most dishonest one.

Boring stack, on purpose

The whole thing runs in about 300 MB on a single VPS in Helsinki. No account, no cookies, no ads, no third-party analytics. The full IBAN is never stored or displayed — only country code, check digits and last four — and saved results are deleted after 90 days.

There's no API and no bulk checking. For a developer audience that's probably the whole review, and it's a fair criticism. It's one person maintaining sixteen fragile integrations, and an API is the fastest way to turn that into an operations job I can't staff.

A worked example, if you'd rather see the output than type a VAT number: vetthisvendor.com/example

Happy to go into any of the registry scraping in the comments — that was most of the work and most of the pain.