{
  "id": 14409448,
  "title": "VAT Number Regex Isn't Validation: What Format Checks Miss",
  "url": "https://urgent.news/2026/10/14/vat-number-regex-isnt-validation-what-format-checks-miss",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-14T09:00:54.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/iurii_rogulia/vat-number-regex-isnt-validation-what-format-checks-miss-11f4"
  },
  "original_language": "en",
  "account": "A regular expression, or regex, can help determine if a string resembles a VAT number, but it cannot confirm if the VAT number has been issued or if the digits are correct. This is because the regex only checks for the correct country prefix, length, and character types. There are three possible outcomes once dealing with a real VAT number, and the regex only covers the first: malformed, well-formed but not registered, and well-formed and registered. The first outcome rejects the VAT number immediately, while the second outcome requires a live lookup against the VIES system. The third outcome confirms that the VAT number is both well-formed and registered, which is the only outcome that matters for actual transactions. A shape regex is unable to distinguish between the second and third outcomes since both are well-formed strings, and the difference lies in a government database. This means that if the validation only stops at the regex, a fake VAT ID could be treated as real. The EU VAT number format varies for each of the 27 member states and one for Northern Ireland, with each country having its own prefix and body. There is no single regex that fits all countries. The open-source eu-vat-rates-data npm package provides the pattern for each country, and the same pattern is returned from the vatnode API. The regex can only validate the shape of the string, while the check digit validation is done separately and is not included in the regex. When validating VAT numbers in JavaScript/Node, using validateFormat() as a first gate is recommended, but it should not be the final validation. A local pass means the VAT number is worth a network call, but further checks are needed to determine if it is registered. The EU VAT API provides three possible responses, which do not align one-to-one with the three outcomes mentioned earlier.",
  "summary": "Originally published at vatnode.dev . The version on vatnode.dev is the canonical source — refer to it for the latest content. A regex can tell you a string looks like a VAT number. It cannot tell you the number was ever issued, and for some countries it can’t even tell you the digits are internally consistent. Three different things get called ‘VAT validation,’ and conflating them is how…",
  "key_points": [
    "Regex checks only shape of VAT number, not registration status",
    "Regex only verifies country prefix, length, character types",
    "EU VAT API provides three possible responses for VAT validation"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}