Customer Location Evidence for Digital Services VAT: The Two-Piece Rule

For every EU B2C digital services sale, the seller must determine the customer's country and keep evidence to prove it. Under the EU VAT Implementing Regulation, that evidence must consist of two non-contradictory items drawn from a closed list — unless you fall below the simplification threshold. Most SaaS companies either ignore this rule entirely or capture only one data point, leaving them exposed in an audit. This article explains the mechanics, the presumptions, and how to operationalise the two-piece rule in your billing stack.

Why customer location matters

Under the EU's place-of-supply rules for digital services (Article 58 of Directive 2006/112/EC), B2C digital supplies are taxed where the customer is located. That means a Dutch consumer buying a SaaS subscription from an Irish vendor triggers Dutch VAT (21%), not Irish VAT (23%). Get the location wrong and you apply the wrong rate, under-collect or over-collect tax, and misallocate revenue in your OSS return.

The legal basis: Article 24b of Regulation 282/2011

The evidence rules live in Council Implementing Regulation (EU) No 282/2011, as amended. Article 24b sets out rebuttable presumptions for specific supply types:

• Article 24b(a) — Supplies via a landline: the customer is where the landline is located.
• Article 24b(b) — Supplies via a mobile network: the customer is where the SIM card country code indicates.
• Article 24b(c) — Supplies requiring a decoder/viewing card at a fixed location.
• Article 24b(d) — The general rule for SaaS and most other digital services. The customer is located where the supplier identifies them based on two items of non-contradictory evidence from the Article 24f list.

Article 24b(d) is what applies to the vast majority of SaaS transactions. The two-piece rule is explicit: you need two pieces of evidence, and they must not contradict each other.

What counts as evidence: the Article 24f list

Article 24f lists the evidence types that are legally acceptable. Any two of the following qualify:

1. The customer's billing address
2. The IP address of the device used by the customer, or any method of geolocation
3. Bank details, such as the location of the bank account used for payment, or the billing address held by that bank
4. The Mobile Country Code (MCC) of the International Mobile Subscriber Identity (IMSI) stored on the SIM card used by the customer
5. The location of the customer's fixed land line through which the service is supplied to them
6. Other commercially relevant information

For most SaaS businesses, the practical pair is (1) billing address + (2) IP address, or (1) billing address + (3) card BIN country. The payment card's Bank Identification Number (the first 6–8 digits) maps reliably to the issuing country and is explicitly contemplated by item 3.

The €100,000 simplification

Since 2019, Article 24b(d) includes a simplification for smaller cross-border B2C digital services suppliers. If your total cross-border B2C digital services turnover is below €100,000 in the current and preceding calendar year, one piece of evidence is sufficient.

What "non-contradictory" means

The biggest operational failure is treating conflicting evidence as if it still proves location. If the customer's billing address is in Germany but their IP address is in Poland and their card BIN is French, you do not have two pieces of non-contradictory evidence — you have three pieces that contradict each other.

The correct response when evidence conflicts is to collect a third piece and apply majority logic, or ask the customer to confirm. Many SaaS billing stacks handle this by locking the VAT country to the billing address and prompting the customer if the IP and BIN disagree.

Example: conflicting evidence

VPN, travelling customers, and corporate cards

The regulation recognises that IP addresses can be misleading. A customer may buy from a hotel WiFi in Spain while their billing address is in Germany and their card is UK-issued. The Commission's own explanatory notes confirm that the IP is just one of several acceptable items and need not be determinative.

A pragmatic policy is: weight billing address and card BIN highest, use IP to corroborate, and tolerate occasional mismatches where two other pieces agree. Document the policy in your tax determination logic so an auditor sees the reasoning, not just the outcome.

Retention: 10 years, electronically available

If you use the One-Stop Shop, Article 63c of Regulation 282/2011 requires you to keep records for ten years from the end of the year of the transaction. The records must include enough detail for the Member State of consumption to verify that the VAT return is correct — and they must be made electronically available on request.

That means storing, for every transaction: the two (or more) pieces of evidence, the determined customer country, the VAT rate applied, the supply date, and the invoice identifier. Raw IP addresses and BIN lookups can be stored as structured metadata rather than free text.

Operational checklist

1. Capture at least two independent signals at checkout: billing address, IP address, and card BIN country. Phone country code and shipping address are useful backups.
2. Classify evidence pairs: agreement → set country; disagreement → collect a third item or prompt the customer.
3. Lock the determined country to the invoice record. Do not recompute at invoice render time from stale IP data.
4. Store evidence in a retrievable format for ten years, with the supply date and VAT rate applied.
5. Log your decision rule. An auditor who sees the rule plus consistent evidence will usually not dig further.

Frequently asked questions

What counts as customer location evidence for EU VAT?

Billing address, IP address, bank or card BIN country, SIM card country code, fixed landline location, or other commercially relevant information (Article 24f of Implementing Regulation 282/2011).

Do I always need two pieces of non-contradictory evidence?

Yes for B2C digital services when your cross-border turnover exceeds €100,000 in the current or preceding year. Below that threshold, one piece suffices (Article 24b(d) simplification).

How long do I need to keep customer location evidence?

Ten years under Article 63c of Implementing Regulation 282/2011 if you use the One-Stop Shop. Evidence must be electronically retrievable on request.

What about B2B customers?

For B2B, the reverse charge applies and the location test is the business customer's establishment. Validate their VAT number against VIES and keep the validation response as your evidence.