VAT Exposure During Fundraising Due Diligence: What Investors Actually Look For

Founders raising Series A through C in 2026 are increasingly hitting a stage in due diligence they didn't expect: the indirect-tax workstream. A Big 4 advisory firm or specialist tax DD provider opens a data room, asks for VAT registration certificates and customer-location evidence policies, and quantifies the contingent liability sitting in places nobody at the company has thought about. The findings rarely kill deals, but they routinely cost founders 1 to 5% of valuation, an indemnity escrow, or a reps-and-warranties insurance premium they didn't budget for. This guide explains what investors look for, what auditors flag, and how to clean up before the term sheet lands.

1. When VAT becomes a DD line item

Series Seed and pre-seed rounds rarely involve indirect-tax DD. The numbers are too small and the diligence budget doesn't justify a tax workstream. By Series A, with $1-5M ARR and any cross-border revenue, VAT starts to surface. By Series B (typically $10-30M ARR) it's a standard line item in the DD checklist. By Series C and growth-equity rounds, it's a serious workstream with documented findings.

The reason is leverage. At pre-seed, a $50k VAT exposure is rounding error on a $5M post. At Series B, a $500k VAT exposure on a $50M post is 1% of valuation, and the legal cost of negotiating an indemnity for it exceeds the underlying number. Investors care because their downstream exit is more sensitive to clean compliance.

The reviewer is usually one of:

• A Big 4 advisory firm (PwC, EY, Deloitte, KPMG) running tax DD as part of a broader DD engagement.
• A specialist tax-DD boutique (often spinning out of a Big 4) doing focused indirect-tax work.
• The lead investor's in-house counsel, escalating to external advisors when material exposure surfaces.

Materiality thresholds typically start around $50k for early-stage rounds and $200-500k for growth-equity. Below threshold, findings get noted but not actioned. Above threshold, the deal team negotiates indemnity, escrow, or warranty insurance.

2. The five recurring findings

Finding 1: Missed EU OSS registration

By far the most common. Any SaaS or e-commerce business with EU consumer revenue is required to be registered for VAT, with the EU OSS Non-Union scheme being the simplest path. The threshold is zero: the first euro of B2C digital service supply triggers the obligation. Most US founders don't realise this until DD.

Quantification example: a SaaS at $5M ARR with 25% EU revenue ($1.25M annual EU sales) has roughly $250k/year of unpaid VAT (using a 20% blended EU rate). Two years of unaddressed exposure compounds to $500k unpaid VAT plus interest plus penalty.

Fix: register for EU OSS Non-Union via Irish Revenue ROS (4-8 weeks), file the back-period returns under a voluntary disclosure if available, pay the back VAT plus interest, document the cleanup. Full OSS explainer.

Finding 2: UK VAT not registered post-Brexit

Pre-2021, UK customers were inside the EU OSS perimeter. Post-2021, the UK runs its own NETP (Non-Established Taxable Person) regime separate from EU OSS. SaaS companies that registered for OSS pre-Brexit and didn't add a separate UK NETP registration have been accruing UK VAT exposure for 5 years.

Quantification example: same $5M ARR SaaS with 8% UK revenue ($400k annual UK sales) has roughly $80k/year of unpaid UK VAT (20%). Five years of cumulative exposure plus HMRC late-filing penalties can hit $500k.

Fix: register with HMRC NETP (zero threshold for nonresidents), file back-period returns where possible, settle the liability. UK doesn't have a formal voluntary-disclosure programme equivalent to many EU countries, but proactive registration plus payment usually limits penalty exposure.

Finding 3: Missed APAC nonresident regimes

Australia simplified GST (AUD 75k threshold), Singapore OVR (SGD 100k + SGD 100k), Japan JCT (JPY 10M), Korea Simplified VAT, India OIDAR (zero threshold). SaaS companies typically hit one or more of these thresholds without realizing it because the reporting is obscure relative to EU and UK obligations.

India OIDAR is the most operationally dangerous because the DGGI has been actively enforcing nonresident registration since 2023, with retroactive notices going back to 1 July 2017 and Section 74 penalty exposure of 100% of unpaid tax plus interest. A finding of "client has India OIDAR exposure but is not registered" can materially change a DD outcome. India OIDAR enforcement.

Finding 4: Reverse-charge applied without VIES validation evidence

For B2B sales to EU-registered buyers, the reverse-charge mechanism applies and the seller invoices without VAT. The catch: the seller must validate the buyer's VAT number via VIES at the time of supply and retain the validation evidence. EU case law (notably Mecsek-Gabona) holds the seller liable for VAT if the buyer's number was invalid when the supply was made and the seller didn't take reasonable steps to verify.

Common DD finding: company applied reverse-charge on B2B sales but cannot produce VIES validation logs for those sales. The DD reviewer assumes the worst case (no validation) and quantifies the contingent liability as if all those B2B sales should have been B2C, with full VAT due plus interest and penalty.

Fix: bulk-validate existing customer VAT numbers via VIES, document which validations were retroactive, address any customers whose numbers fail. The free tax-ID validator handles batch checks.

Finding 5: Customer-location evidence not captured

EU rules require two non-contradictory pieces of customer location evidence per B2C digital-services sale (billing address, IP, payment country, etc.). Most modern billing platforms capture this automatically, but the DD reviewer wants to see proof: a written policy plus a representative sample of evidence per period.

Common DD finding: company has the data in the billing platform but no documented policy and no audit-trail extract. Reviewer flags this as an audit-defense weakness even if the underlying data is fine. Fix is administrative: write a one-page policy, generate a sample report, document the methodology.

3. How investors quantify the exposure

Standard formula:

Total exposure = Unpaid VAT × (1 + interest rate × time) × (1 + penalty multiplier)

Worked examples:

The interest rates and penalty multipliers vary by jurisdiction. The framework is the same.

4. The valuation impact

Two channels:

Direct contingent liability adjustment. The DD reviewer puts a number on the expected VAT payable. The investor either reduces the pre-money valuation by that amount or holds it back in escrow until the liability is resolved. On a $50M valuation, a $500k VAT exposure is a 1% direct hit.

Multiple compression. Less measurable but often larger. A SaaS with messy compliance gets a lower revenue multiple than a comparable one with clean compliance. The investor reasons: ongoing compliance complexity will absorb management bandwidth, surface more findings later, and may resurface during exit DD. A 0.5x revenue multiple haircut on a $5M ARR Series B is $2.5M of valuation reduction. This is the bigger number on most deals.

Combined effect on a $50M Series B with material VAT findings: typically $1-5M of valuation impact, sometimes more.

5. The cleanup playbook

If you're 6+ months from a fundraising conversation:

1. Run an exposure analysis. Sync your Stripe (or equivalent) account to the free exposure dashboard. Identify every jurisdiction where revenue has crossed a registration threshold.
2. Triage the findings. Sort by exposure size and resolution complexity. Focus on EU OSS, UK, and any APAC regime with India OIDAR-style penalty exposure first.
3. Register and disclose. For each priority jurisdiction, register and file under the local voluntary-disclosure programme where one exists. EU OSS doesn't have a formal voluntary-disclosure scheme but Irish Revenue has been pragmatic with sellers who proactively self-correct.
4. Document the trail. Keep registration certificates, back-filed returns, payment confirmations, and a memo describing the cleanup process. This is what the DD reviewer reads.
5. Implement ongoing controls. Set up a tax engine (DeterminedAI, Stripe Tax, or equivalent) so the same gap doesn't reappear. The DD reviewer wants to see process, not just remediation.

Total cost: typically $20-50k in registrations, filings, back-period payments, and tax-tech setup. Total time: 8-16 weeks for a typical Series B-stage cleanup.

If you're already in fundraising with VAT findings on the table:

1. Quantify the exposure honestly. Don't argue the math; the DD reviewer will win. Provide your own calculation matching theirs.
2. Negotiate the indemnity, not the existence. Investors typically accept a specific indemnity provision in the SPA covering pre-closing VAT liabilities, capped at the quantified exposure or 1.5x as a buffer.
3. Use reps-and-warranties insurance. Most M&A and growth-equity deals use R&W insurance. VAT exposure can be specifically excluded (which means the risk stays with the seller), specifically included (with a higher premium), or covered as part of the standard tax representations. Negotiate where it lands.
4. Commit to remediation post-close. If cleanup is feasible within 6 months, commit to it as a closing condition or a post-closing covenant. Reduces investor risk and lets you negotiate down the indemnity.

6. The data room checklist

Documents to have ready in your VAT folder:

• VAT/GST registration certificates for every jurisdiction where you're registered.
• Last 12 quarters of VAT returns (or local equivalent) plus proof of payment.
• Customer-location evidence policy (one-page document describing how you capture two-piece evidence per B2C sale).
• VIES validation logs for B2B reverse-charged sales, ideally as a queryable export with timestamps.
• Tax engine configuration documentation (Stripe Tax setup, Avalara/Vertex/Anrok/DeterminedAI configuration as applicable).
• Per-transaction tax determination logs for a representative period (one quarter is usually enough).
• Any correspondence with tax authorities (HMRC, Irish Revenue ROS, BZSt, ATO, IRAS, DGGI, etc.).
• Memo describing your VAT compliance posture: what's registered, what's not, what's pending, and why.
• If applicable: voluntary-disclosure submissions and acceptance letters.
• Internal escalation policy for tax-authority correspondence (who handles it, response timelines).

The memo is the most important single document. It tells the DD reviewer what to look for and pre-empts the questions they would otherwise ask. A clear, honest, 3-page memo beats a 50-page tax-engine export every time.

7. Frequently asked questions

8. Related reading

• EU OSS scheme explained
• UK VAT registration for US SaaS
• India OIDAR enforcement for nonresident SaaS
• Customer location evidence for digital services
• Validate EU VAT numbers via VIES API
• Nonresident SaaS VAT/GST registration thresholds (2026)