CESOP: What EU Tax Authorities Already See

CESOP comes from two instruments adopted together in February 2020: Council Directive (EU) 2020/284, which added the record-keeping duty for payment service providers to the VAT Directive as Articles 243b to 243d, and Council Regulation (EU) 2020/283, which built the central system and the exchange rules. Both applied from 1 January 2024, so the first quarterly data landed at the end of April 2024.

It is not a tax, a return or a registration. Nothing about it asks a seller to do anything. It is a reporting duty on banks, card acquirers, e-money institutions and other payment service providers, and its output is a single European database of cross-border payment records that tax administrations can query.

That makes it the enforcement layer underneath everything else on this site. The marketplace deemed supplier rules decide who accounts for VAT; CESOP is how an administration notices that someone who should have been accounting for it never did.

The trigger is in Article 243b of the VAT Directive. A payment service provider must keep records where, in a calendar quarter, it provides payment services corresponding to more than 25 cross-border payments to the same payee. A payment is cross-border when the payer is located in a Member State and the payee is located in another Member State, in a third territory or in a third country.

Twenty-five per quarter is a very low bar, and this is the part sellers consistently misjudge. It is roughly two orders a week. It counts payments, not value, so a business selling low-priced goods reaches it faster than one selling expensive ones. There is no de minimis by amount anywhere in the rule.

The counting is done per payment service provider, per Member State and per identifier such as an IBAN. Where the provider knows the payee holds several identifiers, it counts per payee instead. Two consequences follow: each provider counts its own flow, so a seller under 25 with each of three providers may still be well over 25 in reality, and splitting receipts across accounts is not a way out, because the provider aggregates the identifiers it knows about.

This is the assumption worth killing early. Sellers often reason that if the money never touches an EU bank, no EU institution has anything to report. The rule is built the other way round.

Article 243b(3) relieves the payer's payment service provider of the record-keeping only where at least one of the payee's providers is itself located in a Member State, since that provider will report instead. Where the payee's providers are all outside the EU, no such relief applies and the payer-side providers, meaning the buyers' own banks and card acquirers, keep and report the records.

So the further outside the EU a seller banks, the more likely it is that the reporting happens on the buyer's side, where the seller has no visibility and no control. The same paragraph adds that the payer's providers count those payments toward their own threshold either way.

Article 243d sets out the contents, and the list is more identifying than most people expect. It includes the payee's name or business name as the provider holds it, any VAT identification number or other national tax number of the payee if available, the IBAN or another identifier that locates the payee, and the identifier of the payee's own payment provider. Alongside those sit the payment details themselves, including refunds.

Two of those fields do the analytical work. The tax number field is what lets an administration join payment data to a VAT registration, or notice that there is no registration to join it to. The location identifiers are what let it decide which Member State should have been receiving the VAT.

Location is determined mechanically, not from the seller's own account of itself. Under Article 243c, the payer's location follows the IBAN of the payment account or, failing that, the identifier of the provider acting for the payer, and the payee's location follows the same logic. Where a business says it is established has no bearing on where its payments say it is.

What is not collected matters too, and the Commission is explicit about it. Only data on payees above the threshold is transmitted, together with the amounts received. Information about the consumers who paid, and about the purpose of each payment, is not part of the transmission. CESOP shows who received European money and from where, not what anybody bought.

Providers pass the records to their Member State no later than the end of the month following the calendar quarter, using an electronic standard form, under Article 24b of Regulation (EU) No 904/2010. The Member States feed the central system, and the data stays in CESOP for five years from the end of the year of transmission. The providers themselves keep their records for three calendar years.

Access is deliberately narrow. It is limited to Eurofisc liaison officials holding a personal CESOP user identification, and only where the access is connected to an investigation into suspected VAT fraud or serves to detect it. This is not a database that a random official browses, and it is not published anywhere.

The practical effect is a five-year lookback. A seller who regularises its position in 2027 should assume the payment history from earlier years is still visible, which changes the calculus on voluntary disclosure: the choice is rarely between being seen and not being seen, but between explaining the gap first or answering for it later.

The most common way to end up on the wrong side of this is not fraud. It is a seller concluding that because the marketplace now pays the VAT on its sales, the local VAT registration is redundant, and closing it.

The registration usually was not there for the marketplace sales. It was there because the seller imports, holds stock, moves its own goods between Member States or sells through channels the marketplace does not facilitate. Those transactions carry on after the deregistration, which turns them into undeclared transactions, and the input VAT that used to be recoverable becomes stranded. We set out which obligations survive the marketplace rule in if Amazon collects VAT, do you need VAT registration? and the rule itself in EU marketplace deemed supplier VAT.

What CESOP adds is the detection. A business with no registration in a country, receiving payments from consumers in that country quarter after quarter, is exactly the shape the system was built to surface. The pattern that used to be invisible is now a query.

There is nothing to file, so the work is entirely about making sure your own position matches what the payment data already shows. That is a reconciliation exercise, and it is worth doing before someone else does it for you.

If a gap turns up, deal with it deliberately rather than quietly. Correcting a return, registering late or making a voluntary disclosure are all better positions than being asked about a five-year payment history. Contact our VAT team with the countries you receive payments from and the registrations you hold, and we will tell you where the two do not line up. Our VAT returns service covers the filing side once the position is clear.