What happens if you ignore VAT on digital sales

VAT you failed to charge does not disappear when the sale settles. It converts into a debt you owe out of money you already received, spent and paid yourself from, because there is no mechanism for issuing a corrected invoice to a consumer who bought a $19 subscription two years ago and cancelled it eighteen months back.

That is why the exposure from ignoring EU VAT is a percentage of past revenue rather than of past profit, and it is the part that never makes it into the argument. Ask a room of indie founders and you get two incompatible answers. One camp says there is no enforcement mechanism, they have ignored this for years, and nothing happened. The other says you are liable for every cent and it compounds. Both describe something real. Neither describes the mechanism.

Circulating alongside them is a folk threshold: that you are fine below roughly $500,000 to $1,000,000 in revenue. That number appears in no directive, no national VAT statute and no tax authority guidance I could find, and nobody who repeats it cites a source. It is folklore. Treat it as folklore.

None of this is tax or legal advice; it is the mechanism, so you can price the risk instead of guessing.

The obligation starts at the first sale, and non-EU sellers get no threshold at all

Place of supply for electronically supplied services is the customer's location, from the first euro, under Article 58 of the EU VAT Directive. The €10,000 exemption sits in Article 59c and carries three cumulative conditions, the first being that the supplier is established "only in one Member State." An EU seller established in exactly one Member State qualifies. A US LLC, a UK limited company or a Canadian sole proprietor cannot satisfy condition (a) at all, so there is no de minimis, no pro rata, no grace period, as the Commission's place of taxation guidance confirms. Where the obligation begins and whether a merchant of record is the cheaper answer are worked through in VAT and sales tax when you sell software. This post starts one step later, where you did none of it.

Uncharged VAT becomes a debt against revenue you have already spent

Charged correctly, you are a collection agent: the customer pays €121, you keep €100, and €21 was never yours. Uncharged, the customer pays €100, you bank €100, and the €21 obligation still exists, now payable from your own funds.

One piece of the computation is good news. In Joined Cases C-249/12 and C-250/12 (Tulică and Plavoşin) the Court of Justice held that where the parties set a price without reference to VAT and the supplier has no possibility of recovering the tax from the purchaser, the agreed price must be regarded as already including VAT. The assessment comes out of your price, not on top of it.

Work it on an illustrative figure rather than observed data. Take €240,000 of B2C sales to EU consumers over four years, at a blended 21% for the arithmetic. VAT out of the gross is 240,000 × 21 ÷ 121 = €41,652; on top it would have been €50,400. Interest runs from when the VAT was due, not from the assessment: Ireland charges 0.0274% per day, a little over 10% a year, so an average liability age of three years adds roughly €12,500. Penalties come on top.

Now hold that against the business rather than the sales figure. Four years at a 25% net margin produced €60,000 of profit, and VAT plus interest takes €54,000 of it before any penalty, out of money already spent on salary, contractors and hosting. The tax is calculated on revenue; your ability to pay comes from margin. Those two diverge further the leaner you run, which is the opposite of what most founders assume.

Interest and penalties are national, so there is no single EU figure

There is no EU-wide penalty rate to quote, and anyone who gives you one is inventing it. The Commission's Guide to the VAT One Stop Shop puts it plainly: "Any imposition of penalties and charges relating to the late submission of returns falls under the competence of the Member State of consumption, according to its rules and procedures." Twenty-seven regimes, each with its own rate, categories and limitation period.

Look-back periods are the ceiling on exposure, and they vary. Irish Revenue states that "the time limit for raising a VAT assessment is normally four years" with "no time limit in cases of fraud or neglect" (VAT estimates and assessments). HMRC gives four years as "the maximum time limit available to the Commissioners for assessments under Section 73 VATA except where the twenty year rule applies" (VAEC1143). The carve-outs carry the weight: a four-year window becomes twenty, or unlimited, the moment the behaviour is characterised as deliberate or as neglect, and "I knew and did not register" is not an easy fact pattern to argue out of.

Penalty ranges are published where they exist. Ireland's Code of Practice for Revenue Compliance Interventions sets careless behaviour without significant consequences at 20% of the tax, falling to 10% with a prompted qualifying disclosure and full co-operation and to 3% if the disclosure is unprompted. Deliberate behaviour starts at 100%, falling to 50% prompted and 10% unprompted on a first disclosure. Those are Irish numbers for Irish liabilities. Do not port them to Germany or Spain, or average them into a European figure that does not exist.

They find out from payment data before they find out from you

The mechanical answer changed in 2024, and the regime founders worry about is not the one that reaches them.

CESOP is the one that does. Since 1 January 2024, Council Directive (EU) 2020/284 requires payment service providers to keep and report records of cross-border payments where the payer is in a Member State and the payee is in another Member State or outside the EU. The trigger is more than 25 cross-border payments to the same payee in a calendar quarter, records kept three calendar years, reported into a central EU system whose stated purpose is detecting VAT fraud in e-commerce. Finland's tax administration states the threshold in those terms. Note what that catches: a founder in Austin taking card payments from EU consumers through Stripe. The payer's bank sits in a Member State, so the payments are reportable regardless of where you are. Twenty-five a quarter is roughly nine EU customers on a monthly plan.

DAC7 mostly does not. Council Directive (EU) 2021/514 puts reporting obligations on platform operators, and its Annex V definitions are narrower than the summaries suggest. A "Platform" is software "allowing Sellers to be connected to other users for the purpose of carrying out a Relevant Activity," and the definition excludes software that solely enables "processing of payments in relation to Relevant Activity." "Relevant Activity" is a closed list of four: rental of immovable property, a Personal Service, the sale of Goods, and the rental of any mode of transport. A self-serve software subscription is none of those, and Stripe on your own checkout is a payment processor, not a platform. Sell through an app store, a template marketplace or a freelance platform and the operator may report you. Sell direct and DAC7 is not your problem; CESOP is.

The other routes are duller and more common than either: an acquirer's tax due diligence, which is where most of this surfaces; a bank or processor compliance review; a B2B customer asking for a VAT invoice you cannot issue; a competitor's complaint; and your own registration. That last one deserves attention. An OSS registration takes effect "from the first day of the calendar quarter following that in which the taxable person informs the Member State of identification," per the Commission's guide. You are handing an authority a start date attached to a business that plainly did not begin trading that quarter. Registering forward is still the right move, and it is also the moment your history becomes legible.

"Nothing happened to me" describes a cost-benefit calculation, not a rule

Enforcement against very small non-resident sellers has been rare, and the people saying so are reporting accurately. The reason is arithmetic on the authority's side. Recovering €4,000 of German VAT from a sole trader in Ontario means establishing the liability, serving it, then collecting it where the machinery does not reach: Council Directive 2010/24/EU lets one Member State recover another's claim as if it were "a claim of the requested Member State," and there is no equivalent between Germany and a Canadian resident. Fragmentation helps you too. Your €41,652 is not one debt but twenty-odd small ones owed to twenty-odd authorities, each below the level at which anyone opens a file.

Two things change that calculation, and neither is a revenue number. The first is scale: the same fragmentation that makes you not worth pursuing at €40,000 of EU sales makes you worth a file at €400,000, because the per-country amounts cross the point where a case pays for itself.

The second is legibility, and it matters more. Nothing has to be discovered if a document you produce yourself puts it in front of someone. In an acquisition, a buyer's advisers reconstruct sales by customer country as routine, and an unquantified VAT exposure becomes a price reduction or an indemnity you carry personally. A processor review, a move of your residence into a Member State, an OSS registration, an accountant who will not sign off: each converts a quiet history into a dated record.

The risk is therefore not spread evenly across time. It sits near zero for years and concentrates at the moment the business becomes worth something, which is also the moment you have least appetite for a surprise.

Exposure by seller situation

Quantify first, take advice second, register third

Voluntary disclosure is the mechanism that exists for this. It generally buys penalty mitigation plus, in some regimes, protection from publication and prosecution: Ireland's Code of Practice states that where a taxpayer regularises a default by way of a qualifying disclosure the details "will not be included in the quarterly publication of tax defaulters," and that Revenue "will not initiate an investigation with a view to prosecution." The gap between unprompted and prompted is the whole game there, 3% against 10% for careless behaviour and 10% against 50% for deliberate. Other Member States run different regimes with different reductions, and some with none, so the only universal claim is that disclosing before contact beats disclosing after it.

Then sequence. Quantify, take advice, register. Advisers charge by the hour, and the first three hours otherwise go on arithmetic you could have done from a CSV. Walking in with a number by country and by year turns an open-ended engagement into a scoped one, and tells you whether this is a €4,000 problem or a €60,000 one before you decide anything. Doing that reconstruction yourself rather than waiting on a year-end service is the argument that makes a Bench alternative for owners who want their own numbers worth weighing against outsourced bookkeeping: the number is in your processor export today.

Run the number off your processor export

It takes an afternoon, and it makes every later decision cheaper.

EXPOSURE ESTIMATE — EU B2C DIGITAL SALES
Illustrative method. Not a filing. Not advice.

1. EXPORT
Stripe → Reports → Balance → itemised "Balance change from
activity", one file per calendar year, back to your first year.
Columns (Stripe's own names):
created → the year the sale falls in
amount, currency → gross. VAT is computed on this; processor
fees are your cost, not a deduction.
card_country → best available proxy for customer location
reporting_category → keep "charge", subtract "refund", "dispute"

2. FILTER
Drop non-EU rows. Drop rows with a validated business VAT number:
B2B supplies generally reverse-charge to the buyer. If you never
collected VAT numbers, treat everything as B2C — conservative, and
probably also true.

3. BUCKET
Pivot: rows = card_country, columns = year, value = SUM(amount)
net of refunds. Countries with three sales in a year are noise;
four or five will carry 80% of the number.

4. APPLY THE RATE
Multiply each cell by that country's standard rate for that year
as a fraction of gross: rate ÷ (100 + rate).
21% → × 0.1736 19% → × 0.1597 23% → × 0.1870
Gross-inclusive is the Tulică form. Use the rate in force that
year, not today's.

5. TRIM BY LOOK-BACK
Delete years older than that country's assessment window (commonly
four, unlimited where fraud or neglect is found). Move those rows
to a second tab rather than discarding them.

6. ADD TIME
Interest runs from when the VAT was due. For sizing, apply ~10%/yr
(Ireland's published 0.0274%/day) to each year's balance for the
years elapsed, then substitute the real national rate for the two
or three countries that dominate.

7. THE NUMBER
Tax + interest = the floor. Penalties on top, set nationally,
0% to 100% of the tax. Write down the floor, the ceiling and the
four countries carrying most of it. That page goes to the adviser.

One note on evidence: card_country is a proxy, not proof. Article 24b of Implementing Regulation 282/2011 normally wants two items of non-contradictory evidence for customer location, billing address, IP address and bank details among them, though under €100,000 of these supplies a single item suffices. The reconstruction is only painful because the country and tax line were never captured at the point of sale, which is a one-line fix going forward, whether through an invoice generator with a tax field or your billing system's tax settings.

Three things to change this week

1. Run steps 1 to 3 of the export calculation. Not the whole model. Gross EU B2C sales by country by year. Ninety minutes, and it turns an anxiety into a figure.
2. Set the country and the tax treatment on every new sale from today. Whatever the history holds, stop adding to it. If the answer is a merchant of record, switch this week and record the date, because it becomes the boundary in your file.
3. Reserve against the floor, not the mid-point. The set-aside is monthly arithmetic rather than an annual event, the discipline tax season as a year-round system runs on and the reason a monthly set-aside calculation beats a spreadsheet opened in April. The reserve comes out of cash, not MRR, and that difference is the subject of MRR is not cash.

Worklyn's invoicing records the customer's country and the tax line on the document when the sale happens, so the grid in step 3 already exists instead of having to be rebuilt from card metadata four years later.