EU VAT Identification Number - All Member States

Detects EU VAT identification numbers for all 27 member states in a single consolidated pattern, built branch-by-branch from the per-country structures published in the European Commission VIES FAQ (Q11). Covers the Greek quirk (Greece prefixes with EL, not GR) and Northern Ireland's XI prefix, which remains checkable in VIES for goods traders under the Windsor Framework — XI is included with the UK 9-digit, 12-digit and GD/HA government/health-authority forms; plain GB numbers are NOT included because Great Britain left the VIES scheme after Brexit. This pattern is a superset alongside the existing per-country detectors (at/be/de/fr/hu/it-vat-number), which stay untouched for deployed-GUID stability — the same document may fire both, following the global-iban / eu-iban precedent.

Type: regex
Engine: universal
Confidence: high
Confidence justification: High confidence: every branch requires the exact two-letter member-state prefix followed by that state's verified digit/letter structure, which is distinctive in business documents; this matches the confidence of the existing per-country VAT detectors. The short Romanian branch (RO + 2-10 digits, no leading zero) is the loosest row and is the main reason the bare structural tier stays discovery-only.
Jurisdictions: eu
Regulations: GDPR, VAT Directive 2006/112/EC
Frameworks: ISO 27001, ISO 27701, SOC 2
Data categories: financial, business-identifier
Scope: narrow
Risk rating: 5
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Unsupported

Pattern

\b(?:ATU\d{8}|BE[01]\d{9}|BG\d{9,10}|CY\d{8}[A-Z]|CZ\d{8,10}|DE\d{9}|DK\d{8}|EE\d{9}|EL\d{9}|ES(?:[A-Z]\d{8}|\d{8}[A-Z]|[A-Z]\d{7}[A-Z])|FI\d{8}|FR[A-HJ-NP-Z0-9]{2}\d{9}|HR\d{11}|HU\d{8}|IE(?:\d{7}[A-Z]{1,2}|\d[A-Z+*]\d{5}[A-Z])|IT\d{11}|LT\d{9}(?:\d{3})?|LU\d{8}|LV\d{11}|MT\d{8}|NL[A-Z0-9+*]{9}B\d{2}|PL\d{10}|PT\d{9}|RO[1-9]\d{1,9}|SE\d{12}|SI\d{8}|SK\d{10}|XI(?:\d{9}(?:\d{3})?|GD[0-4]\d{2}|HA[5-9]\d{2}))\b

Corroborative evidence keywords

VAT number, VAT identification, VAT registration, value added tax, VIES, intra-community, [object Object], belasting, [object Object], Mehrwertsteuer, [object Object], Umsatzsteuer, BTW-nummer, numéro de TVA, Steuernummer, tax number, tax registration, taxe sur la valeur ajoutée, adószám, imposta sul valore aggiunto (+37 more)

Proximity: 300 characters

Should match

ATU12345678 — Austria — U + 8 digits (9-character block per VIES)
BE0123456789 — Belgium — 10 digits, first digit 0 or 1
DE129273398 — Germany — 9 digits
EL123456789 — Greece — EL prefix (not GR) + 9 digits, the VIES Greek-prefix quirk
ESB12345678 — Spain — 9 characters, first and/or last alphabetic (never both numeric)
FRXX123456789 — France — 2 validation characters (letters excluding O and I, or digits) + 9-digit SIREN
IE6388047V — Ireland — 7 digits + 1 letter (classic 8-character format)
IE1234567WI — Ireland — 7 digits + 2 letters (post-2013 9-character format)
LT123456789012 — Lithuania — 12-digit long form (9 or 12 digits)
NL123456789B01 — Netherlands — 12 characters with the literal B at position 10
XI110305878 — Northern Ireland — XI prefix + UK 9-digit body, checkable in VIES under the Windsor Framework
XIGD012 — Northern Ireland — XI government-department form GD000-GD499

Should not match

DE12345678 — Germany body one digit short — fails the exact 9-digit branch
GR123456789 — Greece never uses GR in VIES — the EL branch is deliberately the only Greek prefix
GB123456789 — Plain GB numbers left VIES after Brexit — only the XI Northern Ireland prefix is covered
IT123456789012 — 12 digits after IT — exceeds Italy's exact 11-digit structure
RO0123456789 — Romania with a leading zero — the fiscal code is written without zero padding

Known false positives

Deliberate overlap with the existing per-country detectors (at/be/de/fr/hu/it-vat-number): the same VAT number can fire both this consolidated pattern and a per-country pattern. This mirrors the accepted global-iban / eu-iban superset precedent. Mitigation: Deploy either the consolidated pattern or the per-country patterns, or de-duplicate at the reporting layer if both are enabled.
Two capital letters followed by digits occur in other identifier schemes (order codes, national IDs, IBAN fragments); the short Bulgarian/Czech/Romanian digit bodies are the most collision-prone rows, and no checksum can be enforced in the exported SIT. Mitigation: Every branch is bounded to the exact per-country structure (no generic 8-12 alphanumeric collapse); the reporting tier requires VAT keywords within the proximity window and the bare structural tier is discovery-only.