The sixth amendment to the EU Directive 2011/16/EU on administrative cooperation in the field of taxation, DAC7, is a directive that standardises reporting obligations for all digital platform operators in the EU. It aims to promote tax transparency and prevent tax evasion and avoidance by those selling through platforms such as Airbnb, Amazon, Booking.com and Uber. As the deadline for implementing the directive was 31 December 2022, digital platform operators should quickly adapt their vendor due diligence procedures and controls.
Many global platforms are already facing numerous challenges they either did not anticipate or needed to be fully prepared for; DAC7 adds to this burden. From a business perspective, there are still significant concerns about compliance with the new regulations.
We discuss the key areas affected by DAC7, including data collection, updating existing data, data validation, lack of standardisation, retrieval of sensitive data and the technical challenges platform operators face.
Data validation
According to DAC7, platform operators must determine whether the information collected from sellers is reliable and accurate. There are several challenges in doing so.
A lack of reliable sources for the validation of tax numbers
Validation of EU VAT numbers is relatively easy thanks to the VIES system and access to the local databases of most EU Member States. However, most countries do not have a publicly accessible database for validating company or personal tax numbers. The eventual introduction of a government verification service (an electronic process available to platform operators to establish a seller’s identity and tax residency) will simplify this process.
Incomplete or outdated information on publicly accessible websites
It is possible to integrate checks (e.g. format and algorithm checks based on information from the Organisation for Economic Cooperation and Development (OECD) and the European Commission) into the client introduction process. However, the information from the European Commission is by its nature limited to EU Member States, and the OECD sources are not entirely up to date. Even these measures do not lead to the full validation of IDs. In short, while collecting tax ID data can be relatively straightforward, verifying the data is not. Moreover, tax ID formats are not static. For example, Argentina changed its format in July 2022 to make its IDs generic rather than binary. In the Netherlands, a person’s VAT ID used to be (almost) identical to their tax number (BSN), but the country decoupled these two formats in 2020.
Real-time validations are challenging to perform
There are significant hurdles for platforms validating IDs in real-time (when customers enter their tax ID at check-out). Even if there is a government database that can automatically validate a tax ID, this can sometimes result in a long wait for the customer. Ideally, it should take less than three seconds and certainly no more than six, as that is the limit of human patience. If a user has to wait too long, the likelihood of the sales process being aborted increases. For some databases, however, it can take much longer to return the required information.
One way to minimise customer loss (“churn”) in this process is to make the request earlier to give the tool time to validate the ID or to implement a risk policy that temporarily accepts an ID that uses the correct format and syntax but does not comprehensively verify the number until onboarding is complete.
Updating existing data
Platforms must move to capture and validate the required data from new sellers and sellers who are already connected. To capture the tax ID numbers of all new sellers, developers need to set up an additional form field. Capturing tax ID data from the existing user base is more challenging for older and mature platforms. And time is working against them.
Why does it take so long to collect data from existing users? The platforms require sellers to provide sensitive personal data that many would prefer to provide in the first place. To collect this data, campaigns need to be launched – by email, phone or in-app, with particular care taken to ensure that messages to sellers are written in their preferred language.
Finding the ideal time to update existing client tax data takes time and effort. One of the benefits of the gig economy was that people could sign up and sell quickly. The requirement to provide this information increases friction and can lead to abandonment. However, the statistics vary. Some companies insist that platform sellers provide their tax number after signing up, but before cashing out. Asking for this information at this stage certainly increases compliance, but in some countries, it is worth speaking to the legal team before withholding a seller’s money.
Furthermore, some platforms can “see” the transaction but are not always involved in the payment process.
Despite the intention to standardise reporting requirements, there will be regional differences. To comply with the respective regulations in the different countries, it is necessary to know the intricacies of the individual national laws.
At the time of writing, the format of the data collected by the platforms is still unknown. For this reason, companies must keep carefully abreast of the relevant global legislation and be prepared to quickly and efficiently develop a strategy between programmers, project managers, designers, and communication teams once the official guidelines are available.
Dealing with bank accounts and other sensitive data
The transfer of financial-related account data is fraught with data protection challenges under DAC7. Any security breach involving information such as date of birth and bank account numbers can result in heavy penalties and reputational damage. The retrieval of such sensitive personal data usually requires the internal approval of the data protection team. As DAC7 involves sharing such data with multiple governments, such procedures must be considered when planning the following data transfers. The company’s data protection officer must be informed of any changes that DAC7 brings.
Technical challenges in compiling the data-sharing file
Other challenges must be overcome when integrating with tax authorities’ databases. For example, compiling the standard data file requires data specialists (e.g. data analysts, data scientists or data engineers), as most tax professionals need to gain the necessary skills. Relevant data points are usually scattered across different databases in the company, and overlapping data sources may need to be reconciled. The platform vendor’s data must be pre-processed and converted into a specific file format (e.g. XML or JSON) before it can be shared with the tax authority. It must be validated using internal or external services. Regardless of the exact transmission requirements in the EU, meeting these requirements may require the help of people outside the tax team.
The data must be shared with platform sellers before submission to the authorities, which creates many challenges for 1099 reporting in the US. Platform operators must create and localise the tax summaries for platform sellers and customise their layout and language.
It seems that DAC7 only applies to European companies, but this is not true. Foreign companies with operations in Europe are likely to have data subject to these requirements. Platforms are now required to collect tax data and share it with the relevant authorities.
This indicates that governments are unwilling to exempt platform operators or sellers from tax reporting requirements.
Planning points
To comply with DAC7 requirements, platform operators need to know what types of tax numbers they need to capture and should conduct independent research to identify the different kinds of tax numbers that need to be captured for each country – which may include data from outside the EU.
- Once official guidance is available, platforms must be prepared to develop an efficient data standardisation strategy within the shortest possible time.
- To collect critical tax data from existing platform sellers, care must be taken to ensure that all communication is tailored, e.g. in the preferred language and including the correct tax ID.
- Limit the loss of revenue from new platform sellers by making the request earlier to give the tool time to validate the tax ID, or by implementing a risk policy that temporarily accepts a tax ID that uses the correct format and syntax.
- Close cooperation between the company data protection officer and the DAC7 officer ensures that the latter is regularly informed of any changes the programme brings.
- The data submitted to the authorities must be shared with the platform operators, and the operators must create and localise tax summaries for the sellers.
Source: news.bloombergtax.com
