You’re given the job of implementing an online order form for a business in the European Union.
European tax laws stipulate that when a VAT-registered business (your customer) located in one EU country purchases from a vendor (your company) in another EU country, the vendor must not charge VAT (Value-Added Tax). If the buyer is not VAT-registered, the vendor must charge VAT and remit the VAT to the local tax office. The vendor must use the VAT registration number of the buyer as proof to the tax office that no VAT is due. This means that for the vendor, it is very important to validate the buyer’s VAT number before proceeding with the tax-exempt sale.
The most common cause of invalid VAT numbers are simple typing mistakes by the customer. To make the ordering process faster and friendlier, you should use a regular expression to validate the VAT number immediately while the customer fills out your online order form. You can do this with some client-side JavaScript or in the CGI script on your web server that receives the order form. If the number does not match the regular expression, the customer can correct the typo right away.
Retrieve the VAT number entered by the customer and store it into a variable. Before performing the check for a valid number, perform a search-and-replace to replace this regular expression globally with blank replacement text:
[-.●]| Regex options: None |
| Regex flavors: .NET, Java, JavaScript, PCRE, Perl, Python, Ruby |
Recipe 3.14 shows you how to perform this initial replacement. We’ve assumed that the customer wouldn’t enter any punctuation except hyphens, dots, and spaces. Any other extraneous characters will be caught by the upcoming check.
With whitespace and punctuation stripped, this regular expression checks whether the VAT number is valid for any of the 27 EU countries:
^(
(AT)?U[0-9]{8} | # Austria
(BE)?0?[0-9]{9} | # Belgium
(BG)?[0-9]{9,10} | # Bulgaria
(CY)?[0-9]{8}L | # Cyprus
(CZ)?[0-9]{8,10} | # Czech Republic
(DE)?[0-9]{9} | # Germany
(DK)?[0-9]{8} | # Denmark
(EE)?[0-9]{9} | # Estonia
(EL|GR)?[0-9]{9} | # Greece
(ES)?[0-9A-Z][0-9]{7}[0-9A-Z] | # Spain
(FI)?[0-9]{8} | # Finland
(FR)?[0-9A-Z]{2}[0-9]{9} | # France
(GB)?([0-9]{9}([0-9]{3})?|[A-Z]{2}[0-9]{3}) | # United Kingdom
(HU)?[0-9]{8} | # Hungary
(IE)?[0-9]S[0-9]{5}L | # Ireland
(IT)?[0-9]{11} | # Italy
(LT)?([0-9]{9}|[0-9]{12}) | # Lithuania
(LU)?[0-9]{8} | # Luxembourg
(LV)?[0-9]{11} | # Latvia
(MT)?[0-9]{8} | # Malta
(NL)?[0-9]{9}B[0-9]{2} | # Netherlands
(PL)?[0-9]{10} | # Poland
(PT)?[0-9]{9} | # Portugal
(RO)?[0-9]{2,10} | # Romania
(SE)?[0-9]{12} | # Sweden
(SI)?[0-9]{8} | # Slovenia
(SK)?[0-9]{10} # Slovakia
)$| Regex options: Free-spacing, case insensitive |
| Regex flavors: .NET, Java, PCRE, Perl, Python, Ruby |
This regular expression uses free-spacing mode to make it easy to edit the regular expression later. Every now and then, new countries join the European Union, and member countries change their rules for VAT numbers. Unfortunately, JavaScript does not support free-spacing. In this case, you’re stuck putting everything on one line:
^((AT)?U[0-9]{8}|(BE)?0?[0-9]{9}|(BG)?[0-9]{9,10}|(CY)?[0-9]{8}L|↵
(CZ)?[0-9]{8,10}|(DE)?[0-9]{9}|(DK)?[0-9]{8}|(EE)?[0-9]{9}|↵
(EL|GR)?[0-9]{9}|(ES)?[0-9A-Z][0-9]{7}[0-9A-Z]|(FI)?[0-9]{8}|↵
(FR)?[0-9A-Z]{2}[0-9]{9}|(GB)?([0-9]{9}([0-9]{3})?|[A-Z]{2}[0-9]{3})|↵
(HU)?[0-9]{8}|(IE)?[0-9]S[0-9]{5}L|(IT)?[0-9]{11}|↵
(LT)?([0-9]{9}|[0-9]{12})|(LU)?[0-9]{8}|(LV)?[0-9]{11}|(MT)?[0-9]{8}|↵
(NL)?[0-9]{9}B[0-9]{2}|(PL)?[0-9]{10}|(PT)?[0-9]{9}|(RO)?[0-9]{2,10}|↵
(SE)?[0-9]{12}|(SI)?[0-9]{8}|(SK)?[0-9]{10})$| Regex options: Case insensitive |
| Regex flavors: .NET, Java, JavaScript, PCRE, Perl, Python, Ruby |
Follow Recipe 3.6 to add this regular expression to your order form.
To make VAT numbers easier to read for humans, people often type them in
with extra punctuation to split the digits into groups. For
instance, a German customer might enter his VAT number DE123456789 as
DE
123.456.789.
A single regular expression that matches VAT numbers from 27 countries in any possible notation is an impossible job. Since the punctuation is only for readability, it is much easier to first strip all the punctuation, then validate the resulting bare VAT number.
The regular expression ‹[-.●]› matches a character that is a
hyphen, dot, or space. Replacing all matches of this regular
expression with nothing effectively deletes the punctuation
characters commonly used in VAT numbers.
VAT numbers consist only of letters and digits. Instead of
using ‹[-.●]› to remove only
common punctuation, you could use ‹[^A-Z0-9]› to strip out all invalid
characters.
The two regular expressions for validating the number are identical. The only difference is that the first one uses the free-spacing syntax to make the regular expression more readable, and to indicate the countries. JavaScript does not support free-spacing, but the other flavors give you the choice.
The regex uses alternation to accommodate the VAT numbers of all 27 EU countries. The essential formats are:
- Austria
U99999999
- Belgium
999999999 or 0999999999
- Bulgaria
999999999 or 9999999999
- Cyprus
99999999L
- Czech Republic
99999999, 999999999, or 9999999999
- Germany
999999999
- Denmark
99999999
- Estonia
999999999
- Greece
999999999
- Spain
X9999999X
- Finland
99999999
- France
XX999999999
- United Kingdom
999999999, 999999999999, or XX999
- Hungary
99999999
- Ireland
9S99999L
- Italy
99999999999
- Lithuania
999999999 or 99999999999
- Luxembourg
99999999
- Latvia
99999999999
- Malta
99999999
- Netherlands
999999999B99
- Poland
999999999
- Portugal
999999999
- Romania
99, 999, 9999, 99999, 999999, 9999999, 99999999, 999999999, or 9999999999
- Sweden
99999999999
- Slovenia
99999999
- Slovakia
999999999
Strictly speaking, the two-letter country code is part of the VAT number. However, people often omit it, since the billing address already indicates the country. The regular expression will accept VAT numbers with and without the country code. If you want the country code to be mandatory, remove all the question marks from the regular expression. If you do, mention that you require the country code in the error message that tells the user the VAT number is invalid.
If you accept orders only from certain countries, you can
leave out the countries that don’t appear in the country selection
on your order form. When you delete an alternative, make sure to
also delete the ‹|›
operator that separates the alternative from the next or previous
one. If you don’t, you end up with ‹||› in your regular expression. ‹||› inserts an alternative
that matches the empty string, which means your order form will
accept the omission of a VAT number as a valid VAT number.
The 27 alternatives are grouped together. The group is placed between a caret and a dollar sign, which anchor the regular expression to the beginning and ending of the string you’re validating. The whole input must validate as a VAT number.
If you’re searching for VAT numbers in a larger body of text,
replace the anchors with ‹\b› word boundaries.
The benefit of using one regular expression to check for all 27 countries is that you only need to add one regex validation to your order form. You could enhance your order form by using 27 separate regular expressions. First, check the country that the customer specified in the billing address. Then, look up the appropriate regular expression according to the country:
- Austria
‹
^(AT)?U[0-9]{8}$›- Belgium
‹
^(BE)?0?[0-9]{9}$›- Bulgaria
‹
^(BG)?[0-9]{9,10}$›- Cyprus
‹
^(CY)?[0-9]{8}L$›- Czech Republic
‹
^(CZ)?[0-9]{8,10}$›- Germany
‹
^(DE)?[0-9]{9}$›- Denmark
‹
^(DK)?[0-9]{8}$›- Estonia
‹
^(EE)?[0-9]{9}$›- Greece
‹
^(EL|GR)?[0-9]{9}$›- Spain
‹
^(ES)?[0-9A-Z][0-9]{7}[0-9A-Z]$›- Finland
‹
^(FI)?[0-9]{8}$›- France
‹
^(FR)?[0-9A-Z]{2}[0-9]{9}$›- United Kingdom
‹
^(GB)?([0-9]{9}([0-9]{3})?|[A-Z]{2}[0-9]{3})$›- Hungary
‹
^(HU)?[0-9]{8}$›- Ireland
‹
^(IE)?[0-9]S[0-9]{5}L$›- Italy
‹
^(IT)?[0-9]{11}$›- Lithuania
‹
^(LT)?([0-9]{9}|[0-9]{12})$›- Luxembourg
‹
^(LU)?[0-9]{8}$›- Latvia
‹
^(LV)?[0-9]{11}$›- Malta
‹
^(MT)?[0-9]{8}$›- Netherlands
‹
^(NL)?[0-9]{9}B[0-9]{2}$›- Poland
‹
^(PL)?[0-9]{10}$›- Portugal
‹
^(PT)?[0-9]{9}$›- Romania
‹
^(RO)?[0-9]{2,10}$›- Sweden
‹
^(SE)?[0-9]{12}$›- Slovenia
‹
^(SI)?[0-9]{8}$›- Slovakia
‹
^(SK)?[0-9]{10}$›
Implement Recipe 3.6 to validate the VAT number against the selected regular expression. That will tell you if the number is valid for the country the customer claims to reside in.
The main benefit of using the separate regular expressions is that you can force the VAT number to start with the correct country code, without asking the customer to type it in. When the regular expression matches the provided number, check the contents of the first capturing group. The recipe in Recipe 3.9 explains how to do this. If the first capturing group is empty, the customer did not type the country code at the start of the VAT number. You can then add the country code before storing the validated number in your order database.
Greek VAT numbers allow two country codes. EL is traditionally used for Greek VAT
numbers, but GR is the ISO country
code for Greece.
The regular expression merely checks if the number looks like a valid VAT number. This is enough to weed out honest mistakes. A regular expression obviously cannot check whether the VAT number is assigned to the business placing the order. The European Union provides a web page at http://ec.europa.eu/taxation_customs/vies/vieshome.do where you can check which business a particular VAT number belongs to, if any.
Techniques used in the regular expression are discussed in Recipes 2.3, 2.5 and 2.8.
Get Regular Expressions Cookbook now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
