EPPO and OLAF gain access to VAT data: what changes for companies with intra-community operations

Key data

If your company sells or buys in other EU countries, your intra-community VAT data is now accessible to two European investigative bodies with the capacity to initiate criminal and administrative proceedings. The Regulation (EU) 2026/1743, published on 27 July 2026, amends Regulation (EU) No 904/2010 to open this access to the European Public Prosecutor's Office (EPPO) and the European Anti-Fraud Office (OLAF).

This is not a minor reform. Until now, VAT cooperation was fundamentally between national tax administrations. With this change, two bodies with investigative and sanctioning mandates enter the European tax information circuit.

What does this regulation establish?

The regulation introduces a structural change in the framework of administrative cooperation on VAT in the EU. The specific changes are as follows:

The logic behind the change is clear: VAT fraud, especially carousel fraud and that linked to cross-border e-commerce, generates millions in losses for the European budget. By giving access to bodies with criminal investigation capacity (EPPO) and administrative capacity (OLAF), the EU closes a gap that fraudsters exploited: the fragmentation of tax information between States.

Economic and operational impact

For most companies operating correctly, this regulation does not generate direct costs. However, it does have relevant operational consequences that should be anticipated:

• Higher probability of cross-border investigation: If an intra-community operation presents inconsistencies, it can now be detected and escalated by EPPO or OLAF, not just by the Spanish Tax Agency.
• Enhanced scrutiny in e-commerce: Platforms and sellers operating in multiple EU markets are one of the priority focuses of this type of regulation.
• International supply chains under scrutiny: Companies participating in chains with multiple intermediaries in different EU countries must review the traceability and documentation of their operations.
• Preventive compliance costs: Although no new sanctions are defined in this regulation, the increase in investigative risk justifies reviewing internal controls on intra-community VAT.

The impact is not symmetric: companies with simple and well-documented operations have little to fear. The real risk falls on those with complex structures, inconsistencies in their declarations or suppliers in chains with a history of fraud.

Who does it affect?

• Companies with intra-community operations: Any company that buys or sells goods or services to other companies in EU Member States and applies the intra-community VAT regime.
• E-commerce operators: Especially those selling to end consumers in several EU countries through digital platforms or their own stores.
• Companies with international supply chains: Manufacturers, distributors and importers working with suppliers or customers in multiple Member States.
• National tax authorities: They are obliged to facilitate access to VAT data to EPPO and OLAF when they request it, following established procedures.
• Tax advisors and CFOs: They must review the internal controls of their clients or companies in the new environment of greater cross-border surveillance.

Practical example

A Spanish distribution company buys merchandise from a supplier in Poland, resells it to a customer in France and applies VAT exemption in both operations as they are intra-community supplies. Until now, an inconsistency in that chain (for example, if the Polish supplier had not correctly declared VAT) could only be detected through cooperation between the tax agencies of Spain, Poland and France.

With Regulation (EU) 2026/1743, the EPPO or OLAF can directly access the VAT information of that operation at Union level, cross-check data from the three countries simultaneously and initiate an investigation if they detect irregularities. The Spanish distribution company could be involved in that investigation even if its actions were correct, simply for being part of a chain with a fraudulent link.

The practical conclusion: properly documenting each intra-community operation and verifying the tax status of suppliers ceases to be an optional good practice to become a necessity in a more powerful investigative environment.

What should companies do now?

1. Audit current intra-community operations: Review that all intra-community supplies and acquisitions are correctly declared in form 349 and in the corresponding VAT declarations.
2. Verify the tax status of key suppliers: Check that suppliers in other Member States are registered in VIES (EU VAT information exchange system) and that their VAT numbers are valid.
3. Review supporting documentation: Ensure that each intra-community operation has sufficient documentation: contracts, delivery notes, CMRs, invoices with correct data.
4. Assess exposure in e-commerce: If the company sells to consumers in other EU countries, verify compliance with the OSS regime (one-stop shop) and correct settlement of VAT at destination.
5. Inform the financial and tax team: The CFO and tax advisor must be aware of this change and assess whether it is necessary to strengthen internal controls or hire an external review of intra-community operations.

Official source

Consult complete regulation in official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202601743