(1)

Council Directive 2006/112/EC (3) lays down the general value added tax (VAT) accounting obligations for taxable persons.

(2)

The growth of electronic commerce (‘e-commerce’) facilitates the cross-border sale of goods and services to final consumers in the Member States. In that context, cross-border e-commerce refers to supplies upon which the VAT is due in a Member State, but the supplier is established in another Member State, in a third territory or in a third country. However, fraudulent businesses exploit e-commerce opportunities in order to gain unfair market advantages by evading their VAT obligations. Where the principle of taxation at destination applies, since consumers have no accounting obligations, the Member States of consumption need appropriate tools to detect and control such fraudulent businesses. It is important to combat cross-border VAT fraud caused by the fraudulent behaviour of some businesses in the area of cross-border e-commerce.

(3)

For the vast majority of online purchases made by consumers in the Union, payments are executed through payment service providers. In order to provide payment services, a payment service provider holds specific information to identify the recipient, or payee, of the payment together with details of the date, the amount and the Member State of origin of the payment as well as of whether the payment was initiated at the physical premises of the merchant. That specific information is particularly important in the context of a cross-border payment where the payer is located in one Member State and the payee is located in another Member State, in a third territory or in a third country. Such information is necessary for the tax authorities of the Member States (the ‘tax authorities’) to carry out their basic tasks of detecting fraudulent businesses and controlling VAT liabilities. It is therefore necessary that payment service providers make that information available to the tax authorities to help them detect and combat cross-border VAT fraud.

(4)

To combat VAT fraud, it is important to require payment service providers to keep sufficiently detailed records and to report certain cross-border payments determined as such by reason of the location of the payer and the location of the payee. It is therefore necessary to define the concepts of location of the payer and location of the payee and also the means to identify those locations. The location of the payer and of the payee should only trigger the record keeping and reporting obligations for the payment service providers which are established in the Union and those obligations should be without prejudice to the rules laid down in Directive 2006/112/EC and in Council Implementing Regulation (EU) No 282/2011 (4) as regards the place of a taxable transaction.

(5)

On the basis of information they already hold, payment service providers are able to identify the location of the payee and the payer in relation to the payment services they provide, using an identifier of the payer’s or the payee’s payment account or any other identifier which unambiguously identifies, and gives the location of, the payer or the payee. When such identifiers are not available, the location of the payer or the payee should be determined by means of a business identifier code of the payment service provider acting on behalf of the payer or the payee, in cases where the funds are transferred to a payee without any payment account being created in the name of a payer, where the funds are not credited to any payment account of the payee or where there is no other identifier of the payer or the payee.

(6)

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (5), it is important that the obligation of a payment service provider to retain and provide information in relation to a cross-border payment be proportionate and limited to that which is necessary for Member States to combat VAT fraud. Furthermore, the only information relating to the payer that should be retained is the location of the payer. With regard to information relating to the payee and the payment itself, payment service providers should only be required to retain and report to the tax authorities information which is necessary for those authorities to detect possible fraudsters and to carry out tax controls. Payment service providers should therefore be required to keep records only on those cross-border payments which are likely to indicate economic activities. The introduction of a ceiling based on the number of payments received by a payee over the course of a calendar quarter would give an indication whether those payments were received as part of an economic activity, thereby excluding payments for non-commercial reasons. Where such a ceiling is reached, the record keeping and reporting obligations of the payment service provider would be triggered.

(7)

It is possible for several payment service providers to be involved in a single payment by a payer to a payee. That single payment can give rise to several transfers of funds between different payment service providers. It is necessary that all payment service providers involved in a given payment, unless a specific exclusion is applicable, have record keeping and reporting obligations. Those records and reports should contain information on the payment from the initial payer to the final payee and not on the intermediate transfers of funds between the payment service providers.

(8)

Record keeping and reporting obligations should apply not only where a payment service provider transfers funds or issues payment instruments for the payer, but also in cases where a payment service provider receives funds or acquires payment transactions on behalf of the payee.

(9)

The obligations laid down in this Directive should not apply to payment service providers which fall outside the scope of Directive (EU) 2015/2366 of the European Parliament and of the Council (6). Therefore, where the payment service providers of the payee are not located in a Member State, it is the payment service providers of the payer that should be subject to the record keeping and reporting obligations of the cross-border payment. Conversely, in order for the record keeping and reporting obligations to be proportionate, where the payment service providers of both the payee and the payer are located in a Member State, only the payment service providers of the payee should keep records. For the purposes of the record keeping and reporting obligations, a payment service provider should be considered to be located in a Member State when its business identifier code (BIC) or unique business identifier refers to that Member State.

(10)

Due to the significant volume of information and its sensitivity in terms of the protection of personal data, it is necessary and proportionate that payment service providers keep records in relation to cross-border payments for a period of three calendar years in order to assist Member States in combating VAT fraud and detecting fraudsters. That period provides sufficient time for Member States to carry out controls effectively and to investigate suspected VAT fraud or to detect VAT fraud.

(11)

The information to be retained by the payment service providers is to be collected by and exchanged between the Member States in accordance with Council Regulation (EU) No 904/2010 (7) which lays down the rules for administrative cooperation and exchange of information in order to combat VAT fraud.

(12)

VAT fraud is a common problem for all Member States, but individual Member States do not have the information necessary to ensure that VAT rules regarding cross-border e-commerce are correctly applied or to combat VAT fraud in cross-border e-commerce. Since the objective of this Directive, namely to combat VAT fraud, cannot be sufficiently achieved by the Member States individually if there is a cross-border element, and due to the need to obtain information from other Member States, but can rather, by reason of the scale or effects of the action, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Directive does not go beyond what is necessary in order to achieve that objective.

(13)

This Directive respects the fundamental rights and observes the principles recognised by the Charter of Fundamental Rights of the European Union, in particular the right of protection of personal data. The payment information retained and provided in accordance with this Directive is to be processed only by the anti-fraud experts of tax authorities within the limits of what is proportionate and necessary to achieve the objective of this Directive, namely to combat VAT fraud. This Directive also respects the rules laid down in Regulation (EU) 2016/679 and in Regulation (EU) 2018/1725 of the European Parliament and of the Council (8).

(14)

The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 and delivered an opinion on 14 March 2019 (9).

(15)

Directive 2006/112/EC should therefore be amended accordingly,