Identity: A forgotten theme in Digital Tax Reporting
Digital reporting of tax and VAT for businesses is being rolled out and will be a reality in many countries in a few years from now.
As Tax Authorities realize this shift with e-reporting and Continuous Transaction Controls (CTC), one theme is becoming impossible to ignore: identity.
Not just “who are you?” – but “who are you submitting a report for?”, “who authorized you to submit”, and “can that be verified in real time?”
Today a business submits periodical tax and VAT reports directly to the Tax Authority.
Simple
In the world of VAT in the Digital Age (ViDA) and CTC, that same business is likely to outsource report submission to its e-invoicing Service Provider. The provider submits Tax Data Documents (TDD) and handles compliance. Also relatively simple, until you look at it from the Tax Authority’s perspective and realize that every system built on automation requires certainty and trust. It must know which provider submitted the report, which taxpayer they represent, and whether that authorization is valid at the time of submission. Without that, real-time controls fall apart. CTC relies on trust. Trust relies on identity.
CTC relies on trust. Trust relies on identity.
Why the chain of identity matters
Every transaction involves at least four core identities in the 5-corner model that is likely to get widespread use in digital tax reporting:
- Corner 1 (seller) – The entity with tax obligations.
- Corner 2 – The Service Provider of the seller, submitting reports on the seller’s behalf.
- Corner 3 – The Service Provider of the buyer, submitting reports on the buyer’s behalf.
- Corner 4 (buyer) – The entity whose status determines deductions and rules.
- Corner 5 – The Tax Authority
If either identity is wrong, mismatched, or unverifiable, the entire chain of accountability breaks.
For example, a TDD submitted by an unauthorized Service Provider is not just an error, it’s a risk. Authorities can’t reconcile data, fight fraud, or guarantee the legal source of the report.
This is why identity is no longer a check-box in a system or in a form. Identity must be a part of the infrastructure.
The authorization challenge
When a business outsources its e-reporting, the tax authority must see evidence, not assumptions,that the service provider is allowed to report on behalf of the business.
Different countries solve this in different ways:
- Authorization registries where a taxpayer pre-registers their service provider, such as in UAE and in France.
- Digital delegation tokens cryptographically linking C1 → C2, such as in Italy and Portugal.
- API-based authorization flows where the tax authority issues tokens only after validating the authorization.
The pattern is the same: build an unbroken, auditable link from the taxpayer to the submitter.
Cross-border identity: where it gets messy
Domestic identity is not always easy, but cross-border identity is a much more challenging problem to solve.
Inside the EU, eIDAS 2.0 and digital wallets will strengthen interoperability. A company in one EU country will be able to prove its identity, and its authorizations, to another country’s tax authority.
But the moment a non-EU entity enters the picture, everything gets complicated:
- Different trust frameworks
- Different PKI systems
- No shared authorization model
- No automatic recognition of service providers
This is where frameworks such as the Peppol network can play an increasingly important role.
SMPs: from routing registries to trust registries
Today’s Service Metadata Publishers (SMPs) mainly tell you where to send documents.
In a CTC-driven world, they may also need to tell you who is allowed to send them.
That means adding:
- Verified C1, and possibly C4, identity data
- Delegation information
- Tax authority residency
- Tax eligibility
- Validation rules for specific jurisdictions
If SMPs evolve in this direction, they become more than directories, they become trust anchors for tax identity in a real-time reporting world.
The bottom line
CTC isn’t just about sending structured data. It’s about proving authenticity in a complex, fast-moving ecosystem. Therefore, identity needs to become an essential backbone of that ecosystem. This creates a need for companies or partnerships between companies that create solutions which support identity, authorization, and interoperability, across borders and regulations.
Curious to hear how Arratech can help? Get in touch and we can explain how our platform is setup to support CTC.
