VAT Penalties for Digital Products: What You Owe
You sold a $19 ebook to someone in Germany. You sold a $49/mo SaaS sub to a designer in France. You sold a Notion template to a kid in the UK.
If you didn't collect VAT on any of those, the tax office in that country can come for it. Plus interest. Plus penalties that, in some EU member states, run to multiples of the original tax owed.
The scary part isn't the rate. It's that nobody tells you the clock has been ticking since your first sale.
Here's what penalties for unpaid VAT on digital products actually look like, who decides them, and the boring infra move that makes the whole problem disappear.
What VAT on digital products actually means
When you sell a digital product (ebook, SaaS sub, template, course, plugin, license key, downloadable game) to a consumer in the EU, UK, or any of ~80 other countries that have adopted similar rules, VAT is owed in the customer's country, not yours.
Germany: 19%. France: 20%. UK: 20%. Italy: 22%. Hungary: 27%.
There's no minimum threshold for cross-border digital B2C sales in the EU. You sell one €5 PDF to one French customer, you owe France 20%. The EU's One Stop Shop (OSS) scheme lets you register once and file quarterly across all 27 member states, but you still have to register, collect, and remit.
If you don't, the country whose VAT you skipped can audit you. They can also share data with each other through the EU's administrative cooperation framework, which means getting caught in one country usually means getting caught in several.
What every founder gets wrong about penalties
Most indie builders assume:
- "If I'm under some revenue threshold, I'm fine."
- "They won't come after a solo founder making $40k/year."
- "I'll fix it when I get bigger."
All three are wrong, and the third one is the most expensive.
The threshold thing is true for goods inside one country. It is not true for cross-border B2C digital sales in the EU. The "small business" exemptions apply to your home country, not to the country you owe VAT in.
The "they won't come after me" thing is half right today, half wrong by 2027. EU tax authorities are now sharing payment data via DAC8 (the eighth Directive on Administrative Cooperation), which forces payment processors and crypto platforms to report cross-border transactions. Your Stripe payouts to a French customer become visible to the French tax authority whether you registered or not.
The "I'll fix it later" thing is the killer. Penalties compound from the date of the first unregistered sale. If you've been shipping a SaaS to EU customers for three years without OSS, you don't owe three months of back VAT. You owe three years, plus interest, plus per-country late-filing penalties.
The four penalty buckets
When a tax authority decides you owed VAT and didn't pay it, you generally face four separate charges, not one. The exact mix depends on the country, but the structure is universal:
1. The back VAT itself. The full tax that should have been collected, on every sale, from the date you became liable. You usually cannot pass this back to the customer at this point. It comes out of your margin.
2. Late-payment interest. Daily-compounded interest from the original due date. EU member states range from ~3% to ~12% annually, set by national finance ministries and updated yearly.
3. Late-filing or late-registration penalty. A fixed fee per missed filing period, often €100 to €500 per quarter, per country. France charges 10% of the VAT due as a base penalty, increased to 40% if you're judged to have acted deliberately, and 80% if fraud is found. Germany's fine structure tops out at €25,000 per violation under §26a of its VAT Act.
4. Criminal exposure for "deliberate evasion." Most countries draw a line between honest mistakes and intentional non-compliance. The UK's HMRC can pursue criminal charges with up to 7 years of prison for VAT fraud. In practice, indie founders almost never see jail. They see settlement letters with five-figure totals.
For a worked example: a SaaS founder doing $150k/year ARR split across EU customers, three years of non-compliance, can land between €25,000 and €60,000 in combined back VAT + interest + late penalties before any "deliberate" surcharge applies. That's not a number you negotiate down by saying "I didn't know."
Why this hits AI builders, indie SaaS, and creators hardest
The people most exposed right now:
- AI app founders running Stripe + a self-hosted EU customer base
- Indie SaaS shipping subs through LemonSqueezy or Paddle without understanding which one handles VAT
- Course creators selling through Gumroad, Whop, or Stan to a global audience
- Notion-template, Figma-plugin, and Shopify-app sellers who never touched tax until their first $10k month
- AI agent developers monetizing API access without registering anywhere
Stripe does not collect or remit VAT for you. Stripe Tax (the addon) calculates it, but you still register in every jurisdiction and remit yourself. Gumroad collects EU VAT but not US sales tax. LemonSqueezy and Paddle act as merchant of record, which actually does fix this. So does creem.
That's the punchline most founders miss: this whole problem is solved by choosing the right payment infrastructure on day one.
The boring infra move that makes this disappear
A merchant of record (MoR) is a third party that legally becomes the seller of your product to the end customer. Your customer's receipt says "creem.io" or "Paddle" or "LemonSqueezy" on the line item. Yours says creem paid you a payout.
Because the MoR is the seller of record, the MoR owes the VAT, not you. They register in every jurisdiction. They collect at checkout. They file the OSS returns. They pay the tax. They absorb the audit risk.
You ship the product, get a clean payout, and never think about Hungarian VAT registration thresholds again. See merchant on record for the full mechanic.
This is also true for sales tax in the US, GST in Australia and India, and equivalents in Japan, South Korea, and Singapore. One MoR covers all of them. The cost is bundled into your payment processing rate, which is why creem's pricing is a single 3.9% + 40¢ instead of "Stripe + Stripe Tax + accountant + filing software + an OSS quarterly bill."
For comparison: a raw-processor stack (Stripe + Stripe Tax + Avalara + a tax accountant) for a $200k/year SaaS shipping EU + US easily runs $8k to $15k/year in tooling and labor, on top of Stripe's fees. An MoR stack runs zero, because it's bundled.
When you should NOT use an MoR
To be honest about the tradeoffs:
- Pure domestic businesses (you only sell to your home country, under threshold). MoR is overkill. Get a basic processor.
- High-volume marketplaces with thin margins. The bundled rate hurts when you're at 0.5% net margin per transaction. MoR economics are for SaaS, courses, AI products, anything with 70%+ gross margin.
- Regulated verticals where you need direct customer-of-record status (some B2B procurement contracts require it). Talk to a tax advisor first.
For everyone else (AI builders, indie SaaS, creators, solo founders, template shops) MoR is the cleanest move you'll make this year.
What to do this week
- Pull a quick exposure check. Open your Stripe / processor dashboard. Filter to EU + UK customers. Multiply that revenue by 20%. That's your rough back-VAT exposure if you've been non-compliant.
- Decide if you're switching infrastructure or registering yourself. Registering yourself means: OSS application, quarterly filings in EUR, accountant who knows VAT, software like Avalara or Quaderno. Switching to an MoR means: change your checkout to creem, done. Both are valid. One is cheaper, faster, and survives DAC8.
- Don't keep selling unregistered while you decide. Every additional sale increases the exposure. Pause EU/UK signups for a week, or switch your checkout to an MoR the same day. See creem docs for the migration path.
FAQ
What is VAT and who has to pay it on digital products?
VAT is a consumption tax charged in the country of the customer for digital sales (ebooks, SaaS, courses, templates, AI products). In the EU, UK, and ~80 other countries, sellers must register, collect, and remit VAT on every B2C cross-border digital sale, with no minimum threshold for EU B2C.
What happens if you don't pay VAT on digital products?
You owe back VAT plus interest from the date of the first sale, plus late-registration and late-filing penalties per country. In France that base penalty is 10% of VAT owed, rising to 40% or 80% if the authority judges the non-compliance as deliberate or fraudulent.
Can the EU tax office find indie founders?
Yes, more easily every year. DAC8 (effective rolling in 2026) requires payment processors and crypto platforms to report cross-border transaction data to EU tax authorities. Your Stripe, PayPal, and processor payouts become visible whether you registered for VAT or not.
Does Stripe handle VAT for digital products?
No. Stripe processes payments. Stripe Tax (an addon) calculates the right rate at checkout, but you still register in every jurisdiction, file your own OSS returns, and remit the VAT yourself. Stripe does not become the seller of record.
What's the difference between Stripe Tax and a merchant of record?
Stripe Tax computes the tax. You still owe it, file it, and pay it. A merchant of record (Paddle, LemonSqueezy, creem) legally becomes the seller, so the MoR owes the tax, registers in every country, and files everything on your behalf. The first is a calculator, the second is a liability transfer.
How does creem handle VAT?
creem is a merchant of record. We register in every relevant jurisdiction, collect VAT and sales tax at checkout, file quarterly OSS returns and equivalents in the US, AU, IN, JP, KR, SG, and remit the tax to each authority. You get a clean payout. The 3.9% + 40¢ rate bundles all of this in.
Ship clean from day one. Start with creem and never spell "Bundesfinanzministerium" again.
