VAT Penalties for Digital Products: What You Owe

VAT Penalties for Digital Products: What You Owe

You sold a $19 ebook to someone in Germany. You sold a $49/mo SaaS sub to a designer in France. You sold a Notion template to a kid in the UK.

If you didn't collect VAT on any of those, the tax office in that country can come for it. Plus interest. Plus penalties that, in some EU member states, run to multiples of the original tax owed.

The scary part isn't the rate. It's that nobody tells you the clock has been ticking since your first sale.

Here's what penalties for unpaid VAT on digital products actually look like, who decides them, and the boring infra move that makes the whole problem disappear.

What VAT on digital products actually means

When you sell a digital product (ebook, SaaS sub, template, course, plugin, license key, downloadable game) to a consumer in the EU, UK, or any of ~80 other countries that have adopted similar rules, VAT is owed in the customer's country, not yours.

Germany: 19%. France: 20%. UK: 20%. Italy: 22%. Hungary: 27%.

If you sell from outside the EU, there's no threshold for cross-border digital B2C sales. One €5 PDF to one French customer means French VAT at the applicable rate.

If you're established in a single EU country, home-country VAT rules can apply while your combined cross-border EU consumer sales of goods and electronic services stay at or below €10,000 in both the current and preceding calendar year. You can choose customer-country VAT below that threshold. Above it, destination VAT applies from the sale that crosses the line.

The EU's One Stop Shop (OSS) lets you register once and file quarterly across all 27 member states. Non-EU sellers use the non-Union scheme, EU-based sellers the Union scheme.

Either way, you still have to register, collect, and remit.

If you don't, the country whose VAT you skipped can audit you. They can also share data with each other through the EU's administrative cooperation framework, which means getting caught in one country usually means getting caught in several. Today's OSS return is still the filing path. The ViDA timeline for SaaS is a later overlay, not a 2026 switch.

What every founder gets wrong about penalties

Most indie builders assume:

1. "If I'm under some revenue threshold, I'm fine."
2. "They won't come after a solo founder making $40k/year."
3. "I'll fix it when I get bigger."

None of these assumptions makes you safe, and the third one is the most expensive.

The threshold thing depends on where you're established. If you sell taxable electronic services from outside the EU, you owe customer-country VAT from your first EU consumer sale.

If you're eligible and established in one EU member state, the €10,000 threshold covers your combined cross-border EU consumer sales of goods and electronic services. Home-country VAT rules apply while those sales stay at or below it in both the current and preceding calendar year, unless you choose destination taxation.

The "they won't come after me" assumption ignores CESOP, operating since 1 January 2024.

Under CESOP rules, EU payment service providers report payees receiving more than 25 cross-border payments per calendar quarter. If your payments meet the reporting conditions, your payee and payment information goes into the EU's VAT anti-fraud database whether you registered for VAT or not.

The "I'll fix it later" thing is the killer. If you've owed VAT on EU SaaS sales for three years without paying it, you face three years of back VAT, plus applicable interest and country-specific penalties.

Waiting leaves that debt on your books.

The four penalty buckets

When a tax authority decides you owed VAT and didn't pay it, the bill can include these four categories. The charges depend on the country and offence:

1. The back VAT itself. The full tax that should have been collected, on every sale, from the date you became liable. You usually cannot pass this back to the customer at this point. It comes out of your margin.

2. Late-payment interest. Interest generally runs from the original payment due date. National rules determine the rate and how it is calculated.

3. Late-filing or late-registration penalty. Penalties depend on the country and offence and can be a percentage of tax due.

• France's late-filing penalty is 10%, rising to 40% when a return remains unfiled 30 days after formal notice.
• France has separate penalties of 40% for deliberate breaches and 80% for fraud.
• Germany's VAT Act §26a allows up to €30,000 for the specified VAT non-payment offence and up to €5,000 for relevant invoicing and record-keeping offences.

4. Criminal exposure for "deliberate evasion." Most countries draw a line between honest mistakes and intentional non-compliance. The UK's HMRC can pursue criminal charges with up to 7 years of prison for VAT fraud. In practice, indie founders almost never see jail. They see settlement letters with five-figure totals.

For a worked example: a SaaS founder doing $150k/year ARR split across EU customers, three years of non-compliance, can land between €25,000 and €60,000 in combined back VAT + interest + late penalties before any "deliberate" surcharge applies. That's not a number you negotiate down by saying "I didn't know."

Why this hits AI builders, indie SaaS, and creators hardest

The people most exposed right now:

• AI app founders running Stripe + a self-hosted EU customer base
• Indie SaaS shipping subs through LemonSqueezy or Paddle without understanding which one handles VAT
• Course creators selling through Gumroad, Whop, or Stan to a global audience
• Notion-template, Figma-plugin, and Shopify-app sellers who never touched tax until their first $10k month
• AI agent developers monetizing API access without registering anywhere

Stripe Payments leaves you as the legal seller. Stripe Tax calculates and collects tax and helps with registration and filing, but you keep the tax liability. Gumroad collects EU VAT but not US sales tax. LemonSqueezy and Paddle act as merchant of record, which actually does fix this. So does Creem.

That's the punchline most founders miss: this whole problem is solved by choosing the right payment infrastructure on day one.

The boring infra move that makes this disappear

A merchant of record (MoR) is a third party that legally becomes the seller of your product to the end customer. Your customer's receipt says "creem.io" or "Paddle" or "LemonSqueezy" on the line item. Yours says Creem paid you a payout.

Because the MoR is the seller of record, the MoR owes the VAT, not you. They register in every jurisdiction. They collect at checkout. They file the OSS returns. They pay the tax. They absorb the audit risk.

You ship the product, get a clean payout, and never think about Hungarian VAT registration thresholds again. See merchant of record for the full mechanic.

This is also true for sales tax in the US, GST in Australia and India, and equivalents in Japan, South Korea, and Singapore. One MoR covers all of them. The cost is bundled into your payment processing rate, which is why Creem's pricing is a single 3.9% + 40¢ instead of "Stripe + Stripe Tax + accountant + filing software + an OSS quarterly bill."

For comparison: a raw-processor stack (Stripe + Stripe Tax + Avalara + a tax accountant) for a $200k/year SaaS shipping EU + US easily runs $8k to $15k/year in tooling and labor, on top of Stripe's fees. An MoR stack runs zero, because it's bundled.

When you should NOT use an MoR

To be honest about the tradeoffs:

• Pure domestic businesses (you only sell to your home country, under threshold). MoR is overkill. Get a basic processor.
• High-volume marketplaces with thin margins. The bundled rate hurts when you're at 0.5% net margin per transaction. MoR economics are for SaaS, courses, AI products, anything with 70%+ gross margin.
• Regulated verticals where you need direct customer-of-record status (some B2B procurement contracts require it). Talk to a tax advisor first.

For everyone else (AI builders, indie SaaS, creators, solo founders, template shops) MoR is the cleanest move you'll make this year.

What to do this week

1. Pull a quick exposure check. Open your Stripe / processor dashboard. Filter to EU + UK customers. Multiply that revenue by 20%. That's your rough back-VAT exposure if you've been non-compliant.
2. Decide if you're switching infrastructure or registering yourself. Registering yourself means: OSS application, quarterly filings in EUR, accountant who knows VAT, software like Avalara or Quaderno.

Switching to an MoR means: change your checkout to Creem, done. Both are valid. One is cheaper and faster.

1. Don't keep selling unregistered while you decide. Every additional sale increases the exposure. Pause EU/UK signups for a week, or switch your checkout to an MoR the same day. See Creem docs for the migration path.

FAQ

What is VAT and who has to pay it on digital products?

VAT is a consumption tax charged in the customer's country on digital sales such as ebooks, SaaS, courses, templates and AI products.

In the EU, UK and ~80 other countries, the seller registers, collects and remits it on B2C sales. Non-EU sellers owe EU VAT from the first sale.

For eligible sellers established in one EU country, home-country VAT rules apply while combined cross-border EU consumer sales of goods and electronic services stay at or below €10,000 in both the current and preceding calendar year. You can choose customer-country VAT below that threshold.

What happens if you don't pay VAT on digital products?

You owe the back VAT plus interest from the original payment due date, and each country adds its own applicable late-registration and late-filing penalties.

In France, a late return costs 10% of the VAT owed, rising to 40% if it is still unfiled 30 days after a formal notice. Deliberate breaches carry a separate 40% penalty, and fraud carries 80%.

Can the EU tax office find indie founders?

Yes. Under CESOP rules, EU payment providers have reported payees receiving more than 25 cross-border payments per calendar quarter since 1 January 2024.

That data goes into a central EU database used by VAT anti-fraud teams, whether or not you registered for VAT.

Does Stripe handle VAT for digital products?

No. Stripe processes payments. Stripe Tax (an addon) calculates and collects tax and helps with registration and filing.

You still keep the tax liability and remain responsible for registration, filing and remittance wherever you owe tax. Stripe does not become the seller of record.

What's the difference between Stripe Tax and a merchant of record?

Stripe Tax calculates and collects tax and helps with registration and filing. You still owe the tax and remain responsible for filing and payment.

A merchant of record (Paddle, LemonSqueezy, Creem) legally becomes the seller on the sales it handles. It owes that tax, registers where those sales require it, and files on your behalf.

The first helps you manage tax, the second is a liability transfer.

How does Creem handle VAT?

Creem is a merchant of record. We register in every relevant jurisdiction, collect VAT and sales tax at checkout, file quarterly OSS returns and equivalents in the US, AU, IN, JP, KR, SG, and remit the tax to each authority. You get a clean payout. The 3.9% + 40¢ rate bundles all of this in.

Ship clean from day one. Start with Creem and never spell "Bundesfinanzministerium" again.