Supplier master data before 2028: VAT, IBAN, peppol checks

Learn more about AI implementation in Luxembourg, and follow the e-invoicing bill on our 2028 tracker.

Every accounts-payable team has a supplier file that grew by accretion: a record created in a hurry for a one-off purchase, the same supplier entered twice under two spellings, a VAT number copied from an old invoice, an IBAN changed by email three years ago. For years none of it mattered much, because a person checked every invoice and every payment by eye.

That is ending. The two changes above both replace a person's judgement with an automated match, and an automated match fails on exactly the records a person used to wave through. I build supplier-data and invoice automation at 20 More, and this is the checklist I would use before either change hits your payment run.

Why is supplier data suddenly urgent?

Verification of Payee is already live. Regulation (EU) 2024/886 amended the SEPA rules so that, since 9 October 2025, payment service providers in the euro area must check the payee's name against the IBAN before the payer authorises a transfer. It applies to regular and instant credit transfers alike, it is free for the payer, and the answer is one of four: match, close match, no match, or verification not possible (EUR-Lex; European Payments Council). If your supplier record says "Dupont Sàrl" and the account belongs to "Dupont & Fils S.à r.l.", your approver now sees a warning on a payment that went through silently before.

E-invoicing is coming. Bill n° 8815, filed on 30 July 2026, would require every in-scope business to be able to receive structured e-invoices from 1 January 2028, with issuing obligations from 1 July 2028 for larger businesses and from 1 January 2029 for the others (dossier 8815). An e-invoice arrives as data, not as a PDF someone reads, and the first thing your system does with it is match the sender to a supplier record. If the VAT number on the invoice does not match the one in your file, the invoice lands in an exception queue.

The five fields that decide whether a record works

VAT number

A Luxembourg VAT number is LU followed by 8 digits (Guichet.lu). Check the format first, then check validity in the European Commission's VIES service. Know VIES's limits: it tells you whether a number is valid today, it cannot confirm validity on a past date, and it cannot search by company name (VIES FAQ). A clean result this week says nothing about next year, so the check has to repeat.

IBAN

An IBAN carries two check digits calculated with the MOD 97-10 method of ISO 7064, which catches most typing errors (SWIFT). A Luxembourg IBAN is 20 characters long (ABBL). The check-digit test is necessary but not sufficient: a perfectly valid IBAN can belong to someone else. That is what Verification of Payee now catches at payment time, and what your own process should catch at the moment an IBAN is changed.

Peppol ID

For Luxembourg organisations the Peppol identifier is the scheme 9938 followed by the VAT number in lower case or the 11-digit company number, for example 9938:lu12345678 (efacturation.public.lu). You do not need it for every supplier today, but you will need it for the ones who invoice you, so start collecting it now. Our guide on getting and checking a Peppol ID in Luxembourg explains why a lookup beats the directory.

How to clean the file without stopping payables

The mistake I see most is treating the clean-up as one big project on the whole file. Most of the file does not matter; the active part does. The sequence below works for a file of a few hundred to a few thousand suppliers:

1. Segment by activity. Pull every supplier paid or invoiced in the last 24 months. Everything else is a candidate for archiving, not cleaning. In most files this removes a large share of the records from scope.
2. Rank the active suppliers by spend. Clean from the top. A wrong IBAN on your largest supplier costs more than fifty errors on suppliers you pay once a year.
3. Run the automatic checks. VAT format and VIES, IBAN check digits, exact and near-duplicate names, the same IBAN on two suppliers, the same VAT number on two records. These are rules, not judgement, and they are exactly what software does well.
4. Send people the exceptions only. A person should look at the records the rules flag: a VAT number VIES rejects, two suppliers sharing a bank account, a name that differs from the bank's. That is a short list, not the whole file.
5. Collect what is missing in one contact. When you write to a supplier about a flagged record, ask for everything at once: legal name as registered, VAT number, IBAN confirmation on the bank's letterhead, and their Peppol ID.
6. Lock the front door. Change the onboarding form so a new supplier cannot be created without those fields, and route every IBAN change through a call-back to a number you already hold, never one given in the email requesting the change.

Step 6 is the one that decides whether you do this again in two years. A clean file with an open onboarding form decays back to its old state.

What to automate, and what to keep human

The split is simple once the fields are defined:

• Automate: format and check-digit validation, VIES checks on a schedule, duplicate detection, cross-checks between the supplier file and the invoices you receive (does the VAT number on this invoice match the record?), and the follow-up emails for missing fields.
• Keep human: approving an IBAN change, merging two records that might be two legal entities, blocking a supplier, and anything that involves calling a supplier about suspected fraud.

That is also how we structure a supplier data audit: the agents check every record and produce the exceptions with their evidence, and a person at 20 More signs off every risk decision before anything in your file changes. For the invoices themselves, the same data powers automated invoice processing, and our pricing is published.

Frequently asked questions

What is verification of payee?

It is a check your bank runs before you authorise a euro credit transfer: it compares the payee name you entered with the name on the account behind the IBAN and returns match, close match, no match or verification not possible. Under Regulation (EU) 2024/886, payment service providers in the euro area have had to offer it since 9 October 2025, for regular and instant transfers, free of charge.

Does a valid VIES result mean the supplier is fine?

No. VIES confirms that a VAT number is valid today. It does not confirm that the number belongs to the company named in your file, and it cannot tell you whether it was valid on the date of an old invoice. Treat it as one check among several and repeat it on a schedule.

When will we need our suppliers' peppol IDs?

As bill 8815 is drafted, you would need to be able to receive structured e-invoices from 1 January 2028, and your larger suppliers would start issuing them to you from 1 July 2028. Collecting Peppol IDs during 2027, together with the other fields, avoids a second round of supplier contact.

How long does a supplier file clean-up take?

It depends far more on how many suppliers are active than on the size of the file. Once inactive records are archived and the automatic checks have run, the human work is the exception list. If you want an estimate for your own file, tell us roughly how many active suppliers you have and which system holds them.