Check the carrier before you hand over the load

How to check an EU carrier by VAT number

You check an EU carrier in three steps: the VAT number in the EU VIES system (is the number active and who is it registered to), the company register and transport licence in the country of registration (is the company operating, who runs it, does it hold a valid licence), and the sanctions lists. Then check the contact: is the e-mail domain new, or a look-alike of the real company's domain?

NSRoute does this in one lookup: enter the VAT number with its country prefix and the report collects the answers from several official sources, shows the risk signals and a decision with its reasons. Every result links to its source and shows the time of the request.

What we check

• EU VAT number in VIES — with a consultation number when you enter your own EU VAT number.
• Poland: VAT White List (taxpayer status, bank account match), KRS (liquidation, bankruptcy, management board, shareholders, changes in the last 12 months), CRBR (beneficial owners, links to Russia and Belarus) and REGON (business suspended or ended).
• Transport licence checked automatically in official registers: Poland (KREPTD, GITD — with current and withdrawn licence extracts and the national permit), Bulgaria, Estonia, Finland, France, Lithuania, United Kingdom, Ukraine, USA. Other countries: a link to the official search and a manual confirmation in the report.
• Company registers by VAT number: Poland, Czechia, Lithuania, Latvia, Estonia, Finland, France, Belgium, Croatia, Slovenia (FURS taxpayer list), Norway, Romania, Switzerland and Liechtenstein. By the company registration number: Slovakia, United Kingdom, Ireland and Cyprus (in Ireland and Cyprus the name is matched against VIES). Ukraine by the EDRPOU code, USA by the US DOT number. Other EU countries: a link to the official company register search (and the insolvency search where the country offers one).
• Insolvency and tax: Slovakia (REPLIK), Switzerland (SHAB), Lithuania (AVNT, VMI tax arrears), Latvia (insolvency register, VID rating and suspension of activity), Estonia (EMTA tax debtors and quarterly turnover, taxes and employees), Slovenia (FURS tax debtors, VAT number withdrawn ex officio).
• EU, UK and US sanctions lists: the EU consolidated financial sanctions list, the UK Sanctions List (FCDO) and the US OFAC SDN list, with the index refreshed daily. The company name is screened, not its shareholders or beneficial owners.
• Company name consistency (and the postal code in Poland) across register responses.
• Contact domain and e-mail: domain age, MX record, look-alike domains.
• Registered domains similar to the carrier's e-mail domain (a letter added or removed, a doubled letter, characters that look like letters, another domain ending), each with its registration date.
• SPF and DMARC of the e-mail domain: how easy it is to send a forged e-mail from it.
• Czechia: the ISIR insolvency register by IČO, the commercial register history (management board, shareholders, name, registered office) and the VAT payer register with bank accounts.
• France: insolvency notices in BODACC. Romania: taxpayer and VAT registration status in ANAF.

How this differs from checking one register

A single register answers a single question. VIES confirms that a VAT number is active, but it does not tell you whether the company holds a transport licence, has just changed its management, or whether the e-mail you received comes from its domain. A licence register says nothing about insolvency, and an insolvency register nothing about sanctions.

Hijacked-carrier fraud looks correct in every register on its own: a real company, an active VAT number, a valid licence. It shows only when several sources are put side by side: a recent management change together with a change of shareholders, a bank account in another country than the registered office, an e-mail domain registered a few weeks ago. NSRoute puts these answers in one report and compares the company name across registers.

Risk signals we catch

• Hijacked company: a management change in the last 6 months together with a change of shareholders, address or name.
• A young company or a domain registered a few weeks ago.
• A bank account in a different country than the carrier's registered office.
• A free mailbox instead of a company domain.
• A company name that differs between registers.
• A recently registered domain that looks like the carrier's domain.
• An e-mail domain without DMARC, or with a policy that does not block forged e-mail: confirm bank details and payment changes by phone.
• Ongoing insolvency proceedings in the Czech ISIR (STOP) or an undecided insolvency petition (caution).

What you get

• A decision: ready to book, caution, high risk or STOP — with the reasons behind it.
• The controls still missing: CMR liability insurance, a call-back to a number from an independent source, the vehicle check at loading.
• On PRO and FLEET: a signed PDF and JSON report with hashes of the register responses — a record of what was checked and when — and monitoring of changes for carriers you follow.

Plans

API for your system (PRO and FLEET)

• Create a key in the app: Carrier verification → “Report authenticity, watch-list and alerts” → API for your system. Up to 5 keys per account; a key is shown once and NSRoute keeps only its hash.
• Call: POST https://api.nsroute.com/v1/carrier-checks with the header Authorization: Bearer <key> and a JSON body with vatId (with the country prefix) and email (the carrier contact, may be empty).
• The response is the same signed JSON report as in the app: decision, checks, sources, signature. Texts are in English; "lang":"pl" (or the header Accept-Language: pl) returns them in Polish. Codes and statuses are the same in both. Up to 20 calls a minute per key; register queries from the API have a lower priority than checks run in the app.
• A key works only while the account has PRO or FLEET. Revoke it in the app at any time.

curl -X POST https://api.nsroute.com/v1/carrier-checks -H 'Authorization: Bearer nsr_live_…' -H 'Content-Type: application/json' -d '{"vatId":"PL1234567890","email":""}'

What the report does not do

• It does not guarantee the carrier's reliability and is not a confirmation by any insurer.
• It does not replace liability insurance or the check at loading.
• When a register does not answer, the report says "no data" — never a positive result.
• NSRoute does not store reports: keep the PDF and JSON yourself.