Which is btw the exact opposite of what EU was supposed to promote. Doing business within EU should be simpler so that we could compete against companies operating in the unified American market.
They could have said, that business with less than X "foreign" income could still comply to their own countries taxation ... but no, with such a thing, they just created more bureaucracy and support the big players like Amazon, against which the regulation should have gone in the first place ... (at least, that was the explanation).
Even if you do MOSS it's still not one database lookup. For one thing, you need to get current VAT rates in the particular state that the customer is coming from, which is a significant amount of work just in making sure you're billing people correctly. A good e-Commerce platform will let you use complex tax rules but you still need to make sure that the users are linked to the correct country. If a user comes in, picks Luxembourg as their place of residence rather than Denmark and notices they're saving €30, they're likely to lie about which country they're in. You're required to collect and retain evidence about your supplies, so you end up in the situation where you're having to trust GeoIP to save you from customers looking for a discount at the expense of your tax records.
The regulation should in the first place go against the big players like Amazon .... but such badly as it was done now, it hurts the small businesses and start-ups. Another reason, that Europe is bad for Entrepreneurs!
We already ask for a billing address when a customer orders, and record the IP address, and we already do a location lookup by IP address on our cart, so we'll just need to check that there is a match, and do something to deal with it if there is not. I expect there will mostly be matches.
I took a look at our existing customers. Only about 0.1% did not have an IP address on file that matched the country they gave for their billing address. Most of the ones that did not match had a telephone number on file, and the telephone number appeared to be in the country of their billing address.
That raises a question. Suppose a new customer orders online, giving France as their country. Their IP address is also in France, at least according to the ip => location database you have. That's two pieces of non-contradictory evidence for France, and so you are good to go.
Are those two pieces of evidence only good for that particular sale? If the customer comes back a few months later and purchases again, again giving a French billing address but this time coming from a German IP address, can I use the French IP address from the first order and the French billing address from this order as sufficient evidence to again charge French VAT?
The VAT is supposed to be for the place the customer permanently resides, so for instance if that customer lives in France but is on vacation in Germany I'm supposed to charge French VAT. Billing address is much less likely to change during a vacation than IP address, so a person with two orders with French billing, and one French IP and one German IP, is probably far more likely to be a French resident temporarily in Germany than someone who has moved to Germany.
So, from a logical, common sense point of view, I'm inclined toward going with the customer's stated billing address country if they have any IP addresses from that same country among their last few orders. Logical and common sense don't alway match the law, though.
Another question is how to handle telephone sales. No IP address on a telephone sales. Figure it out from their phone number? Ask them to go to their computer and go to a page of ours, enter a number that the salesperson tells them, and hit "submit", and get an IP from that?
For example, you need to watch out for which currency you charge in vs. which currency you pay tax in, and how you calculate the exchange rates if these differ.
Another possible problem area is relying entirely on a country code to determine which tax rate to apply. Sometimes islands or other secondary locations might use the same country code as their "home country" but have different tax rules.
Then there are the data protection implications. I've seen several sources you would expect to be reliable today, and even those don't seem to agree on whether or not the requirements to keep location data for 10 years will mean businesses that were otherwise not required to register with the local data protection authority will now have to do so.
No doubt more catches will be identified as the panic continues over the next few days...