European Legislation on Electronic Invoicing Ariba Invoice EU Regulatory and VAT Compliance September 2004
Table of Contents Executive Summary....................................................................3 Overview of EU Regulatory Environment...................................................5 Ariba Invoice Regulatory Compliance Status...............................................9 Ariba Directive [2001/115/EC] Compliance Details..........................................11 Ariba Directive [1999/93/EC] Compliance Details...........................................13 EU E-Invoicing Deployment Considerations...............................................15 Deloitte & Touche E-Invoicing VAT Services...............................................16 Appendix............................................................................17
Executive Summary This paper intends to provide complete details on the evolution of the regulatory environment on electronic invoicing and Ariba's latest compliance status, along with answers to the following frequently asked questions: "Is it legal to use Ariba Invoice in Country XX in Europe?" "What does the E-Signature Directive mean to me and my suppliers?" "Do I have to send invoices electronically starting January 1, 2004?" "What countries has Ariba Invoice been deployed to in Europe?" European Legislative Environment on E-Invoicing The regulatory environment in the European Union around the legality of electronic invoicing has evolved greatly from partial acceptance and country-specific and often confusing frameworks to a more harmonized and consistent practice across different Member States. The latest legislative implementations of EU Directives in most European countries have created an open environment for companies to adopt electronic invoicing within the same country and across borders. This paper contains details on various regulatory Directives as well as country implementation details to assist companies in evaluating how to deploy electronic invoicing solutions in various EU Member States. Ariba Invoice Regulatory Compliance in Europe In March 2002, Ariba released its electronic invoicing solution that allows suppliers to transmit electronic invoices to buying customers over the Ariba Supplier Network securely and efficiently. Ariba Invoice is being rapidly adopted by many European customers and/or Global 1000 customers with large operations in Europe, such as British Sky TV, HSBC, Unilever, Skandia, Johnson Matthey, Morgan Stanley and AT&T. Copyright 2004 Ariba, Inc. All rights reserved. 3
By working closely with VAT specialists such as the Deloitte & Touche VAT Group, Ariba continually monitors legal requirements, develops and enhances its products to ensure full regulatory compliance with the latest laws and regulations. As customers deploy the solution globally, Ariba intends to deliver further product solutions with full compliance with legal and regulatory requirements, such as electronic signature support in electronic invoicing. 4 Copyright 2004 Ariba, Inc. All rights reserved.
Overview of EU Regulatory Environment The legislative environment in the European Union on Electronic Invoicing has gone through dramatic changes over three major phases as outlined below. "Pre-Directive" Era (1990 ~ 1999) Prior to the introduction of the EU E-invoicing Directive, the practice of using electronic invoicing in Europe can be best characterized with reluctance and confusion, caused by inconsistent and outdated country-specific rules and regulations, varying in acceptance from complete acceptance to complete refusal. Many Member States sanctioned businesses to obtain prior authorization from local VAT authorities before using any electronic invoicing solutions. Between 2001 and 2002, Ariba actively worked with EU VAT authorities and the largest accounting and audit firms specializing in e-invoicing and VAT to obtain appropriate local authority approvals. EU Directive Introduction (1999 ~ 2002) The EU Council introduced two major directives between 1999 and 2002 to (i) address the concerns and barriers caused by the inconsistent national practices; (ii) promote the adoption of new e-commerce technologies across EU Member States; and (iii) introduce harmonized procedures for e-invoicing across Member State borders in a homogenous home market. 1 Sourcing Interest Group, Research Report - Procurement Outsourcing, February 2003, www.sourcinginterest.com Copyright 2004 Ariba, Inc. All rights reserved. 5
EU E-Signature Directive [1999/93/EC] In November 1999, the European Union released the Directive [1999/93/EC] that established the legal framework for implementing electronic signatures; a prerequisite for ensuring the security of data that is transmitted electronically in the practice of electronic invoicing. The purpose of this Directive was to facilitate the use of electronic signatures and to ensure that a digital signature was not denied legal effect, validity and enforceability. Some of the highlights and definitions of the Directive include: Must be uniquely linked to the signatory, Art. 2 (b); Create invoices using means that the signatory can maintain under his sole control; and Link invoices to the data to which it relates in such a manner that any subsequent change of the data is detectable. EU E-Invoicing Directive [2001/115/EC] In December 2001, another EU Council Directive [2001/115/EC] was passed to clarify the implementation of electronic invoicing throughout the Member States. The Directive requires EU Member States to recognize the validity of electronic invoices and allow cross-border electronic invoicing, provided that the authenticity of the origin and integrity of the contents are guaranteed. Highlights of the Directive include: Approved mandatory VAT information on all e-invoices, Art. 2 (b); Ensure Authenticity of origin and integrity of the data; and Member States define time period for secure storage of e-invoices. To guarantee the data integrity, three options are allowed: Advanced electronic signature (AES). Member States may however ask for the advanced electronic signature to be based on a qualified certificate; Electronic data interchange (EDI) as defined in [1994/820/EC]; and Other electronic means accepted by the Member State(s) concerned. Member State Directive Implementation (2003 ~ 2004) As required by the Directive, all EU Member States must have implemented the EU E-Invoicing and E-Signature Directives into national legislations by January 1, 2004, with the exception of the ten new EU accession Member States, which must have implemented the Directives by May 1, 2004. 3 Sourcing Interest Group Research Report - Procurement Outsourcing, February 2003, www.sourcinginterest.com 6 Copyright 2004 Ariba, Inc. All rights reserved.
The table below summarizes the current legislative status in all 25 EU Member States and Switzerland. Member State EU Directive Implementation Status 4 Forrester Research, BPO's Fragmented Future, August 2003 Copyright 2004 Ariba, Inc. All rights reserved. 7
Please note that while this white paper focuses on EU electronic invoicing, selected Asia Pacific (APAC) countries are also utilizing E-Invoicing procedures. APAC countries, including Singapore, allow the electronic issuance of VAT/GST invoices. In Singapore, a company does not need prior approval from the Inland Revenue Authority of Singapore to issue or receive E-invoices. The company must, however, comply with a set of invoicing rules as outlined in the Singapore Electronic Invoicing guide. E-Invoicing is also possible in at least the following APAC countries: Australia; South Korea; and Taiwan. There have been minimal developments towards E-Invoicing initiatives in Latin America and the Caribbean. 8 Copyright 2004 Ariba, Inc. All rights reserved.
Ariba Invoice Regulatory Compliance Status Ariba Invoice Is Fully Compliant With EU Directives In partnership with leading accounting and VAT audit firms such as Deloitte & Touche, KPMG and formally Arthur Andersen, Ariba conducted extensive research and product development to ensure that the Ariba E-Invoicing solution supports EU rules and regulations. As of April 2004, Ariba Invoice is fully compliant with EU Directives and pertaining Member State legislations. Using the same diagram depicting EU Directive structure, Ariba's compliance is highlighted in green: As demonstrated by the diagram above, Ariba Invoice supports both the EU Directives and their respective rules, terms and guidelines. This enables companies to rapidly adopt electronic invoicing practices in a harmonized legislative environment in Europe. Ariba Invoice Can be Legally Deployed in EU Member States and Switzerland Prior to the national implementation of EU E-Invoicing Directives, the Ariba Invoice solution had been widely deployed around the world, including a number of EU Member States. Customers should note that the implementation and use of Ariba Invoice in Europe may be subject to country-level notification procedures and/or maintenance for both paper and electronic invoices for VAT reclaim audit purposes until December 31, 2005. However, most countries will allow a simple notification from Ariba users to the local VAT authorities, stating that the company will be using Ariba Invoice for the e-invoicing from a certain Copyright 2004 Ariba, Inc. All rights reserved. 9
date. Please note that all parties that apply e-invoicing (buyers and sellers) must file the notification. The newly implemented EU Directives allow companies to rapidly deploy Ariba Invoice in the 25 EU Member States and Switzerland. The following table provides complete details on EU countries where Ariba Invoice has already been deployed, country Directive implementation status, and electronic signature type required by the country when deploying e-invoicing. EU Member States EU Directive Implementation Status Note: For more details on the difference between "Advanced Signature" and "Qualified Signature", please go to the "Technical and Compliance Details" section. 10 Copyright 2004 Ariba, Inc. All rights reserved.
Ariba Directive [2001/115/EC] Compliance Details Ariba Invoice Meets Mandatory VAT Data Requirements The EU E-invoicing Directive lists nine compulsory invoice requirements and five additional mandatory requirements. Ariba Invoice and Ariba Supplier Network support all of the requirements. In cases where additional countryspecific data is required, Ariba Invoice can be easily extended to capture those fields. Please refer to the diagram below for the compulsory invoice details. Additional Requirements 1) Where a supply is VAT-exempt, zero-rated or subject to reverse charge procedure, include: a statement explaining that this is the case; a reference to the appropriate (community or national) legislation that deems the supply exempt or subject to the reverse charge procedure; or a reference to the appropriate (community or national) legislation that deems supply is zero-rated for intra-community transactions. Copyright 2004 Ariba, Inc. All rights reserved. 11
2) Where there is an Intra-Community supply of a new means of transport, the particulars specified in the 6th EU VAT Directive, i.e. the reason why the supply qualifies as a new means of transport (e.g. for a car: age and mileage) 3) Where the margin scheme is applied, include a statement explaining that this is the case or a reference to relevant legislation 4) Where the person liable to pay the tax is a tax representative, include tax representative's details: VAT number, full name and address 5) Where the customer accounts for VAT (i.e. for an intra-eu supply or reverse charge transaction), the customer VAT number is required on the invoice. For all other transactions, the customer's VAT number is optional. Ariba Invoice Securely Stores All Original Invoices Upon receipt of all incoming cxml invoices, Ariba Invoice securely and electronically stores all cxml invoices in its original electronic form, along with the electronic signature that accompanies them. The length of the storage is subject to Member EU country requirements. Only designated users will be allowed access to retrieve the original invoices. Once stored, the original invoices CANNOT be edited or modified. All edits, disputes and reconciliation activities will occur on a "shadow" document ("Invoice Reconciliation" document) within the Ariba system. Ariba Invoice Supports EDI Invoices Ariba Supplier Network supports EDI invoices in both ANXI.12 and EDIFACT formats, as defined by the EU E-Invoicing Directive. All original EDI invoices, along with digital signatures, will be securely stored in the Ariba EDI transaction network. Upon the request from Ariba customers and/or tax authorities in the event of review and audit, the original EDI/EDIFACT invoice, along with its accompanying electronic signature, will be retrieved and provided by Ariba. Ariba Invoice Supports Advanced E-Signatures Please see Section 5: Ariba Directive [1999/93/EC] Compliance Details for details on how Ariba supports e-signatures. 5 Aberdeen Group, You Will Outsource Procurement: Here's Why and How, October 16 2002 12 Copyright 2004 Ariba, Inc. All rights reserved.
Ariba Directive [1999/93/EC] Compliance Details E-Signature Basics ("Digital Signature") E-signatures are used to ensure that the content of an electronic invoice cannot be altered after submission, serving as a method of authentication. A digital signature can be used to sign the entire electronic document, or just a specific area of the document. According to the EU E-Signature Directive, there are two types of E- signatures permitted: "Advanced Electronic Signature" and "Qualified Electronic Signature", whose definitions are depicted in the diagram below. In general, EU Member States require, at minimum, an Advanced E-Signature. However, the EU Directive does allow the use of "Qualified E-Signature" at Member States' discretion. Ariba Invoice Supports Advanced and Qualified Electronic Signature As of the Mars release (Q2 2004), Ariba Invoice and Ariba Supplier Network support the signing, validation, storage and retrieval of e-invoices with e- signatures in accordance with the EU E-Signature Directive. Starting AN40, suppliers can submit electronic invoices with e-signatures through the Ariba Supplier Network. The picture below illustrates how Ariba supports e-signatures: Copyright 2004 Ariba, Inc. All rights reserved. 13
E-Signature on cxml Invoice Starting with the Ariba SN40 release, the cxml standard is extended so electronic signatures can be embedded in every cxml electronic invoice document using XAdES format. This allows all invoice content to be electronically signed to ensure the future validation of content integrity (Note: cxml envelop-level routing content will not be electronically signed as they may change during the transportation of the invoice document, i.e. new server level time stamp). Customers and/or VAT authorities can retrieve the original electronic invoice from the secure storage location for review and audit against e-signatures. E-Signature Rule Configuration Since e-signature requirements and readiness may vary by region, customer and supplier, the Ariba SN40 release allows customers to configure "Digital Signature Rules" on a per-supplier basis, meaning customers can explicitly define which suppliers are required to send e-invoices with e-signatures. Once specified, the Ariba Supplier Network will enforce this business rule by automatically checking incoming invoices against customer configuration for each trading supplier, rejecting invoices without valid e-signatures if required by the configuration. E-Signature Verification If an e-signature is required, the Ariba Supplier Network will perform a verification function on incoming invoices and automatically reject the invoice if it does not contain an e-signature or the e-signature contained is no longer valid. Only invoices with valid e-signatures will be passed to the Ariba Invoice application for download and reconciliation. Once downloaded, the invoice will be re-validated before storage in the customer's local database. Furthermore, customers may use any other compatible third party electronic validation software/tool to verify the incoming invoices and signatures at a later time, such as those provided by digital signature issuing authorities, to verify the electronic signature against a set of public keys (PKI) to detect whether or not the contents of the invoice have been altered. E-Signature Subscription Service To comply with country- and customer-specified e-signature requirements, suppliers must be able to digitally sign the electronic invoices submitted through the Ariba Supplier Network. Suppliers may choose to independently implement their own e-signature support as part of their overall IT infrastructure (See "cxml Supplier Guide" for more details on how to enable e-signature and communicate with Ariba SN), or leverage a third party service provider to digitally sign e-invoices for them. To provide a cost-effective alternative solution to suppliers to do electronic invoicing in Europe, the AN 40 release will offer an "E-Signature" service on a "Pay-Per-Use" subscription service. Once subscribed, the service will digitally sign e-invoices on behalf of the supplier using Qualified Certificates, Ariba Private Keys and Secured Signature Creation Device (SSCD, or, Smart Card) based on the EU E-Signature Directive standards. The service is available to all suppliers regardless of their invoicing method, i.e. PO Flip, cxml or EDI. The Signature Service provided by Ariba will ensure that the invoice contents generated through the Ariba Supplier Network will not be compromised after it is generated. 14 Copyright 2004 Ariba, Inc. All rights reserved.
EU E-Invoicing Deployment Considerations Which Country/Countries to Deploy? Assess your current practices and determine which countries, divisions or subsidiaries need process adaptation. If invoicing is managed at an SSC level, determine a project roll-out plan. In adapting to the EU invoicing rules, consider moving towards a more widespread use of e-invoicing. Expect that paper invoices will still exist and the two processes might run simultaneously in the short to medium term. Consider how to support proper reporting for financial and tax obligations. In terms of tax compliance, it remains each customer's responsibility to demonstrate to the tax authorities that the way that they are using our solution does comply with tax requirements in terms of invoice transaction, invoice data content, tax calculations and invoice storage. E-Signature or Paper? The goal of the EU Directives is to help businesses move away from costly paper processes. For companies that wish to remove paper invoices from the process and be exempt from the regulatory approval hassles, especially in countries where legislations on e-signature are already in place, they should inform its suppliers to prepare for the use of electronic signatures. Companies should embrace electronic invoicing together with e-signatures. In countries where legislation has been fully implemented, companies should try to convince key suppliers to adopt e-signature technologies along with e-invoicing to leverage immediate mutual cost-saving benefits. What Does the E-Signature Directive Mean to Suppliers? The EU E-Signature Directive puts most obligations on suppliers in the context of electronic invoicing as suppliers are the party responsible for providing the e-invoices with valid e-signatures. This requires companies to proactively communicate to their suppliers on e-signature requirements. More importantly, suppliers need to allocate sufficient IT resources to implement e-signature infrastructure so invoices can be digitally signed prior to submitting into the Ariba Supplier Network. Depending on which country of operation, the supplier might need to obtain qualified certificates, secured signing device and private keys. Alternatively, depending on its technical capacity and actual invoice volume, the supplier may choose to use a third party ASP service, such as the one offered by Ariba, to accelerate its ability to comply with the EU Directives quickly and cost effectively. Copyright 2004 Ariba, Inc. All rights reserved. 15
Deloitte & Touche E-Invoicing VAT Services Deloitte & Touche, a strategic partner to Ariba, provides critical guidance to Ariba and its clients to ensure that the Ariba E-invoicing solution and deployment adhere to country-level VAT requirements. Ariba draws on the knowledge and experience of Deloitte's Global Indirect Tax Group to help achieve full compliance with the EU VAT Directives. Deloitte & Touche assists companies with (i) country-specific E-Invoicing deployment strategies based on local rules and specific requirements; and (ii) review and audit program compliance. Additionally, Deloitte maintains a subscription-based information website on the EU Invoicing Directive that can be consulted to obtain detailed information regarding: the Directive National legislation in each of the EU Member States; official guidance and publications; status summaries; an implementation timetable; developments in the 15 Member States and the 10 new Member States. Based on the extensive knowledge Deloitte gained over the past decade in advising its global clients with ERP implementation projects, the Deloitte VAT/ERP team is ideally placed to assist Ariba and its customers with designing the E-Invoicing and ERP architecture in line with the local VAT legislation. Furthermore, the Deloitte VAT/ERP team can give guidance by implementing best practices so that the Ariba E-Invoicing solution is used to the fullest extent from a VAT perspective and meets the customer's needs. The Deloitte team consists of VAT consultants who (i) specialize in dealing with the VAT-related issues during ERP and e-invoicing implementations; (ii) can negociate tax rulings on clients' behalf; and (iii) provide specialist support with tax audits and assessments. Please contact your local Deloitte & Touche team for more details, or contact our U.S.-based VAT/ERP team members: Robert Tsang (robtsang@deloitte.com) at (415.783.4257 / 212.436.2343); Mark Houtzager (markhoutzager@deloitte.com) at 212.436.3426; or Jan de Clercq (jdeclercq@deloitte.com) at 415.783.5029. For further information, contact your local Ariba account representatives, or visit us at www.ariba.com. 16 Copyright 2004 Ariba, Inc. All rights reserved.
Appendix Glossary Electronic Signature: data in electronic form that is attached to or logically associated with other electronic data and serve as a method of authentication; Advanced Electronic Signature: an electronic signature that meets the following requirements: it is uniquely linked to the signatory; it is capable of identifying the signatory; it is created using means that the signatory can maintain under his sole control; and it is linked to the data to which it relates in such a manner that any subsequent change of the data is detectable; Signatory: a person who holds a signature-creation device and acts either on his own behalf or on behalf of the natural or legal person or entity he represents; Signature Creation Data: unique data, such as codes or private cryptographic keys, which are used by the signatory to create an electronic signature; Signature Creation Device: configured software or hardware used to implement the signature-creation data; Secure Signature Creation Device: a signature-creation device that meets the requirements laid down in Annex III; Signature Verification Data: data, such as codes or public cryptographic keys, which are used for the purpose of verifying an electronic signature; Signature Verification Device: configured software or hardware used to implement the signature-verification-data; Certificate: an electronic attestation that links signature-verification data to a person and confirms the identity of that person; Qualified Certificate: a certificate that meets the requirements laid down in Annex I and is provided by a certification-service-provider who fulfils the requirements laid down in Annex II; Copyright 2004 Ariba, Inc. All rights reserved. 17
Certification Service Provider: an entity or a legal or natural person who issues certificates or provides other services related to electronic signatures; Electronic Signature Product: hardware or software, or relevant components thereof, which are intended to be used by a certificationservice-provider for the provision of electronic-signature services or are intended to be used for the creation or verification of electronic signatures; Voluntary Accreditation: any permission, setting out rights and obligations specific to the provision of certification services, to be granted upon request by the certification-service-provider concerned, by the public or private body charged with the elaboration of, and supervision of compliance with, such rights and obligations, where the certification-service-provider is not entitled to exercise the rights stemming from the permission until it has received the decision by the body. References and Useful Links CEN/ISSS Final Report of the einvoices Focus Group, adopted by the CEN/ISSS Forum on October 7th, 2003, http://www.cenorm.be Council Directive 2001/115/EC of 20 December 2001 amending Directive 77/388/EEC with a view to simplifying, modernizing and harmonizing the conditions laid down for invoicing in respect of value- added tax Official Journal L 015, 17/01/2002 P. 0024-0028 Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community Framework for Electronic Signatures, Official Journal L 013, 19/01/2000 P. 0012-0020 Commission Recommendation 1994/820/EC of 19 December 1994 relating to the legal aspects of electronic data interchange, Official Journal L 338, 28.12.1994, p. 98 18 Copyright 2004 Ariba, Inc. All rights reserved.
About Ariba, Inc. Ariba, Inc. is the leading Spend Management solutions provider. Ariba helps companies develop and leverage spend management as a core competency to drive significant bottom line results. Ariba Spend Management software and services allow companies to align their organizations with a spend-centric focus and deploy closed-loop processes for increased efficiencies and sustainable savings. For more information on procurement outsourcing, visit www.ariba.com or call 1-866-772-7422. Copyright 2004 Ariba, Inc. All rights reserved. 19