EU VAT Number (Generic) Regex for JavaScript

What this pattern does

This page provides a comprehensive, battle-tested regular expression for matching eu vat number (generic), ported and verified for JavaScript. Financial data validation has zero tolerance for false negatives — a missed invalid entry can corrupt downstream calculations. The snippet below is ready to drop into your JavaScript project — whether you're validating in an Express middleware, a Next.js API route, or a client-side form.

Javascript Implementation

// EU VAT Number (Generic)
// ReDoS-safe | RegexVault — Finance > Tax & Registration

const euVatNumberGenericRegex = /^(?!US)(?![0-9]+$)(?:(?:AT)?U[0-9]{8}|(?:BE)?0[0-9]{9}|(?:BG)?[0-9]{9,10}|(?:CY)?[0-9]{8}[A-Z]|(?:CZ)?[0-9]{8,10}|(?:DE)?[0-9]{9}|(?:DK)?[0-9]{8}|(?:EE)?[0-9]{9}|(?:EL|GR)?[0-9]{9}|(?:ES)?[A-Z][0-9]{7}[A-Z]|(?:FI)?[0-9]{8}|(?:FR)?[A-Z0-9]{2}[0-9]{9}|(?:HR)?[0-9]{11}|(?:HU)?[0-9]{8}|(?:IE)?[0-9][A-Z0-9+*][0-9]{5}[A-Z]{1,2}|(?:IT)?[0-9]{11}|(?:LT)?(?:[0-9]{9}|[0-9]{12})|(?:LU)?[0-9]{8}|(?:LV)?[0-9]{11}|(?:MT)?[0-9]{8}|(?:NL)?[0-9]{9}B[0-9]{2}|(?:PL)?[0-9]{10}|(?:PT)?[0-9]{9}|(?:RO)?[0-9]{2,10}|(?:SE)?[0-9]{12}|(?:SI)?[0-9]{8}|(?:SK)?[0-9]{10})$/;

function validateEuVatNumberGeneric(input: string): boolean {
  return euVatNumberGenericRegex.test(input);
}

// Example
console.log(validateEuVatNumberGeneric("DE123456789")); // true

Test Cases

When to use this pattern

This pattern is drawn from the Finance > Tax & Registration category and carries a ReDoS-safe certification. That matters for JavaScript developers because especially critical in long-running Node.js event loops where a ReDoS vulnerability can block the entire process. RegexVault audits patterns against known backtracking attack vectors, ensuring you have the necessary context before using this regex in a high-stakes production environment.

Common Pitfalls

Technical Notes

Each EU member state has a distinct VAT number format. This pattern covers all 27 EU member states. The country prefix is optional in this pattern — some systems present numbers without it. UK (GB) left SEPA in 2021 but the pattern is included for legacy data.