Short answer
Ten years, across all three One Stop Shop schemes, counted from the end of the year in which the transaction was carried out.
- Union scheme: Article 369k(2) — "10 years from 31 December of the year during which the transaction was carried out".
- Non-Union scheme: Article 369(2) — "ten years from the end of the year during which the transaction was carried out".
- Import scheme (IOSS): Article 369x(2) — "10 years from the end of the year during which the transaction was carried out".
The three formulations mean the same thing. A sale made in March 2026 must be retained until the end of 2036.
Two obligations sit alongside the period, and both are more demanding than the period itself:
- The records must contain the twelve categories listed in Article 63c of the Implementing Regulation, at the level of each individual good or service supplied.
- They must be producible electronically without delay, with a 20-day backstop before a formal reminder is issued.
The retention rule
"The records referred to in paragraph 1 must be made available electronically on request to the Member State of consumption and to the Member State of identification. Those records must be kept for a period of 10 years from 31 December of the year during which the transaction was carried out." —
Ten years is substantially longer than the general business-record periods in most Member States, which commonly run to five, six or seven years. It is also longer than the three-year window for correcting an OSS return. Do not let a general retention policy, or a data-minimisation policy, delete OSS data at seven years.
Two audiences can ask: the Member State of identification, where you file, and any Member State of consumption, where the customer was. In practice the consumption states are the ones with the revenue interest.
What the records must contain
Article 63c(1) sets out what "sufficiently detailed" means for the Union and non-Union schemes:
"(a) the Member State of consumption to which the goods or services are supplied; (b) the type of services or the description and quantity of goods supplied; (c) the date of the supply of the goods or services; (d) the taxable amount indicating the currency used; (e) any subsequent increase or reduction of the taxable amount; (f) the VAT rate applied; (g) the amount of VAT payable indicating the currency used; (h) the date and amount of payments received; (i) any payments on account received before the supply of the goods or services; (j) where an invoice is issued, the information contained on the invoice; (k) in respect of services, the information used to determine the place where the customer is established or has his permanent address or usually resides and, in respect of goods, the information used to determine the place where the dispatch or the transport of the goods to the customer begins and ends; (l) any proof of possible returns of goods, including the taxable amount and the VAT rate applied." —
Point (k) is the one that catches digital businesses. You must retain the evidence you used to locate the customer — the IP address, geolocation result, billing address, SIM country code or bank data that satisfied Article 24b — for ten years, not merely the conclusion you reached.
Storing "customer country: IT" is not compliance. Storing the two non-contradictory items that produced "IT", with their timestamps, is.
Point (e) and point (l) are the refund and returns trail, which must survive alongside the original sale.
Article 63c(2) sets a parallel list for the import scheme. It drops the services-location item, since IOSS covers goods, and adds two logistics items: the order number or unique transaction number, and the unique consignment number where the taxable person is directly involved in the delivery.
Granularity and format
"The information referred to in paragraphs 1 and 2 shall be recorded by the taxable person or the intermediary acting on his behalf in such a way that it can be made available by electronic means without delay and in respect of each individual good or service supplied." —
Two constraints in one sentence.
Per item, not per return. Aggregated monthly totals do not satisfy this. The unit is the individual good or service supplied.
Electronically, without delay. Archived tape, a decommissioned billing platform, or a format requiring reconstruction does not satisfy it either. If your billing system is replaced in year four, the OSS data must be migrated in a queryable form — or you must retain a working means of reading it for the balance of the ten years.
The same paragraph sets the enforcement rhythm:
"Where a taxable person or the intermediary acting on his behalf has been requested to submit, by electronic means, the records referred to in Articles 369, 369k and 369x of Directive 2006/112/EC and he has failed to submit them within 20 days of the date of the request, the Member State of identification shall remind the taxable person or the intermediary acting on his behalf to submit those records. The Member State of identification shall by electronic means inform the Member States of consumption that the reminder has been sent." —
Twenty days is not the deadline — "without delay" is. Twenty days is the point at which failure becomes visible to every consumption state at once.
Intermediaries
Article 369x(1) requires an intermediary under the import scheme to keep records for each of the taxable persons he represents, separately.
If you use an IOSS intermediary, settle in the contract who retains what, for how long, in what format, and what happens on termination. An intermediary's own ten-year obligation does not discharge yours, and a relationship that ends in year two leaves eight years of exposure on records held by a former service provider.
Interaction with other obligations
Corrections. The three-year window under Article 369g(4) is much shorter than the ten-year retention. Records must outlive the ability to correct, because they support audit rather than amendment.
Leaving the scheme. Ceasing to use OSS does not end the retention obligation. Under Article 61a of the Implementing Regulation, corrections arising after your final return are settled directly with each Member State of consumption — which is precisely when you will need the underlying records, potentially years later.
Data protection. OSS records include personal data: addresses, IP addresses, payment data. Retention for ten years is a legal obligation under Union law and can be relied on as such, but it should be documented in the retention schedule and the processing record rather than left implicit. IP addresses and geolocation data retained under point (k) deserve particular attention, because they are retained for a tax purpose and should not be repurposed.
National rules. Article 369k sets a floor for OSS records. Member States may impose longer or additional requirements for domestic registrations. Where you hold both a local registration and an OSS registration, two regimes apply to different parts of your data.
Operational checklist
- Set OSS retention to ten years from 31 December of the transaction year, separately from general business-record policy.
- Retain the customer-location evidence itself, not just the derived country.
- Keep data at individual supply level, queryable electronically.
- Carry OSS data through any billing-system migration.
- Preserve the refund and returns trail alongside original sales.
- For IOSS, retain order and consignment numbers.
- Agree record ownership and hand-back with any intermediary.
- Rehearse producing a full extract for one Member State within 20 days.
- Reflect the ten-year period in the data-retention schedule and processing record.
Conclusion
Ten years is the answer, uniformly across the Union, non-Union and import schemes, measured from the end of the transaction year.
The period is the easy part. The harder obligations are completeness — twelve prescribed categories including the location evidence — and availability, at individual-supply granularity, electronically and without delay. A business that can produce a clean per-transaction extract for a single Member State within twenty days, four years after replacing its billing platform, has met the standard. Most of the work that requires happens at system-design time, not at audit time.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.