OSS record keeping: what you must keep for 10 years
You sell through the OSS to private customers in other EU countries and wonder what has to be on the table in ten years? For every single sale you keep twelve kinds of data, until the end of the tenth year after the year of the sale. The BZSt and the EU country of your customer may request them electronically. Anyone who does not deliver risks exclusion from the OSS.
Last updated: October 27, 2026
In brief
- Period: Ten years from the end of the year of the sale, even if you left the OSS long ago.
- Content: Per sale the country, goods, date, net amount, tax rate, tax, payment and the proof of where your customer is.
- Request: Deliver electronically. One month after the reminder without an answer counts as persistent failure.
How long must I keep OSS records?
Ten years. The period runs from the end of the year in which you made the supply (Section 22(1) UStG). A sale in August 2026 must therefore be provable until the end of 2036. The EU directive says the same: ten years from 31 December of the year in which the supply took place (Article 369k(2) VAT Directive).
The European Commission makes it clear: the ten years apply whether or not you keep using the scheme. If you deregister, you must not throw the records away.
This is its own OSS duty, which stands next to the general periods of the German Fiscal Code: books and records ten years, accounting vouchers eight years, other documents six years (Section 147(3) AO). An overview is in Receipt retention periods: 6, 8 and 10 years.
Which data belongs to every sale?
Article 63c of Implementing Regulation (EU) No 282/2011 sets out what you must record. For sales under the Union scheme of the OSS these are twelve items:
| Item | What it means |
|---|---|
| Country of consumption | The EU country the goods were delivered to or the service was supplied in |
| Type and quantity | Description and quantity of the goods, for services the type of service |
| Date of supply | The date of the delivery or of the service |
| Taxable amount | The amount without VAT, stating the currency |
| Changes | Every later increase or decrease of that amount |
| Tax rate | The rate you applied |
| Tax amount | The VAT due, stating the currency |
| Payments | Date and amount of the payments received |
| Prepayments | All advance payments received before the supply |
| Invoice | If you issued one, the information in it |
| Customer location | For goods: where the dispatch starts and ends. For services: the information you used to determine where the customer is established |
| Returns | Proof of goods returned, with taxable amount and tax rate |
Not every row applies to every sale: there is not always an invoice, a prepayment or a return. According to the European Commission there is generally no duty to issue an invoice in the OSS at all. If you did issue one, its data belongs to your records.
The cut matters: you must record the data so that you can deliver it without delay and for each single sale electronically (Article 63c(3)). The total per country from your quarterly return is not enough for that; it appears in the return, not in the records. Which marketplace report contains which data is explained in Amazon reports at a glance: which one for taxes?.
Who may request the records?
The BZSt, the competent tax office and the central authorities of the other EU countries (BZSt). The law puts it like this: on request, the records must be made available electronically to the tax authority responsible for the OSS in Germany or in the rest of the EU (Section 22(1) UStG). The directive names two bodies: the country where you are registered and the country where your customer is (Article 369k(2)).
How does a request from another EU country work?
A country where you have customers does not ask you directly. The European Commission describes the route:
- The country of your customer first turns to the country where you are registered, for you the BZSt.
- That country tells you how to hand over the records.
- You deliver them electronically and without delay.
- If you do not comply within 20 days, your country of registration sends a reminder (Article 63c(3)).
- If the records are still missing one month after the reminder, this counts as persistent failure to comply with the scheme (Article 58b(2)(c) of Implementing Regulation (EU) No 282/2011).
The consequence of step 5 is exclusion from the OSS. It affects every OSS scheme you use, and a two-year quarantine follows during which you cannot register again (Article 58b(1)). How an exclusion works overall is in OSS return: missed deadline.
If you want to hand over the records in a common format: the European Commission names the standard audit file SAF-OSS, whose file all Member States accept.
What happens in an audit from another EU country?
This is what the sources used for this text give:
- Request: It runs through the BZSt and follows the five steps above.
- Errors in the return: For a missing, late, incomplete or incorrect return or a late payment, the country of your customer sets any interest, fines or other charges under its own law. You pay them directly to that country (Article 63b).
- Your own correction: If you find the error yourself, you correct it in a later return up to three years after the filing deadline of the original return (Section 18j(4) UStG). How is in Correct an OSS return.
Whether a country asks further questions or requires more evidence beyond that depends on its own procedure and is not in the rules cited here. For a concrete request, your tax adviser can help.
This text is about OSS records. The audit of your German VAT is another topic: VAT special audit for online sellers.
Common mistakes
- Keeping only the quarterly return. The data per sale is required, totals are not enough.
- Deleting everything after deregistration. The ten years keep running even after you leave the OSS.
- Using six or eight years. For OSS records ten years apply.
- Letting a request sit. After 20 days comes the reminder; one month after the reminder, exclusion threatens.
- Leaving the records only in your marketplace account. You must be able to deliver them; files of your own are the surest way.
- Forgetting the currency. Taxable amount and tax amount must be recorded with the currency used.
How VAT GPT helps
VAT GPT is the tax software for Amazon and eBay sellers in Germany: your OSS return first, then VAT, EÜR, trade tax and income tax, calculated and filed in one place. For record keeping this means:
- You upload your Amazon and eBay reports. VAT GPT detects the report type and stores the uploaded file in your account.
- VAT GPT breaks the OSS sales down by country and calculates the OSS return. For each submitted OSS return it stores the countries with their amounts and the totals.
- The data export bundles your documents, overview tables and your uploaded CSV reports in one ZIP file. You file that with your records.
Sending the OSS return is a Pro feature. The duty to keep records stays with you as the taxable person, as the VAT GPT terms also say. Create an account to try it.
Not tax advice: the content does not replace individual advice.
What VAT GPT does not do
- VAT GPT is not tax advice.
- You register for and deregister from the OSS yourself in the BZStOnline portal.
Frequently asked questions
How long must I keep OSS records? Ten years from the end of the year in which you made the supply (Section 22(1) UStG).
Does the period also apply after I deregister from the OSS? Yes. The European Commission writes that the records must be kept for ten years even if you no longer use the scheme.
Is the quarterly return enough as proof? No. The return contains totals per country and tax rate. What you keep is the data per sale under Article 63c of Implementing Regulation (EU) No 282/2011.
Do I have to issue invoices in the OSS? Generally not, says the European Commission. If you issued one, its data belongs to your records.
Who may request the records? The BZSt, the competent tax office and the central authorities of the other EU countries. A country where you have customers first asks the BZSt.
What if I do not answer a request? After 20 days the BZSt sends a reminder. If the records are still missing one month after the reminder, this counts as persistent failure; exclusion from the OSS threatens.