PEPPOL: Security Is About More Than Technology

Since 1 January 2026, electronic invoicing through Peppol has become the standard for B2B transactions in Belgium. While the network offers a much higher level of security than sending invoices by email, that security relies on one essential principle: verifying both the identity of the company and the authority of the person acting on its behalf.

A Secure Network… Provided Companies Are Properly Identified

Peppol operates as a private network where only certified access points can exchange electronic documents. This architecture significantly reduces the risk of fraud, invoice tampering and identity theft.

However, the way a company’s identity is verified may differ from one service provider to another. Simply confirming a person’s identity through itsme® or SMS is not sufficient. It is equally important to verify that the individual is legally authorised to represent the company.

How Can You Verify That Someone Is Authorised to Represent a Company?

In Belgium, several reliable methods can be used to confirm that a person has the legal authority to act on behalf of a company.

1. Consult the Crossroads Bank for Enterprises (CBE)

The CBE lists the company’s legal representatives, such as directors, managing directors or managers. This is generally the first verification that should be performed.

2. Review the Articles of Association Published in the Belgian Official Gazette

Appointments of directors and the company’s representation rules are published in the Belgian Official Gazette. These documents indicate whether a single representative may bind the company or whether joint signatures are required.

3. Verify an Official Power of Attorney

If the person is not a legal representative, they may still be authorised through a power of attorney or another mandate signed by the company’s authorised directors. This document should be retained as supporting evidence.

4. Verify the Person’s Identity

Once the authority to represent the company has been confirmed, the person’s identity should be verified using a strong authentication method such as itsme®, the Belgian electronic identity card (eID) or another secure identification process.

5. Maintain an Audit Trail

Professional service providers retain evidence of all verification steps, including the person’s identity, their authority, the date of the verification and the documents that were consulted. This audit trail is essential in the event of an audit or dispute.

In the Context of Peppol

The most reliable Peppol providers go well beyond simple authentication through itsme®.

They typically combine:

• strong user authentication (itsme®, eID, etc.);
• automatic verification of the person’s authority through the Crossroads Bank for Enterprises and/or the Belgian Official Gazette;
• where appropriate, a power of attorney when a member of staff, accountant or consultant registers the company on behalf of the business.

This combination of verification measures is what effectively prevents unauthorised individuals from fraudulently registering a company on the Peppol network.

Best Practices to Check

Beyond identity verification, it is advisable to ensure that:

• your Peppol access point is certified according to recognised security standards, such as ISO 27001;
• your company is correctly registered with both its enterprise number and VAT number to ensure accurate invoice routing;
• your service provider performs a complete verification of both the user’s identity and their authority to represent the company before activating the service.

Your Accountant Helps Protect Your Electronic Business Communications

Implementing Peppol is not simply a matter of installing software. It also requires ensuring that your company is properly registered and that only authorised individuals are able to act on its behalf.

Working together with trusted technology partners, your accounting firm ensures that best practices are followed so that your connection to the Peppol network remains compliant, reliable and secure.