A weekend ↓ architecture v1.0 · 2026-09-02

The new-customer check: before you do EUR 20,000 of work on trust

One page of free official checks before the quote goes out, instead of a debt-collection file eighteen months later

Setup: A weekend (~6-12 h) Running cost: $0-12/mo (software included) Time saved: none directly — it prevents losses rather than saving hours: the EU Payment Observatory found more than half of EU companies hit by late payment in 2024, up 5 points on 2023, with B2B and G2B payment periods still above 60 days and public authorities near 70, and the Commission attributes about one in four EU bankruptcies to late payment; Directive 2011/7/EU already gives you automatic interest at ECB reference plus 8 points and EUR 40 minimum recovery costs, and its stricter replacement (2023/0323(COD)) has been Blocked in Council since 2024 After setup: You run it — the lookups run by themselves on form submit; the decision to quote, to ask for 40 percent up front, or to walk away is yours, and a name match on a sanctions list always needs a human tap Data lives: Mixed — The register dumps, your customer table and the check files stay on your box. The outbound calls are to public government endpoints - VIES, the EU sanctions file, OFAC - and they carry a company number and a name, plus your own VAT number as requester on VIES. Sole traders in that table are personal data under GDPR: record the purpose as pre-contract credit assessment, set a retention period, and keep it out of your mailing list.

n8nNocoDBntfyGotenbergOllamaDockerPaymentsInvoicingReporting

Built for small businesses in general — not a sector list.

Before you start

Your own VAT number, sent as the requester on every VIES call - that is what returns the consultation number, which is the only piece of this file a tax administration will accept as proof you checked
A written credit policy in five lines, decided before any automation: what job size goes out without a deposit, what deposit for a first-time customer, and when you stop work
A company registration number field on your enquiry form and quote template, because a check that runs after the material is ordered changes nothing
Access to your own national register's open data - free CSV in Belgium after registration, free API with a key in the UK, portal-only or paid in several member states
Your last three years of invoices with payment dates, so days-to-pay per customer can be computed rather than remembered
The three customers who cost you the most money, to backtest the rules against - if the file says green on all three, the rules are decoration

What breaks first FAILS SILENTLY

the national register feed: the open-data dump changes column layout or the daily update file stops arriving, and the workflow keeps returning green because it finds no adverse record in an empty table. Belgium's CBE publishes a full file and a daily delta, each kept for only 31 days, so a fortnight of silent failure is unrecoverable as well as invisible. Assert a row count and a file date on every load, and fail the check loudly rather than returning a clean file built on stale data.

Version history

v1.0 · 2026-09-02 — First release. n8n assembles five free official lookups - VIES with a stored consultation number, your national register's open data, EU FSF and OFAC sanctions files, deep links to BRIS and the insolvency registers, and your own days-to-pay history - into one dated PDF with rule-based flags. Carries the 2026 legal picture: Directive 2011/7/EU still governs (60 days B2B, 30 for public authorities, automatic interest at ECB reference +8 points, EUR 40 minimum recovery costs) and its replacement Regulation, procedure 2023/0323(COD), is Blocked in Council as of the Legislative Train entry dated 22/05/2026. Explicitly rejects OpenSanctions data on licence grounds (CC-BY-NC, no commercial exemption for businesses).

Every time you start work before you get paid, you are lending that customer money. Nobody calls it that, so nobody underwrites it. This is the twenty-minute check that turns "they seemed fine on the phone" into a one-page file with dates, links and a payment condition.

The architecture

the same flow as text

      THE TRIGGER — one field, typed once

      [ enquiry form ] · [ quote about to go out ] · [ existing customer, bigger job ]

              ▼ company registration number + name

      THE LOOKUPS — all free, all official

      [ n8n — the assembler ] runs them in parallel, stores every raw answer

              ├─ 1. VAT number → VIES REST /check-vat-number + consultation number

              ├─ 2. national register → open-data dump (CBE/KBO, Companies House, …)

              ├─ 3. sanctions → EU FSF XML + US OFAC SDN, name match

              ├─ 4. cross-border / no dump → deep link to BRIS + IRI, you click

              └─ 5. your own history → NocoDB: paid late before? still open?

              ▼

      THE PAGE — deterministic, no model

      [ rules ] status · age · accounts filed · VAT valid · notices · your history

              ├─ green → normal terms, quote goes out

              ├─ amber → deposit or stage payments, and the reason in writing

              └─ red → ntfy on your phone. You phone them. Nothing is refused by software.

              ▼

      [ Gotenberg ] → one PDF per check, filed against the customer, dated.

      [ Ollama ] optional, and only ever to summarise text you already have.

Two design decisions carry this. The first: the flags are rules, not a score, and definitely not a model. An amber that says "no accounts filed since 2023, and this customer paid your last two invoices at 74 and 81 days" is a sentence you can repeat to the customer. A number that says 62 out of 100 is a sentence you cannot defend, and you would be inventing a credit rating you have no data to support.

The second: neither the EU business register search (BRIS) nor the insolvency register search (IRI) publishes an API. Both are free, both are real-time against national registers, and both are web interfaces for humans. So the automation does not pretend to scrape them. It builds the correct deep link, puts it on the page, and leaves the click to you. A watcher that quietly stops watching after a portal redeploy is worse than no watcher, because you will trust it.

The problem

Start with the scale, because the number is worse than most owners think. The EU Payment Observatory's 2025 reporting found that more than half of EU companies had difficulties caused by late payment from private clients or public authorities in 2024 — up 5% on 2023 and 10% on 2021. Average payment periods stayed above 60 days in both business-to-business and government-to-business transactions, with public authorities close to 70 days in every member state. And the framing the Commission itself uses: late payment is behind roughly one in four bankruptcies in the EU.

You already have rights here and they are stronger than most people use. Under Directive 2011/7/EU, businesses must pay within 60 days unless a longer term is expressly agreed and is not grossly unfair to you; public authorities get 30 days, or 60 in narrow cases such as public hospitals. Late payment triggers interest automatically at at least 8 percentage points above the ECB reference rate, plus a minimum €40 for recovery costs, with no reminder required. The Commission's own evidence is that firms do not claim any of it, because they are afraid of damaging the relationship.

So do not wait for the rules to improve. The Commission proposed replacing that directive with a Regulation in September 2023 — a hard 30-day cap, automatic interest, €50–150 recovery compensation — and Parliament adopted its position on 23 April 2024. As of the Legislative Train entry dated 22 May 2026, the file's status is Blocked, and the blocking institution is the Council. That is roughly two years of no movement. Whatever protects you in 2027 is the same directive that protects you today, and it is a remedy after the loss, not a filter before it.

The filter is the missing piece. A commercial credit report from Graydon, Creditsafe or Companyweb is a real product and it is priced for finance departments, not for a two-van installer deciding whether to order €9,000 of material on Tuesday. Meanwhile the facts that would have told you something — does this company exist, is it still trading, has it filed accounts, is there an insolvency notice, is its VAT number live, is it on a sanctions list — are published for free by the same governments that would later collect the tax on the invoice you never got paid.

This blueprint is the assembly job, not a scoring model. It gathers the free official answers about one company into one page, and it stops there.

Tool choices — and why

n8n

(Sustainable Use License, free for internal business use, 201.9k stars, pushed 23/08/2026) is the assembler. Five lookups, some of which fail some of the time, with retries and a stored raw response for each — that is exactly what it is for. If you already run it for another blueprint here, this is one more workflow, not one more machine.

VIES

is the only lookup that is genuinely instant and EU-wide: POST ec.europa.eu/taxation_customs/vies/rest-api/check-vat-number with a country code and a VAT number, free, no key. Send your own VAT number as the requester and the reply carries a consultation number, which is the archivable proof that you checked this number on this date and got this answer. Keep it. It is the one artefact in this whole workflow that a tax administration will accept as evidence.

Your national register's open data

is the workhorse, and it is different in every country, which is the honest part of this blueprint. Belgium's Crossroads Bank for Enterprises publishes a free CSV of all active entities and establishment units, with a full file and a daily update file, each kept available for 31 days, after registration and acceptance of the terms; SFTP access is available on request. The UK's Companies House has a free REST API with a key. Several member states charge, or only offer the portal. Build for your own country first and treat everything cross-border as a link.

EU Financial Sanctions Files

(webgate.ec.europa.eu/europeaid/fsd/fsf) gives you the consolidated EU list as XML behind a free account and a token in the URL; OFAC's Sanctions List Service gives you the US SDN and Consolidated lists. Both are free for commercial use, which is the point. Screen names on both if you sell outside the EU, and screen on the EU list regardless, because EU sanctions bind you as an EU operator.

NocoDB

(Sustainable Use License since 29/01/2026, free for internal business use, 64.7k stars, pushed 25/08/2026) holds the customer table, the check log and your own payment history. Spreadsheet-shaped is right, because the most predictive column in the whole system is one you fill in yourself: how many days this customer took, last time.

ntfy

(Apache-2.0, 33.9k stars, pushed 01/09/2026) delivers the red flags. Email is the wrong channel because the failure mode is a message read three days after the quote went out. Gotenberg (MIT, 13.0k stars, pushed 31/08/2026) turns the page into a dated PDF. Ollama (MIT, 179.3k stars, pushed 23/08/2026) is optional and confined to summarising a register extract you already fetched; it never decides anything.

Monthly cost

Software: €0, every piece. Data: €0 — VIES, FSF, OFAC, BRIS, IRI and the Belgian CBE dump are all free, and Companies House is free with a key. Hosting: nothing new if you already run an automation box, otherwise roughly €5–12/month for a small VPS. The comparison is not another SaaS tool, it is a single unpaid invoice: commercial credit reports run from a few euro each on pay-per-view up to several hundred a month on subscription, and one €9,000 write-off pays for all of it several times over.

Setup outline

1. Write your own credit policy first, in five lines, before any automation. What size of job goes out without a deposit. What deposit for a first-time customer. When you stop work. Without this the workflow produces information nobody acts on.
2. Add one required field to your enquiry form and your quote template: the customer's company registration number. This is the whole trigger, and it is also a quiet filter — a business that will not give you its own registration number has told you something.
3. Wire the VIES call in n8n. Send your own VAT number as requester, store the consultation number, the request date and the returned name and address. Test it against a company you know, then against a deliberately wrong number.
4. Load your national register dump into NocoDB and refresh it on the schedule the publisher uses. For Belgium that is the daily CBE update file; do not re-download the full file every day when a delta exists.
5. Pull the EU FSF XML and the OFAC lists daily into two tables. Match on normalised name — case, punctuation, accents, legal-form suffixes — and accept that this will over-flag.
6. Add the two deep links: BRIS for the company, IRI for insolvency proceedings. Label them clearly as "you must click this", not as a result.
7. Join your own history: every past invoice for this customer, days-to-pay on each, anything still open. Compute it, do not eyeball it.
8. Write the rules. Keep them boring and few: entity not active, VAT invalid, no accounts filed in the last two financial years, an insolvency or judicial reorganisation notice, a sanctions name hit, incorporated in the last six months, or your own average days-to-pay above your policy line.
9. Render the page to PDF and file it against the customer with the date. If you later decline a job or ask for 40% up front, this is the document that says why.
10. Backtest before you trust it. Take the three customers who cost you the most money in the last three years and run them through as they were on the day you accepted the job. If the file says green on all three, your rules are decoration.

Pitfalls — the real ones

A valid VAT number tells you almost nothing about solvency

This is the mistake that makes people feel safe. VIES confirms that a number is registered and active for intra-EU trade on the day you ask, and where the member state supplies it, the registered name and address. A company that files for insolvency next Monday has a perfectly valid VAT number today. Treat it as identity, not as health.

The registers are slow, and the delay runs against you

Annual accounts are filed months after the year they describe, and a struggling company files late or not at all. So the strongest signal in the whole file is usually the absence of a filing rather than the contents of one, and your own days-to-pay column beats every register, because it is current.

Sole traders are personal data, and the register says so

Belgium's CBE open data terms state plainly that personal data may not be reused for direct marketing, and that this covers all data on registered entities that are natural persons. A one-man business in your customer table is a person under GDPR. Write down the purpose — assessing credit risk before entering a contract — set a retention period for the check files, and keep this table out of your mailing list. This is not a footnote; reusing a register dump for marketing is the single most common way this build goes wrong.

OpenSanctions is the licence trap

It is the best-packaged aggregate sanctions dataset available and its data is published under CC-BY-NC. Running yente yourself is free, but the licence covers the software, not the data — commercial use of the dataset requires a paid licence, and the exemptions are for journalists, nonprofits and academics, not for your workshop. Use the Commission's FSF and OFAC's own files instead. They are free for commercial use, they are the primary sources, and they are what a regulator would expect you to have screened against.

A name match is not a hit

Sanctions screening on names alone produces false positives constantly, and the consequence of acting on one is that you refuse work to somebody who shares a name with a listed party. Show the matched alias, the listing regulation and the score, require a human tap, and log the dismissal with the reason.

Do not build a credit score

You do not have payment-behaviour data across the market, so anything you compute is a plausible-looking number with nothing behind it. Worse, an automated decision that materially affects a person — a sole trader — starts touching GDPR Article 22 territory. Flags with reasons keep a human in the loop and keep you honest.

The check is worthless if it runs after the quote

Every workflow like this dies the same way: it gets built, it works, and then it sits behind a button nobody presses because the quote is already out and the material is already ordered. Put the registration number field on the enquiry form, not in the back office, and make the check fire on form submit.

Re-run it for existing customers before big jobs

The customer you checked in 2024 is not the company you are about to give €30,000 of credit to in 2026. Trigger on job value, not on whether the name is new.

This is not the late-invoice chaser and it is not the supplier bank-detail gate

Those two run after you have committed. This one runs before, and its only output is a better sentence in the quote.

Verified repos

n8n — Sustainable Use License (free self-hosted internal use), 201.9k stars, pushed 23/08/2026
NocoDB — Sustainable Use License since 29/01/2026 (free for internal business use), 64.7k stars, pushed 25/08/2026
ntfy — Apache-2.0, 33.9k stars, pushed 01/09/2026
Gotenberg — MIT, 13.0k stars, pushed 31/08/2026
Ollama — MIT, 179.3k stars, pushed 23/08/2026 — optional, summarising only
yente — open-source API server, but the OpenSanctions data is CC-BY-NC and needs a paid licence for business use. Listed as the trap, not as the recommendation.

Official data sources used, all checked 02/09/2026: VIES VAT validation · BRIS business registers · Insolvency registers · Belgian CBE open data · EU Financial Sanctions Files · OFAC sanctions lists · Late payment, Directive 2011/7/EU · EU Payment Observatory · Legislative Train, 2023/0323(COD) · OpenSanctions licensing

Get the next blueprint as it publishes — free, practical, verified tooling only.

Subscribe · Want this audited or extended for your business? DM @RXed_EU