Who Controls Belgium's Peppol E-Invoicing Network?

Context

Peppol, the Pan-European Public Procurement Online network, facilitates electronic invoicing across Europe. In Belgium, its governance structure is undergoing a deliberate transition to align with EU e-invoicing directives. Currently, day-to-day oversight lies with SPF BOSA (Federal Public Service Strategy and Support), but this responsibility will shift to SPF Finances in 2027. This transition is part of a broader policy decision to integrate e-invoicing oversight with tax authority functions, ensuring greater coherence in Belgium's digital taxation framework.

The network itself is managed by OpenPeppol, an international non-profit association headquartered in Brussels. It operates independently of any single corporation or national government, ensuring neutral governance. OpenPeppol enforces strict security protocols, including encrypted invoice transmission and mandatory compliance with network security rules for certified service providers.

What's Changing: The 2027 Transition

The most significant change in Belgium's Peppol governance structure is the scheduled transfer of oversight from SPF BOSA to SPF Finances in 2027. This transition, planned in alignment with EU e-invoicing directive implementation timelines, is designed to streamline administrative processes and enhance coordination between e-invoicing and tax authorities.

SPF Finances, as the future overseer of Peppol in Belgium, will be responsible for ensuring compliance with local and European regulations. This shift is expected to facilitate more efficient monitoring of e-invoicing activities and better integration with existing tax systems. The transition is framed as a strategic policy decision rather than an administrative disruption, aiming to strengthen Belgium's digital taxation infrastructure.

Security Architecture and Equivalency Frameworks

Peppol's security architecture is robust, with invoices transmitted through encrypted channels to protect data integrity. Each participating company is identified by its enterprise number, providing a structured identity layer that enhances security.

The OpenPeppol security policy was updated and approved by the Steering Committee as of September 30, 2026. This update includes certified equivalency frameworks such as BSI IT Grundschutz, CyFun Essential, and eIDAS QTSP certification. These frameworks offer SMEs multiple compliance pathways, ensuring that they can meet the necessary security standards without undue burden.

Residual Risks and End-User Security Literacy

While Peppol secures the transport of invoices, it cannot guarantee the legitimacy of individual payment requests. Fraud vectors remain at the endpoint, where compromised accounting software or stolen credentials can result in fraudulent invoices entering the network. Specifically, changes to IBAN details should always be verified through independent contact channels, such as a phone call to a known number, rather than solely relying on the received invoice.

This practical guidance is critical for SMEs, as it highlights the importance of end-user vigilance in preventing fraud. Users must understand that while Peppol provides a secure network, the ultimate responsibility for verifying payment details lies with the individual or organization receiving the invoice.

Outlook and What to Watch

As Belgium prepares for the 2027 transition of Peppol oversight to SPF Finances, stakeholders should monitor developments in the integration of e-invoicing and tax systems. The alignment of these functions is expected to enhance efficiency and compliance, but it will require careful management to ensure a smooth transition.

Additionally, end-users should stay informed about updates to the OpenPeppol security policy and any changes to equivalency frameworks. Vigilance against endpoint fraud will remain a priority, with emphasis on verifying IBAN changes and securing accounting software.