How to Choose a Peppol Access Point: A Buyer's Guide

Choosing an access point is a compliance decision, not just a vendor pick

Your Peppol Access Point is the party that legally transmits your invoices on the network, validates them, and determines which countries you can reach. Choose well and you integrate once and grow into new markets by configuration. Choose badly and every new mandate becomes a migration. This guide sets out the criteria that actually matter.

If you're still orienting, read what a Peppol Access Point is first; this article is about how to compare and select one.

1. Certification — non-negotiable

Only certified access points may operate on the live Peppol network. Certification is issued through OpenPeppol, and any legitimate provider can be verified on the OpenPeppol public directory. Treat this as a gate: if a provider isn't listed and certified, nothing else about them matters.

Bonus signal: a provider that is also a certified SMP can publish and manage your participant registration directly, instead of depending on a third party — which shortens onboarding and removes a coordination dependency.

2. Country coverage that matches your markets

This is where most selections go wrong. Peppol is not one uniform format — each jurisdiction adds its own profile and rules:

The EU and Australia/New Zealand use BIS Billing 3.0. See Peppol e-invoicing in Australia.
Oman requires PINT OM plus a Tax Data Document. See the Oman Fawtara readiness guide.
Others run national CIUS variants or their own clearance platforms, like Poland's KSeF.

A provider that only covers the European baseline cannot serve these. Map the countries you trade with today and in the next two years, and require coverage for all of them — the whole point is to integrate once and comply everywhere.

3. Validation before transmission

Ask precisely what a provider validates and when. The safe answer is a layered pipeline — UBL XSD, business rules, code lists, CEN EN 16931 + Peppol BIS, and jurisdiction packs — run before the document is transmitted, blocking on every error. If validation happens only at the receiver, you inherit their rejections as production incidents. The failure modes to guard against are catalogued in invoice validation errors you can prevent.

4. Security and business continuity

You're routing commercial and tax data through this provider. Expect:

Encryption in transit and at rest, and clear data-isolation between tenants.
A documented business-continuity and disaster-recovery posture.
Auditability — correlation IDs, delivery receipts, retention of evidence.

5. Integration model and API

The value of Peppol is a single integration. Prefer a provider offering one well-documented REST API that covers issuance, reception and every supported country — not a different connector per market. Confirm strong multi-tenant isolation if you operate across entities or on behalf of clients.

6. Pricing, SLA and support

Pricing should be transparent and scale with your volume, without per-country surprises.
Uptime and support SLAs should be defined, not implied.
Mandate changes should be handled centrally by the provider, so a rule change is their update, not your engineering project.

The questions to ask, in one list

Are you a certified Access Point (and SMP)? (Verify on the directory.)
Which countries and document profiles do you support today?
Do you validate before transmission, and against which rule sets?
What are your uptime and support SLAs?
How do you handle mandate and rule changes?
Is it one API for all markets, and how is tenant data isolated?

For the finance-team rollout view once you've selected a provider, work through the Peppol onboarding checklist.

How GoRoute helps

GoRoute (POP000991) is a certified Peppol Access Point and SMP that meets every criterion above: broad country coverage (BIS Billing 3.0, PINT and its jurisdiction packs, national CIUS), layered validation before transmission, and a single REST API across 50+ countries with per-tenant isolation. Mandate changes are rolled out centrally, so you integrate once and stay compliant as the map changes. Book a demo or read what a Peppol Access Point is.

Sources: OpenPeppol; OpenPeppol public directory; Peppol BIS Billing 3.0.

Frequently asked questions

What is a Peppol Access Point?

A Peppol Access Point is a certified service provider that connects you to the Peppol network, handling the AS4 transport, participant discovery via SMP/SML, and validation of the documents you send and receive. You integrate with the access point once; it reaches every other participant on the network.

What should I look for when choosing a Peppol Access Point?

Prioritise certified Peppol Access Point (and ideally SMP) status, coverage of the countries you actually trade with, layered validation before transmission, security and business-continuity posture, a clear API and integration model, transparent pricing, and responsive support with defined SLAs.

Does a Peppol Access Point need to be certified?

Yes. Only certified access points may operate on the live Peppol network. Certification is issued through OpenPeppol and you can verify a provider on the OpenPeppol public directory. An uncertified 'provider' cannot legitimately transmit on your behalf.

Should the access point also be an SMP?

It helps. An access point that also runs a certified SMP can publish and manage your participant registration directly, rather than depending on a third party. For jurisdictions with their own registration flows, in-house SMP capability shortens onboarding and reduces coordination risk.

Why does country coverage matter so much?

Each jurisdiction has its own document profile, validation rules and sometimes its own tax-reporting step. A provider that only covers the EU baseline can't serve Oman's PINT OM or a national CIUS. Choose one whose coverage matches your current and planned markets so you integrate once, not per country.

What questions should I ask a Peppol provider?

Are you a certified Access Point (and SMP)? Which countries and document profiles do you support today? Do you validate before transmission, and against which rule sets? What is your uptime and support SLA? How do you handle mandate changes? Is it one API for all markets, and how is tenant data isolated?

Can I switch Peppol Access Points later?

Yes, but with effort — your participant registration and integration move with you. Choosing well up front avoids a migration. Favour providers with broad coverage, a stable API and in-house SMP so that growth into new markets doesn't force a change of provider.