"We already do Peppol, so the new mandate is just a config change." We hear this often, and it is usually wrong. Most of the mandates arriving now are not four-corner exchange — they add the tax authority as a fifth corner. That extra corner does not bolt onto the side of your existing flow; it sits inside your send path and changes what "sent" even means. Here is what actually moves between the models, and why the fifth corner is a re-architecture rather than a setting.
1. Counting corners
The "corner" shorthand counts the parties a document passes through. It is worth being precise, because the jump from four to five is the one that hurts.
| Model | Path | Where it shows up |
|---|---|---|
| Two-corner | Supplier → buyer, directly | Bilateral EDI, email — no network, no authority |
| Three-corner | Supplier → central platform → buyer | A single government or private portal both sides connect to |
| Four-corner | Supplier → their access point → buyer's access point → buyer | Classic Peppol: two service providers exchange over a network |
| Five-corner | Four-corner plus the tax authority as a fifth party | Peppol-based CTC — Oman, the UAE, Belgium from 2028; France via a 4-corner + e-reporting variant |
In a four-corner model the network is the whole story: the supplier's access point (C2) hands the invoice to the buyer's access point (C3), which delivers it to the buyer (C4). The tax authority is not involved in the exchange at all. A five-corner model keeps that spine and adds C5 — the tax administration — which receives the invoice, or a report derived from it, as part of the same obligation.
Why "5-corner" and not "clearance"A five-corner model is not necessarily clearance. The authority can sit synchronously in the path (the invoice is not valid until it responds) or receive a near-real-time report beside the exchange. Both are "five-corner"; they differ in whether C5 can block delivery. Establish which one you are dealing with before you design anything.
2. The fifth corner redefines "done"
This is the crux. In a four-corner flow, an invoice is delivered when the buyer's access point accepts it — you get a transport-level acknowledgement and you are finished. Legal validity was established the moment you issued.
Add C5 and "done" moves. Depending on the regime, an invoice is not complete until:
- the tax authority has validated it and returned an identifier (clearance — the invoice is not legally valid without it), or
- the authority has acknowledged the report you were obliged to send within a deadline (reporting — valid on issue, but non-compliant if the report is late or missing).
Either way, your system now has a state it did not have before: issued but not yet confirmed by the authority. That single new state is where most of the work lives — persisting it, surfacing it, retrying it, and reconciling it. A four-corner integration that models an invoice as "sent / delivered / failed" has nowhere to put "cleared" or "reported", and retrofitting that state late is expensive.
3. It is not the same payload
A comforting assumption is that the authority simply gets a copy of the buyer's invoice. Often it does not. Several five-corner regimes define a separate tax data document for the fifth corner — a report shaped for the administration, not the invoice the buyer receives. The UAE's model pairs the PINT AE billing document with a UAE Tax Data Document; Oman's pairs PINT OM billing with an Oman Tax Data Document reported to the tax authority.
That means the fifth corner can carry different fields, different mandatory elements and a different validation artefact than corners C2–C4. You are not sending one document to two destinations; you may be deriving two documents from one transaction and keeping them consistent. Model that explicitly.
The fifth corner is a second consumer of your data with its own contract. Treat "the buyer's copy" and "the authority's report" as distinct outputs of one event, not one output sent twice.
4. Two sources of rejection
In four-corner, rejection comes from one place: the buyer (or their access point) says no. In five-corner you gain a second, differently-behaved source — the authority — and the two do not fail the same way:
| Dimension | Buyer / C3 rejection | Authority / C5 rejection |
|---|---|---|
| What it means | Business dispute or routing failure | The document is not legally valid / not compliant |
| Remedy | Resend, or issue a credit note by agreement | Fix and re-submit; the original may never have existed in law |
| Timing pressure | Commercial | Statutory — deadlines and penalties attach |
| Who sees it first | Often the buyer | Your system, via the authority's response |
Designs that funnel both into a single "rejected" bucket lose the distinction that matters most: a buyer rejection is a business conversation, while an authority rejection can mean you have no valid invoice and a running clock. Route and surface them separately.
5. What you actually have to build
Concretely, moving a four-corner integration to five-corner adds these work items — none of them a config toggle:
- A confirmation state and store. Persist the authority's response — clearance ID, acknowledgement, timestamp — next to the invoice, retrievable for years. This is part of legal validity now, not telemetry.
- The authority-facing document. If the regime defines a separate tax data document, build and validate it as its own artefact.
- Deadline and retry handling. A reporting obligation has a clock; a clearance dependency needs retry, timeout and outage handling — see our companion piece on designing for clearance outages.
- Registration / accreditation. Five-corner regimes usually require enrolment with the authority or the use of an accredited provider, with lead times measured in weeks or months.
- Two-channel error handling. Separate the authority's verdict from the buyer's, with different owners and different recovery paths.
The reassuring part: if your Peppol foundation is solid, the C2–C3 spine genuinely does carry over. The fifth corner is additive. But it is additive in the way a new limb is additive — it needs its own plumbing, and pretending it is a setting is how a "quick" mandate project turns into a re-architecture halfway through. Belgium is the clearest cautionary tale: live as four-corner in 2026, it converts to a five-corner CTC regime in 2028, so anyone treating the 2026 go-live as the finish line is building the fifth corner twice. The Belgium, France, Oman and UAE pages each state which model applies and when.
- Four-to-five is the painful jump — the authority moves from absent to inside your send path.
- The fifth corner redefines "done" and adds an "issued-but-unconfirmed" state you must model.
- It may want a different document — a tax data report, not a copy of the buyer's invoice.
- Two rejection sources, two meanings. An authority "no" can mean you have no valid invoice.
- Your Peppol spine carries over; the fifth corner is real new plumbing, not a config change.