What the VCA actually checks when you upload an eCoC

The VCA's eCoC page says three things about what happens to a file after you upload it. It's worth reading them exactly, because a lot of what's being sold to bodybuilders right now rests on fear of what the VCA might check.

1. It's validated against their schema

The VCA publish an XML Schema Definition, the UK IVI 2.0 XSD, and every uploaded file is checked against it. That means: every mandatory field is present, every value is the right type, every coded field uses a value from the allowed list, and nothing exceeds the field length limits. A file that fails this is rejected at upload with an error.

This is mechanical and predictable. If you validate against the same schema before you upload, which CoC AutoDocs does, the VCA will not find anything here that you didn't.

2. It has a digital signature

The guidance is explicit: files without a digital signature fail validation and are rejected at the upload stage. It's equally explicit about the current depth of that check. They're checking that a signature is present, not verifying the certificate or key behind it.

Two practical consequences. First, a file signed with a self-generated test key gets through today, which is why CoC AutoDocs ships one, so you can test against the real portal before your certificate arrives. Second, "currently" is doing a lot of work in that sentence. Get a proper certificate before you go live; the day they start verifying, unsigned-in-spirit files will be the first to be queried.

3. It isn't a duplicate

The VCA use the VIN together with the file's version number to spot resubmissions. Same VIN, same version, twice: rejected. The version number is how you tell them "this is a correction to the one I sent before". CoC AutoDocs handles this automatically when you reissue a file.

What they don't say they check

Whether the approval number matches a real GB approval on their records. Whether the type, variant and version exist under it. Whether the masses are plausible for the category. The published guidance doesn't mention any of this, and nothing in the portal's behaviour so far suggests it happens at upload.

That could change, and the VCA have revised their guidance six times this year. But if someone tells you their software is the only way to pass "the VCA's 679 business rules", ask them where the VCA publish those rules. The EU system has an Information Checking Module; the VCA page doesn't mention one.