Cash Law 2020

No business transaction without a receipt: Anyone who records income and expenditure with a till must keep proper records. To ensure that electronic POS systems also record all relevant transactions, the “Law for the Protection against Manipulation of Digital Records” applies. It is also known as the “Cash Law 2020“. The federal government has defined what is required for all POS systems that are used in restaurants, shops or hotels, for example:

• Certified Technical Security Equipment (TSE): The POS systems are to be protected against manipulation via a security module, a secured storage medium and a digital interface. This leads to the important question for businesses of whether new systems may have to be purchased in order to comply with the new rules. You can read more details on this in the following.
• Reporting duty: Every business that uses a POS system must report the technologies used to the responsible tax office. Those who acquired their POS system before 1 January 2020 were originally supposed to have completed the notification by 31 January 2020. In the meantime, transitional periods apply, which we explain below.
• Receipt Obligation: A receipt must be issued to the customer for each individual cashier transaction. This receipt can be issued either in paper form or, if the customer agrees, electronically. The obligation only relates to the issuing of the receipt, the customer does not have to take the receipt with them. Anyone who considers the receipt obligation to be unreasonable, e.g. because of a large number of individual receipts for very small amounts, can apply for an exemption from the obligation.

Which TSE Solutions are Available for POS Systems?

Two different types of TSEs are already available on the market. At the same time, the responsible authorities are still busy certifying the offers. You should be familiar with these two solutions:

TSE Cloud Solution

With the TSE Cloud solution, there is a server address or a certified cloud storage to which turnover data of the POS system can be uploaded in real time. The prerequisite for this is a suitable POS software – or a POS software that has already implemented the interface. For Android POS systems, certified third-party providers such as “Deutsche Fiskal” or “fiskaly” provide a cloud-based interface to which every POS solution transmits the digitally signed POS transactions.

TSE Module

A TSE module is a combination of security chip and memory card. The POS system can be operated with locally installed software or software that works in the local network. The TSE module must be inserted into the POS system or, say, into a network printer. The POS system sales are then written to this memory in real time – i.e. “live” – and stored unchangeably. Manufacturers such as SUNMI POS already offer Android POS systems with a corresponding slot – it is important to ensure that the TSE module does not stick out or can be easily stolen, and that it can be removed by the tax official during a cash audit.

New Deadlines Granted (incl. Current Notice on TSE Deadline Extension)

According to the text of the law, the obligation to provide proof of a TSE POS system will apply from 1 January 2020. As has been announced in the meantime, there are various transitional periods, which Bundesdruckerei (German Federal Printing Office), for example, informs about online. Officially, a transitional period is granted until 30 September 2020, which means that if your business has not yet supplemented or converted the POS system, this situation will be tolerated at least until the end of September. Some federal states have also adopted an extended regulation, which is generally referred to as the TSE deadline extension, but only partially lives up to its name, as you can see from the article linked above.

An extended transition period applies to businesses that purchased a POS system between November 2010 and 31 December 2019 that cannot technically be retrofitted with a TSE. If your business falls into this category, you can still manage without a TSE POS system until 31 December 2022 free of penalty.

TSE Checkout 2020 – these Case Studies Will Help You Find the Best Solution

If your business is looking for compliant POS solutions, you can use these three cases as a guideline:

• Does your existing POS hardware have an appropriate slot for the installation of certified TSE modules? Then both the TSE Cloud and the module come into question.
• Does your POS hardware not have a theft-proof TSE slot? In this case, the POS software must have an interface to a TSE Cloud.
• Does your POS system have neither a suitable slot nor software that enables a TSE Cloud connection? In this case, you should provide for a replacement within the framework of the extended transition period.

As a rule, a timely, intensive examination of the topic should be worthwhile – according to the text of the law, violations of the new Cash Law 2020 can result in fines of up to 25,000 euros.

There has been a lot of movement on the market since the law was published. Companies are preparing to launch complete solutions for certified security devices. Together with our software partners, we at CONCEPT have already created the necessary framework to enable data backup in compliance with the law.

Contact Our Experts Free of Charge

POS systems purchased from us can be equipped with a appropriate interface on the software level and, in addition, with a TSE module. In this way, we can ensure that our hardware is configured and certified in accordance with the specifications. Please contact us so that we can find the most suitable solution for your business!

What Data Does a TSE POS System Record?

The Federal Ministry of Finance published a so-called “Application Decree” (AEAO) in June 2019. It states that all business-relevant transactions are to be recorded. This includes normal turnover through cash receipts and cash withdrawals, electronic payments by EC or credit card, cancellations, tips, redeemed vouchers, private withdrawals or deposits, change deposits or even salary payments from the POS system. Only purely functional transactions such as setting the screen brightness are not fiscally relevant and are therefore not stored for the authorities.

Once a transaction has been recorded, it cannot be changed at a later date – the technical security device works according to the principle “write once, read only”: What has been recorded once can only be read out. In practice, this means, as an example, that an immediate reversal is not possible with a TSE POS system 2020: the recording of the revenue and the reversal of the same are two separate processes. Special working groups in the tax authorities have designed a uniform taxonomy for data entry for all conceivable POS system transactions.

Cash Security Ordinance Supplements Cash Law 2020

The “Cash Security Ordinance” (KassenSichV) clarifies how payment transactions must be recorded and documented in a structured manner with reference to the Cash Law 2020 and the Tax Code (section 146a AO) amended as a result. The Federal Office for Information Security (BSI) in turn defines the important technical details of the required security device.

This mainly specifies requirements, but does not prescribe an exact design. According to this, the combination of security module, storage medium and digital interface should be able to:

• Protect against subsequent changes
• Protect against subsequent deletion
• Store in a uniform format

Addressing manufacturers and providers of TSEs, the BSI published specifications and test criteria for certifiable solutions. Important details are:

1. The POS system itself is not subject to certification, but only the technical security device.
2. The TSE does not necessarily have to be permanently installed in the individual POS system, but can also be realised in an external hardware (such as a smart card that secures data and provides digital interfaces) or in a cloud solution.
3. Due to this open regulation, there can also be adapted solutions, especially for businesses that operate several POS systems in a network. The goal here is a clear backup, i.e. that each booking or transaction should be recorded via one and the same backup solution and not, for example, distributed across several different TSEs.

The BSI emphasises the fundamental openness of technology in all specifications. This is to say that there will not be just one ideal solution, but several competing solutions for the legal requirements.