What the KassenSichV changed at every German till

If you run a restaurant, a bakery, a salon, a kiosk or any business in Germany that takes cash or card payments at a till, the rules for how your register records sales changed two weeks ago. The Kassensicherungsverordnung (KassenSichV) — the cash register security ordinance — is now in force.

This is the first post in our series on German fiscalization. We work with hospitality and retail clients in Baden-Württemberg and across Germany, and most of the questions we hear right now boil down to three things: What do I have to do? By when? And what happens if I do nothing?

Where this comes from

The legal root is the Kassengesetz of December 2016, which added § 146a to the German Fiscal Code (Abgabenordnung, AO). The law's purpose is simple: make it technically impossible to delete or alter a sale after it has been recorded. Cash businesses have long been a focus of tax authorities because an unrecorded sale leaves no trace; the new rules close that gap with cryptography rather than with more inspectors.

§ 146a AO sets the principle. The KassenSichV, issued in 2017, defines the technical details. Together they form the framework you will hear people call Fiskalisierung.

The three things that changed for you

1. Every transaction must be secured by a certified TSE. Every electronic recording system must be connected to a Technische Sicherheitseinrichtung (TSE) — a certified security module that signs each transaction. The TSE has three parts: a security module that generates the signature, a storage medium, and a standardized digital interface. Certification is done by the BSI (Bundesamt für Sicherheit in der Informationstechnik).

Here is the honest situation in January 2020: certified TSEs are only just reaching the market. Because of that, the Federal Ministry of Finance issued a Nichtbeanstandungsregelung (non-objection rule) — tax offices will not object if your register is not yet equipped with a TSE, provided you upgrade by 30 September 2020. Treat that as the real deadline.

2. You must issue a receipt for every sale — the Belegausgabepflicht. Since 1 January 2020, a receipt must be produced for every transaction, whether or not the customer wants it. It can be paper or electronic — a QR code on a screen, an e-mail, an app. This is the rule that made headlines as the "Bonpflicht", and it is the most visible change for your customers.

3. Your register must be able to export data in a standard format. Auditors will be able to pull a standardized export — the DSFinV-K — directly from your system during a Kassen-Nachschau, an unannounced cash register inspection that has been possible since 2018. We will cover the export format in depth in a later post.

What if your register is old?

There is a transition rule. Registers bought after 25 November 2010 and before 1 January 2020 that meet the 2010 GoBD-era requirements but cannot be retrofitted with a TSE may be used until 31 December 2022. If your device can be upgraded, the transition rule does not apply to it.

What to do this quarter

1. Ask your POS vendor, in writing, when their TSE integration will be available and whether it is BSI-certified.
2. Check whether your current hardware can be retrofitted or must be replaced.
3. Make sure your system prints or displays a receipt for every sale, today.
4. Keep a Verfahrensdokumentation — documentation of how your register is set up and operated. Auditors ask for it.

For developers and integrators

If you maintain POS software for the German market, the clock is running on three pieces of work.

TSE integration. The TSE exposes a standardized API, defined in BSI TR-03153 and TR-03151, with a transaction lifecycle: startTransaction, then updateTransaction, then finishTransaction. Every transaction must be opened at the moment the order begins — not at payment — and closed with the final payload. The TSE returns a signature counter, a transaction number, a timestamp and a signature, all of which must appear on the receipt.

Receipt content. § 6 KassenSichV lists the mandatory receipt fields: business name and address, date and time of start and end, transaction number, quantity and type of goods, amounts and VAT, and the TSE serial number plus signature data. Most vendors encode the TSE data as a QR code.

DSFinV-K export. Your system must be able to produce the DSFinV-K CSV package on demand. Start with the data model now; retrofitting a clean export later is painful.

Hardware TSEs — SD cards, USB sticks — are what you can buy today. Cloud TSEs are in certification and will matter a great deal for multi-site and cloud-native POS. We will return to that in the next post.

This is general information, not legal or tax advice.

Daleenda builds and integrates POS, ordering and back-office software for hospitality and retail clients in Germany and the MENA region.

Ask us for a fiscalization assessment