The TSE deadline: hardware or cloud?

A year ago we wrote that 30 September 2020 was the real deadline for equipping a German cash register with a TSE. Then the pandemic happened, certified devices were scarce, and in mid-2020 fifteen federal states granted their own extension to 31 March 2021. That extension ends in three weeks.

From 1 April 2021, an electronic register without a certified TSE is simply non-compliant. Penalties under § 379 AO can reach 25,000 euros, but the more practical risk is an auditor treating your books as unreliable and estimating your revenue for you.

What a TSE actually does

The TSE is a small, certified component that sits between your till and your records. Each time an order is opened and closed, the TSE creates a cryptographic signature over the transaction data and increments a counter. The signature and the counter go on the receipt. An auditor can later verify that every transaction in your export was signed in sequence and that nothing was removed.

Think of it as a tamper-evident seal on every sale — not on the drawer.

Two ways to get one

Hardware TSE. A microSD card, SD card or USB stick that plugs into the register. Well-known manufacturers are Swissbit, cryptovision and Diebold Nixdorf, and Epson also ships integrated solutions. Typical price: roughly 150 to 300 euros per device, with a certificate validity of several years after which the unit must be replaced.

Good for: single-site businesses with one or two tills, legacy hardware, places with unreliable internet.

Watch out for: one TSE per register, physical handling, replacement cycles, and the "what if the stick fails" question — you must be able to document downtime.

Cloud TSE. The signature is created by a certified service in a data centre. Your POS talks to it over an API. The first cloud TSEs — among them fiskaly's SIGN DE and Deutsche Fiskal's solution — received BSI certification at the turn of 2020/2021, which is why this option is only now realistic.

Good for: multi-site operators, tablet-based and cloud POS, franchises, anyone who wants one central view of all tills.

Watch out for: you need a stable internet connection, though most cloud TSEs buffer transactions for short outages, and you are entering a subscription relationship with a provider.

Our view for owners

If you have one register and it already has a slot for a hardware TSE, buy the card, get it installed, and move on.

If you run more than two or three locations, or your POS already runs in the browser or on tablets, the cloud route usually wins on operating cost and — more importantly — on visibility. You get every transaction from every site signed and stored in one place, which also makes the later DSFinV-K exports and audits much simpler.

Whatever you pick: the TSE must be activated, in use and documented. A TSE that is installed but not initialised is worth nothing in an audit.

For developers and integrators

The cloud option changed our integration work more than anything since the law itself.

Why fiskaly stood out to us. fiskaly SIGN DE is consumed as a REST API. You create a TSS — their term for a TSE instance — and a client per till, then wrap each sale in a transaction:

• PUT /tss/{tss_id}/tx/{tx_id}?tx_revision=1 puts the transaction in state ACTIVE. The order has been opened.
• PUT /tss/{tss_id}/tx/{tx_id}?tx_revision=2 puts it in state FINISHED, with the full receipt payload. Payment is done.

The FINISHED response gives you the signature value, signature counter, transaction number, log time and the QR-code string you print on the receipt. The same API family later provides the DSFinV-K export for a date range — one fewer thing to build yourself.

Design notes that apply to any TSE, cloud or hardware:

• Open the TSE transaction when the order starts, not at payment. Cancelled or abandoned orders still need a FINISHED record with the cancellation type.
• Persist the TSE response fields next to the receipt row in your own database. If the receipt fails to print you still need the record.
• Handle TSE unavailability explicitly: log the outage with timestamps, mark affected receipts, and continue selling. The law allows this if the outage is documented and resolved promptly.
• Store the TSE serial number and certificate expiry. You will need both in the export and, later, for reporting to the tax office.
• Hardware TSEs typically sit behind a vendor SDK — Swissbit, cryptovision — that exposes the same TR-03151 lifecycle, and cloud providers hide that behind HTTP. Abstract the interface in your code so you can switch providers.

Next in the series: what the DSFinV-K export really contains, and why getting the data model right matters more than the CSV itself.

This is general information, not legal or tax advice.

Daleenda integrates hardware and cloud TSEs into custom and off-the-shelf POS systems for German hospitality clients.

Ask us about your setup before 31 March