Effects of the Cash Register Security Ordinance on the Digital Delivery Note

Mobile direct-sales solutions are widely used in the beverage industry. If they are also used to record cash payments, these software systems fall under the Cash Register Security Ordinance (Kassensicherungsverordnung).

Cash payments are a key focus of the Federal Ministry of Finance (BMF) and since October 1, 2020, may only be recorded in a tamper-proof manner in accordance with the Cash Register Security Ordinance. The regulation is broadly defined and affects not only restaurants or retail stores but also the delivery process in the beverage industry when mobile software is used provided that cash payments are possible within the workflow. Cash receipts must therefore be equipped with a so-called TSE signature, and in the event of an audit, cash receipt data must be made available to the tax authorities electronically in a standard format.

In concrete terms, this means: beverage wholesalers, breweries, or mineral springs that use a solution for electronic delivery notes and also record cash payments must upgrade their hardware and software.

The following five regulations are particularly relevant for mobile direct sales:

• Law on the Protection Against Manipulation of Digital Basic Records
• Fiscal Code (AO) §146a
• Cash Register Security Ordinance (KassenSichV)
• Administrative Guidance for §146a
• Digital Interface of the Tax Authorities for Cash Register Systems (DSFinV-K)

The starting point for the matters described here is the “Law on the Protection Against Manipulation of Digital Basic Records” from December 2016.

This law anchored §146a in the Fiscal Code. In this paragraph, the Ministry of Finance obligates the users of such recording systems to:

• Individually record business transactions
• Use a certified Technical Security Device (TSE)
• Notify the tax office of the recording systems used

The requirements of the above paragraph are specified by the Cash Register Security Ordinance (KassenSichV), published on December 22, 2016. This ordinance describes—very generally—the specifications for how digital basic records must be recorded, secured, stored, and made available, as well as the design of receipts.

Recording systems such as cash registers record (1) business transactions—for example, the payment of an invoice. These records must then be stored for at least ten years. However, mere recording is not sufficient. The legislator requires that the data be protected against manipulation in the future through a TSE signature. Each business transaction receives a kind of digital envelope that indicates later tampering if it is “damaged.”

The recorded business transactions must (2) be kept ready for a cash register inspection or external audit in a special data format compliant with DSFinV-K, which can be electronically read by the tax auditor. This concerns the Digital Interface of the Tax Authorities for Cash Register Systems.

So much for the legal foundations and the resulting technical offerings. What is crucial, however, is how they apply in practice to beverage delivery. Typically, a software application (app) is used in mobile driver solutions, running on mobile devices such as smartphones, to support truck drivers in the logistics of beverage distribution. Delivery data e.g., route information, customer addresses, and goods to be delivered—are transferred to the app via an interface from the ERP system.

At the customer location, the truck driver confirms the delivery of goods via the software on the mobile device, records any deviations such as quantity changes, and also logs returned empties. In some cases, such as ad-hoc sales or home delivery services, it is also possible to record new delivery items.

At certain customer stops, it may happen that the truck driver collects payment in cash directly on site—effectively acting as the cashier—and generates a receipt using a mobile receipt printer. The invoice amount is calculated by the mobile software. Depending on the beverage logistics company, there are different variants for how receipts are created and further processed—for example, a priced delivery note, a pro forma invoice, or a genuine invoice generated directly on the mobile device, after which the customer pays in cash.

Until now, the common understanding among manufacturers, users, and ERP providers alike was that these driver solutions represent the mobile “arm” of the ERP system. The cash collection by the delivery driver—for example, a beverage wholesaler’s driver—is therefore not equivalent to the cashier process in a restaurant or retail shop, where customers anonymously purchase goods and possibly pay in cash.

This leads to the question: Is the Cash Register Security Ordinance intended for delivery services or delivery processes in beverage logistics, and does the type of cash collection described here fall under this ordinance? The Ministry of Finance is essentially unambiguous in its FAQ on the Cash Register Law: “As soon as systems are capable of recording and processing cash payment transactions, the corresponding part of the software—though not the entire system—is subject to the requirements of §146a AO in conjunction with the KassenSichV.”

It must be noted: According to the tax authorities, mobile recording systems in beverage delivery are considered cash register systems and must record cash-related transactions. Discussions with several providers of ERP systems for the beverage industry made it clear that the security measures can be clearly limited to the mobile recording level. All data requiring documentation exist on the mobile level, and the leading ERP system is not involved in the cash payment process.

Conclusion: Both TSE protection and DSFinV-K export are required and technically feasible in the mobile driver solution.

Since April 2017, the obligation to use an electronic cash register has been in effect in Austria. For users of mobile direct-sales solutions, this did not result in significant changes—this is the major difference compared with the current situation in Germany. Mobile sellers there are exempt from immediate receipt-signing requirements or are granted a reasonable grace period.

The Austrian Ministry of Finance states: “The Cash Revenue Regulation includes simplified rules for the recording times of cash revenues for so-called ‘mobile groups.’ These are entrepreneurs who provide their services outside of their business premises […]”.

In practice, this could work as follows: A mobile receipt may include the printed note, “This receipt is not electronically signed in accordance with the Cash Revenue Regulation 2015 §7 ‘mobile groups’.” After the tour is synced back to the ERP system, the correct recording of cash register activities including electronic signing takes place there. Due to technical requirements, an online connection to the signing system is necessary for this, which cannot be guaranteed during a delivery route.

German authorities specifically officials from the Federal Office for Information Security—have a clear stance on adopting the Austrian approach: “This example is intentionally not to be followed

Companies whose delivery processes include the possibility of cash payments generally have several options for action. One thing is important: something must be done if one wants to avoid the legal threat of fines up to 25,000 euros for failing to secure records.

For beverage direct-sales operations, discontinuing cash payments simplifies many things. To avoid the TSE requirement, the “cash payment” function can be disabled in the mobile ERP system, allowing legally compliant operation. Switching to card payments e.g., debit or credit card is also an option to document payments in a tamper-proof manner and forgo the TSE. Alternatively, handling cash payers on paper is legally permissible, for example as part of a dedicated “cash payer route.” However, it is assumed that many companies would consider this a rather undesirable return to the pre-digital era.

Another option is upgrading the mobile software in use to include TSE functionality and DSFinV-K export capability. Cash register system manufacturers—including providers of mobile delivery solutions with cash payment functionality—offer their customers legally compliant software that integrates an offline-capable TSE, enables cash register closing and cash reconciliation, and provides DSFinV-K-compliant data exports for tax auditors when needed.

In summary, the Cash Register Security Ordinance requires providers of recording systems to provide compliant solutions. Beverage manufacturers and beverage wholesalers using mobile direct-sales solutions will need to rethink how they handle cash-paying customers. The obligation for TSE signing may serve as an incentive to push topics such as card payments. This would not only be in line with modern practices and customer expectations but would also likely be welcomed by the tax authorities, given the improved auditability.