D TRUST TSE Recertification Tips for Companies

Status: March 22, 2023

There is a great deal of uncertainty: Since January 7, 2023, the so-called Technical Security Devices (TSE) from the Bundesdruckerei (D-Trust TSE modules) may no longer be operated. Under certain conditions, a transitional regulation applies until July 31, 2024. For companies, the question arises: what needs to be done? This article provides practical advice on how to handle the current situation.

Update: Extension of the transitional period

In a notification dated March 16, 2023, the Federal Ministry of Finance (BMF) announced that the transitional period for the replacement of TSE modules has been extended to July 31, 2024, and applies to all TSE modules purchased both before and after July 7, 2022.

On July 8, 2022, the BSI (Federal Office for Information Security) announced that the Technical Security Device (TSE) from the Bundesdruckerei (D-TRUST, certificate BSI-K-TR-0491-2021) may no longer be used as of January 8, 2023. As a POS system manufacturer, commsult has also relied on the TSE solution from D-TRUST for its mobile delivery solution OntegoGL since 2020. Until recently, the manufacturer's public communication stated that the TSE modules would be valid for a period of five years from the date of purchase. This statement has been void since the BSI announcement. As of January 8, 2023, POS solutions using the existing D-TRUST TSE will no longer be considered compliant with cash security regulations—at least, that is the current legal situation.

Note: The certificate originally issued for the D-TRUST TSE modules, BSI-K-TR-0374-2020, was valid until 2028. Surprisingly for outsiders, a new, time-limited certification was issued in 2021 in accordance with BSI-K-TR-0491-2021. As a result, all D-TRUST TSE modules purchased and deployed up to January 7, 2023, lose their approval (subject to the transitional regulation mentioned below).

All companies operating a POS solution with a local Technical Security Device from D-TRUST in the form of SD or micro-SD cards must address this issue. In the specific case of the cash register function integrated into the OntegoGL delivery solution, this mainly affects companies in the beverage industry, such as breweries and specialist beverage wholesalers.

Excursion: OntegoGL and Cash Security

OntegoGL is an app solution for delivery logistics used on mobile devices such as smartphones.

• The software specifically supports delivery processes and empties recording in beverage logistics.
• OntegoGL contains an optional cash register module, which is used by customers for driver or truck collections.
• With this cash register module, the truck driver can collect cash directly and generate a receipt on-site using a mobile receipt printer.
• The recording of a cash payment is secured directly on the mobile device via the D-TRUST TSE modules used.

For a long time, there were no statements or concrete instructions for action from the parties involved—the Bundesdruckerei, the BSI, or the Federal Ministry of Finance. Currently, one must assume that there will be no certified TSE solution from D-TRUST by the deadline. With the letter "2023/0245012" (go to document) dated March 16, 2023, the Federal Ministry of Finance formulated its perspective:

• The replacement of the decertified TSE must be carried out immediately, at the latest upon the certification of TSE Version 2 from the company cv cryptovision GmbH [...].
• The transitional regulation can also be claimed for TSE purchased or installed after July 7, 2022.
• The previously used D-Trust TSEs may continue to be used until a maximum of July 31, 2024, provided that an earlier replacement is not possible.
• The utilization of the exemption rule must be reported to the responsible tax office in writing or electronically—companies that have already submitted a notification to the responsible tax office do not need to do so again.

In a communication dated November 22, 2022, to the main distribution partner for the TSE modules, the Bundesdruckerei outlined a path for a future legally compliant cash security solution. "We plan to be able to provide all users of the D-Trust TSE Module 1.0 with a new TSE module free of charge by the time the transitional regulation expires on July 31, 2023," the letter states. As before, certification by the BSI is a prerequisite. A concrete exchange offer is reportedly in preparation.

In addition to the Bundesdruckerei / D-TRUST, the Swiss company Swissbit also offers a TSE solution for local cash security. In practice, however, the solution is not (or no longer) usable, as the TSE modules do not work on Android 11 and newer. Android 13 is now officially available and is shipped directly ex works on newer devices (smartphones).

Against this background, one currently has to wait for a successor solution from Swissbit as well, as the solution currently available on the market is not upgradeable.

Below we provide some advice for companies with mobile POS solutions.

• Companies operating TSE modules purchased before or after July 7, 2022: Inform your responsible tax office that you will be utilizing the "Transitional regulation for the use of TSE Version 1 from the company cv cryptovision GmbH, distributed under the name D-TRUST TSE-Modul" dated October 13, 2022 / March 16, 2023.
• Stay informed via your POS provider. commsult is monitoring the market and will examine the integration of alternative TSE solutions as soon as they become available.