We know how difficult it can be to understand and implement national laws. France in particular, is characterised by very complex legislation. The implementation of cash register security in accordance with the law is not an exception. In addition, it is not easy to keep track of the various players in the market. As fiskaltrust.France, we have set ourselves the goal of providing transparent and independent information and support for all of our partners.
What does the legislator require of shop owners?
In France, there is neither a cash register obligation nor a receipt sharing obligation, as found in other European countries. In fact, merchants are still allowed to keep a handwritten cash book records. However, the legislator has set the following restriction: anyone who processes and stores cash register receipts electronically must correspondingly use a secure cash register system.
What is a secure cash register system?
Here, too, the French legislator has a very clear but simple answer. It has defined this in paragraph 88 of the 2016 Finance Act (article 88, LOI n° 2015-1785 du 29 décembre 2015 de finances pour 2016). This definition was then clarified in several decrees, of which the latest was published on 30 December 2020 under BOI-TVA-DECLA-30-10-30. In the first paragraph, it is stipulated that cash register systems must comply with the so-called ISCA principles.
- Inalterability
- Security
- Conservation
- Archiving
As soon as these four rules have been integrated into the POS system, it complies with the law. No further measures for cash register security, such as additional hardware, are required. Also, the implementation of the four principles is not exactly defined, but only certain minimum technical requirements have been set.
How does one prove the use of a secure POS system?
This question has also been clearly answered by the legislator: Every cash register manufacturer that puts a cash register or cash register software into circulation must either have it certified by an independent body or can issue an attestation of conformity. However, there is also a restriction on issuing attestations. Those who create their cash register software for their own internal use and not for sale to third parties must have the software certified.
Certify or self-attestation?
We have already written a post about this to highlight the advantages and disadvantages of each method. Nevertheless, let’s take a brief look at it again because this topic, in particular, is very often provided with puffery arguments and the fear of those involved in the market is also often preyed on. Let’s try to take a neutral look at it here.
Self testify!
Yes, it is possible to declare oneself legally compliant. This is of course a very simple solution to serve the French market. As a cash register manufacturer, you fill in a form proposed by the legislature, sign it and hand it over to the cash register operator.
Is it really that simple? Yes, it is! But there are not only advantages to be found. The self-attestation is inexpensive, no one checks your software, the time required for implementation is much less and changes to the POS system can also be made at any time. On the other side, however, are the disadvantages. You have to implement the ISCA principles yourself and in full, cash register operators rely more on certification, changes in the legal situation are not necessarily detected in advance and the entire risk in the event of incorrect implementation lies with the cash register manufacturer. Also, supplying a fraudulent self-attestation carries great legal penalties including fines and possible prison time.
You can compensate for some of the disadvantages with fiskaltrust. A large part of the implementation of the ISCA principles is included in the licence-free fiskaltrust.Middleware, the monitoring of the laws can be taken over by fiskaltrust for you and also the risk can be partly transferred to fiskaltrust.
Are you interested? Contact our Key Account Manager without obligation to find out more!
Certify!
Some POS systems need to be certified and others want to overcome the disadvantages of self-attestation and have their products independently tested. There are two French organisations for achieving certification.
Infocert
An organisation that offers a certification procedure which ends with the permission to use the trademark “NF-525” in daily business.
This private company is accountable to AFNOR and COFRAC for the fee-based set of rules and regulations and tests your product against this framework. The technical implementation of the ISCA principles is precisely defined in the reference framework. In some cases, the reference framework requires more than the legislator has provided or defines the legal requirements very precisely without any further leeway. This can be an inconvenience, as some things are very difficult to implement or requires change in the business processes of the cash register operators. In addition, the cash register manufacturer is also audited with regard to the quality of product production. This examination, called an audit, is carried out by two independent auditors and lasts between 2 and 5 days.
After the first audit, the POS system is subjected to an annual review or re-audit. This is about 75% of the scope of the initial audit. And after three years, the cycle is started again with a full audit.
LNE
A state institution that also has a certification procedure. Here, too, a certificate is issued at the end and, in addition, a seal is provided for daily business transactions.
This certification body works with a publicly and freely available set of rules against which the cash register software is checked. Of course, the ISCA principles are also defined here. Here, the focus is additionally placed on quality assurance and compliance management. 19 rules are defined on how to achieve compliance with the law. In addition, however, examples of implementation are given for the type of verification. Exact technical specifications, however, are not found in these rules. This process also ends with an audit by two independent auditors and takes about three days.
This organisation also audits the certified POS system at annual intervals. However, only changes to the system or necessary adjustments to a changed legal situation are checked. A complete audit is only necessary if the POS system has undergone serious changes.
As an independent middleware provider, we support you in obtaining certification with any organisation. Have we piqued your interest? Contact our Key Account Manager without obligation to find out more!
What are the obligations of the cash register manufacturer and the operator?
In addition to the use of the legally compliant POS system, there are other obligations.
The manufacturer must ensure consistent versioning of its POS system and traceability of changes to the system.
The POS system must also be able to create a fiscal archive. This must contain all the system’s cash register data, must be readable with any tool and may only contain the data of a maximum of 365 days. In addition, an explanation of the contents of the archive (for example, the meaning of the data field names) must be provided in French.
Step-by-step instructions for creating or downloading the archive must also be available in French.
And last but not least, the manufacturer must also provide a test tool to prove the integrity of the archive.
The certificate or attestation must also be made readily available to the cash register operator and in French.
In contrast, the cash register operator must present the certificate or the attestation in the event of an inspection. This can be done either as a printout or electronically, for example as a pdf file.
On the basis of the independent and licence-free fiskaltrust.Middleware, you can implement this requirement yourself or have it supported. Contact our Key Account Manager without obligation to find out more!
What are the possible consequences?
Again and again we come across arguments and statements that spread fear. Fear of penalties, of the complex laws, of the implementability of the laws, of fiscal controls and many other things.
We think fear is a bad advisor and absolutely not necessary. With a professional, clear and transparent approach to this topic, a POS system that complies with the law can be achieved within a short time!
Of course, the legislator has also provided penalties for non-compliance with the law. We will mention only two examples here. On one hand we do not want to contribute even more to the uncertainty and on the other hand we want to point out possible dangers in daily business.
If the cash register operator cannot provide an attestation or certification for the POS system used, € 7,500 must be paid per installation. After that, the operator has 60 days to bring the system into compliance with the law.
If a certified version of a POS system exists and is not used, but an older/newer version is used, this is interpreted as an attempt to fraud and can be punished with high fines or even imprisonment.
Legally compliant POS systems for France!
As a partner, fiskaltrust tries to inform and support you in a transparent and independent way. Our aim is to create POS systems that are compliant with the law without:
- increase costs;
- change processes for the operator; or
- to create restrictions in the development.
For this purpose, we provide our licence-free and system-independent fiskaltrust.Middleware. With it, a POS system can become legally compliant. For the manufacturer, we offer support in the certification process or assistance with the self-attestation.
Due to our independence from manufacturers and third parties on the market, we can work out the ideal solution with you. We are happy to accompany you to your success on the French market.