Fiscalization in Europe: Country-by-country regulations (2026).

The Kassensicherungsverordnung is a regulation designed to ensure the tamper-proof security of electronic cash register systems. It requires businesses to use a Technical Security System (TSS) to securely record all transactions and prevent manipulation.

The Cash Register Security Ordinance (KassenSichV) applies to all businesses that use electronic recording systems to document business transactions.

This primarily affects sectors such as retail, hospitality, and other service industries where cash transactions are common.

It does not only target the users of these systems but also the manufacturers and providers of cash registers, point-of-sale systems, and related software. These companies are required to design their products in a way that complies with the technical and organizational requirements mandated by the KassenSichV.

As of January 1, 2020, cash register systems must be equipped with a certified TSS. The TSS must securely store each transaction, and all systems must undergo regular checks and maintenance. The system must also meet reporting requirements to the tax authorities.

Businesses operating in Germany have the flexibility to choose between cloud-based TSS such as fiskaly SIGN DE and hardware-based options, which are installed directly on cash registers.

Cloud-based solutions are maintained and updated by the service provider, making it easy to stay compliant with regulatory changes after the initial integration and scale when you want to expand.

Hardware TSS solutions have limited scalability, which can be challenging in cases of system changes or high transaction volumes.

Regardless of the chosen option, the TSS must be certified by the German Federal Office for Information Security (BSI). This ensures that the security mechanism meets stringent national standards for data integrity and protection against manipulation.

Transaction data must be recorded in the standardized DSFinV-K format (Digital Interface of the Tax Authorities for Cash Register System), making it easier for auditors to review and analyze data during tax inspections. This standardization ensures that all cash register data is complete, traceable, and verifiable by the tax authorities.

With the introduction of the receipt issuance obligation and the Cash Register Security Ordinance, Germany has required businesses with electronic cash register systems, since January 1, 2020, to issue a receipt for every transaction, regardless of the payment method. The issued receipt can be a physical paper receipt or a digital receipt.

A key component of the receipt issuance obligation is the precise specification of the information that a receipt must contain to ensure the transparency and traceability of transactions. Each issued receipt must include the following mandatory details:

• Full name and address of the business providing the service
• Date and time of the receipt issuance
• Quantity and type of goods delivered or services provided
• Invoice amount and applicable tax rate
• Transaction number
• Serial number of the electronic cash register system and security module
• Verification value and signature counter

Since January 2025, all businesses operating in Germany must report electronic recording systems (cash registers, EU taximeters, and odometers) and corresponding TSS details to the tax authorities to comply with the POS reporting obligation (Meldepflicht). 

Businesses are required to transmit a variety of information about the cash register systems and TSS (Technical Security System) used at each business location to the tax office. Details are specified in § 146a (4) Sentence 2 of the German Fiscal Code (AO):

• Type of cash register system: Description of the system used (e.g., stationary register, mobile system, cloud-based system).
• System serial number: Unique identifier for each cash register.
• Details of the TSS: Serial number, certificate number, manufacturer, and type.
• Date of commissioning: When the system was first used. Location: Address where the cash register is used.
• Change information: Decommissioning, replacement, or updates to the TSS.

This reporting is required to ensure the lawful use of the systems and to keep tax authorities informed about all cash registers in operation.

Since January 1, 2016, businesses in Austria have been required to meet three main obligations:

• the requirement to individually record all income and expenses,
• the necessity of an electronic recording system when certain revenue thresholds are exceeded,
• and the obligation to issue receipts for every cash transaction.

These requirements form the foundation of the Cash Register Security Regulation (RKSV) and define how cash registers should be used in the business environment.

Any business in Austria with an annual turnover exceeding €15,000 and cash transactions amounting to at least €7,500 must use an RKSV-compliant cash register that meets specific technical and security standards to ensure accurate recording of sales transactions (known as Registrierkassenpflicht, or cash register obligation).

An RKSV-compliant cash register must have

• a data recording protocol,
• a receipt printer,
• an interface to a security device,
• an AES 256 encryption algorithm,
• and a unique cash register identification number.

It must also be registered with the Austrian tax authorities via the FinanzOnline (FON) portal. This ID links the device to the business, providing a transparent audit trail.

Businesses operating in Austria are required to keep individual records (i.e. the ongoing and individual recording of all income and expenditure).

Similar to other countries, businesses are obligated to issue a receipt for every cash payment containing detailed information on the transaction in order to create transparency and prevent tax fraud.

In order to be compliant with the RKSV regulations, a receipt must include the following information:

• Business name
• Sequential receipt number
• Date and time of receipt issuance
• Quantity and description of goods or services
• Payment amount broken down by tax rates
• Cash register identification number
• Machine-readable signature

Every receipt issued by a compliant cash register must include a QR code that summarizes the signature and all essential transaction information in a machine-readable format. Customers and auditors can scan this code to verify the validity of the receipt.

The “Signaturpflicht” (§ 131b BAO) requires receipts to be digitally signed using a secure signature creation device, ensuring that any alterations to the data are immediately detectable. This digital signature guarantees the authenticity of transaction records.

To comply with the RKSV requirements, the electronic signature of a cash transaction must include specific details:

• Cash register identification number
• Transaction time
• Breakdown of transaction amount by tax rates
• Machine-readable signature (QR code)

The signature requirement is implemented through a technical security device that attaches an electronic signature to each transaction. This can be realized either through a physical signature card or a cloud-based solution.

Spain’s fiscalization is based on a pure cloud approach, but it is also complex because the country has five different tax authorities, each with its own legislation. This creates different requirements depending on the region and the type of company.

SII (Suministro Inmediato de Información) mandates the digital submission of VAT-related transaction data to Spain’s national tax agency (Agencia Tributaria, AEAT).

Companies with an annual turnover exceeding €6 million have been required since 2017 to report fiscal data through the SII system.

For companies below €6 million turnover, three different legislations apply (or will soon apply), depending on the regional tax authorities:

• Verifactu (national, except Basque Country & Navarra)
• TicketBAI (Basque Country regions)
• Navarra’s legislation

With specifications being greenlit in October 2024 by the National Tax Authorities (Agencia Tributaria, or AEAT), Verifactu systems regulation focuses on creating a standardized invoicing system.

Verifactu software adheres to Spain's Anti-Fraud Law and the regulation outlining the standards billing software must meet, including the capability for real-time communication with the AEAT.

Compliance with Verifactu requirements will apply to businesses and freelancers across Spain from January 2026 onwards, except for those with tax residency in the Basque Country and in the Navarra region.

It's important to note that all billing software operating in Spain must comply with Verifactu's technical requirements from July 2025.

TicketBAI is a software-based fiscalization system that ensures all invoices are digitally signed and reported to local tax authorities. It’s a regulation promoted by the Basque Country’s regional tax authorities (Vizcaya, Guipúzcoa, and Álava).

In Bizkaia, TicketBAI is part of a broader tax control framework called BATUZ. TicketBAI is being gradually implemented from 2021 to 2026, and although the regulation is the same, each province has its own technical requirements to comply with. That’s why it's important to be aware of the specific specifications when operating in different regions.

The tax authorities in this region are currently developing new legislation similar to TicketBAI and Verifactu, requiring companies to send all their transaction fiscal data to tax authorities in real-time.

While there is no official timeline for this legislation yet, it is expected to be approved in 2026.

Italy’s fiscalization regulations are centered around

• the documento commerciale (the commercial document, previously known as scontrino elettronico or electronic receipt)
• and mandatory e-invoicing systems

Since January 1, 2020, businesses are required to issue electronic receipts for all transactions and transmit the data to the Italian Revenue Agency (Agenzia delle Entrate, AdE).

The transmission happens through the use of certified hardware devices known as “Registratori Telematici” (RTs) or the online commercial document procedure made available to every merchant by the AdE on the invoices and receipts (“Fatture e Corrispettivi”) portal.

Businesses are required to use certified electronic devices (Registratori telematici, RT) to securely record and transmit transaction data. These certified cash registers generate unique identifiers for each receipt and must ensure secure recording and daily digital transmission of transaction data and telematic fees to the Italian Tax Agency (Agenzia delle Entrate, AdE).

Italy's legal framework for e-invoicing, outlined in the Legislative Decree 148/2018 and Decree 55/2013, focuses on public authorities and other entities. In compliance with the European Directive 2014/55/EU, B2G e-invoicing became mandatory for central administrations.

Initially applicable only to ministries, tax offices, and national security agencies, the requirement was extended to all public entities in 2015.

In January 2019, Italy became the first EU country to mandate e-invoicing at a national level for B2B and B2C transactions.

On March 7, 2025, the Italian Revenue Agency published the Provision Prot. No. 111204/2025, defining the technical specifications for developing, approving, and releasing certified cloud-based solutions for the storage and electronic transmission of daily transaction data.

In addition, the regulation governing software solutions for sales data, together with the technical specifications published on March 7, 2025 by the Italian Revenue Agency, goes beyond defining functional and technological aspects. It clearly outlines the roles of the stakeholders in the new digital ecosystem, with the aim of ensuring accountability, traceability, and service quality.

These solutions represent a valid alternative to traditional fiscal devices (Registratori Telematici RT), allowing businesses to manage their fiscal data entirely in the cloud, including integration with advanced POS systems, without the need for hardware.

Transaction data (corrispettivi) must be transmitted to the tax authorities for the continuous monitoring of businesses activities. If the taxpayer uses the online commercial document procedure, the transmission will be done in real time.

Alternatively, when using an RT device the data are sent at the end of the day, at the latest within 12 days from the recording day. This oversight helps reduce tax evasion and ensures proper VAT collection.

France introduced fiscalization on January 1, 2018, requiring VAT-liable businesses conducting B2C sales to use certified POS or cash register software.

Since January 1, 2018, businesses subject to VAT and conducting B2C sales must use software certified by accredited bodies (such as NF525) or provide equivalent proof of compliance.

Cash register software must guarantee

• Inalterability (no retroactive data changes)
• Security (protection against tampering)
• Retention (data must be stored securely)
• Auditability (complete traceability for tax inspections)

Until recently, businesses could demonstrate compliance through self-certification. The Financial Act of February 2025 (Article 286 of the General Tax Code) has ended that option: all POS systems must now obtain external certification from an accredited body within the following deadlines:

• August 31, 2025: POS providers must have initiated the external certification process
• March 1, 2026: A valid third‑party certification is mandatory

Failure to meet these requirements can lead to substantial penalties, creating significant time pressure.

• E-invoicing for B2G transactions: Mandatory since January 2020 (with earlier rollouts from 2017 for large enterprises).
• B2B e-invoicing & real-time reporting: Rolling out in three phases until January 2026, covering all businesses.

Paper or digital receipts must include specific mandatory fields, such as date and time of the transaction, total amount (including VAT breakdown), and unique identifier or invoice number.

As part of the Anti-Waste Law (Law No. 2020-105 of 10 February 2020 or “Loi anti-gaspillage”), merchants only have to provide printed receipts when asked explicitly by the customer and  customers must be offered the option to receive receipts electronically.

Any business that accepts payments in cash, by card, or through equivalent electronic methods, and whose annual turnover exceeds the threshold linked to the price base amount (SEK 235,200 in 2025), is required to operate a certified cash register connected to a certified control unit.

This unit, which generates control codes and records transaction data, can be provided as a physical device or as a cloud-based API service.

Fiscal equipment must be registered with Skatteverket (the Swedish Tax Agency), and companies must comply with daily requirements such as issuing a receipt for every transaction, either digital or paper, and producing a report at the end of each business day.

Any business selling goods or services in Sweden that accepts cash, card, or equivalent electronic payments and exceeds the turnover threshold (SEK 235,200 in 2025) must use a certified cash register connected to a certified control unit.

The control unit is a certified security component that works alongside the cash register. It receives each transaction, generates a unique control code, and securely stores the data for auditing by Skatteverket. Control units can be hardware devices or certified cloud-based services accessed via API.

GKS 2.0 (Geregistreerd Kassasysteem) or SCE 2.0 (Système de Caisse Enregistr­euse) is the new, cloud-based version of Belgium’s registered cash register system. Unlike the older hardware-based setup, it enables real-time data transmission to FPS Finance, supports digital receipts, and eliminates the need for on-site inspections. It replaces the black box (FDM) and VAT smart card (VSC).

Like the current system, the obligation applies to businesses in the HoReCa sector (hotels, restaurants, and catering) with on-premise sales above EUR 25,000. However, the government is considering extending the requirement to other sectors with high volumes of cash transactions in the future.

The introduction of GKS 2.0 has been postponed to allow more time for certification and technical readiness.

• New businesses must comply from January 1, 2026.
• Existing SCE 1.0 users will transition gradually starting July 1, 2026, depending on their current system’s activation date.

Businesses will move from local data storage in the FDM to cloud-based reporting, ensuring transactions are securely transmitted to FPS Finance in real time. The update also allows digital receipts, faster processing, and simplified compliance, reducing the need for physical inspections.

To operate legally in Portugal, invoicing and POS systems must be certified by the tax authority (AT) and meet a defined set of technical and security standards. Certified software must guarantee data integrity, traceability and proper auditability of all tax-relevant documents.

SAF-T (PT) is the Standard Audit File for Tax, a structured XML file defined by the Portuguese tax authority that contains detailed accounting and invoicing data. Businesses must submit their invoice data to AT every month, which makes SAF-T a central part of fiscal compliance in Portugal.

ATCUD (Código Único do Documento) is a code that uniquely identifies every invoice and fiscally relevant document in Portugal. It links each document to an authorized invoice series and ensures full traceability for the tax authority. For POS providers, supporting ATCUD correctly is essential for legal compliance.