Reference

BR-51 Card primary account number must be masked

In accordance with card payment security standards, the invoice shall never include a full card primary account number (BT-87); PCI rules allow at most the first 6 and last 4 digits.

Problem Description

WARNING

EN 16931 core business rule (CEN)

This is an EN 16931 core rule whose severity depends on the syntax: the validation artefacts report it as a warning for UBL and as a fatal error for CII. It protects card data: an invoice passes through several systems and is archived for years, so it must never expose a usable card number. The validator reports BT-87 whenever the value is longer than 10 characters, even if the middle digits are masked with asterisks. The message appears when an ERP or payment provider exports the full or masked card number.

Solution

Fill cac:CardAccount/cbc:PrimaryAccountNumberID (CII: ram:ApplicableTradeSettlementFinancialCard/ram:ID) with at most 10 characters, preferably only the last 4 digits of the card and no masking characters. The Schematron warns on any value longer than 10 characters, including a masked 16-character number.

Quick actions

Validate XML Convert invoice

Valid Examples

BT-87 = 1881 (last 4 digits only)

Invalid Examples

BT-87 = 4012888888881881 (full PAN exposed)
BT-87 = 401288******1881 (masked, but 16 characters is still longer than 10)

Code Examples

Valid XML

<cac:PaymentMeans>
  <cbc:PaymentMeansCode>48</cbc:PaymentMeansCode>
  <cac:CardAccount>
    <cbc:PrimaryAccountNumberID>1881</cbc:PrimaryAccountNumberID>
    <cbc:NetworkID>VISA</cbc:NetworkID>
  </cac:CardAccount>
</cac:PaymentMeans>

Invalid XML

<cac:PaymentMeans>
  <cbc:PaymentMeansCode>48</cbc:PaymentMeansCode>
  <cac:CardAccount>
    <cbc:PrimaryAccountNumberID>401288******1881</cbc:PrimaryAccountNumberID>
    <cbc:NetworkID>VISA</cbc:NetworkID>
  </cac:CardAccount>
</cac:PaymentMeans>

Affected Fields

BT-87 Payment card primary account number

Validation Tools

Official KoSIT Validator

Run the official KoSIT validator with the XRechnung configuration to check EN 16931 and XRechnung rules.

Convert PDF to XRechnung

Find validation errors during conversion and review each correction.