RKSV (Austrian Cash Register Security Regulation)
The RKSV (Registrierkassensicherheitsverordnung) is the Austrian regulation that protects cash registers against retroactive manipulation – every cash sale is cryptographically signed, chained and recorded immutably in the data collection log.
The RKSV (Registrierkassensicherheitsverordnung, Cash Register Security Regulation) is an Austrian regulation issued by the Federal Ministry of Finance that prescribes how cash registers must be technically secured against retroactive manipulation. It gives concrete form to the statutory cash register and receipt obligation under the Federal Fiscal Code (§ 131b BAO) and requires that every single cash sale be cryptographically signed via a security device, chained to the previous sale and recorded without gaps in a data collection log.
The goal is tamper resistance: once a sale has been recorded, it should be impossible to delete or alter it unnoticed. The RKSV has applied since 1 January 2016, and the technical security device has been mandatory since 1 April 2017. In principle it affects businesses that exceed a certain turnover and cash-turnover threshold. The term is therefore a purely Austrian compliance topic and the counterpart to the German Cash Register Security Ordinance (KassenSichV) with its technical security device (TSE).
At a glance
- Austrian regulation by the Ministry of Finance, giving concrete form to § 131b BAO (cash register obligation)
- In force since 2016; the technical security device has been mandatory since 1 April 2017
- Every cash sale is signed, chained and stored in the data collection log (DEP)
- Mandatory from €15,000 annual turnover and more than €7,500 in cash turnover per year
- Start, monthly and annual receipts plus registration via FinanzOnline are mandatory
How does the RKSV (Cash Register Security Regulation) work?
At the heart of the RKSV is a technical security device connected to the cash register. It adds an electronic signature or seal to every cash sale and chains the sales into a closed chain. Because the signature value of the previous receipt flows into the signature of each receipt, any retroactive deletion or alteration of a sale would mathematically break the chain and thus be immediately noticeable.
Signature or seal creation unit
The signature is generated by a signature or seal creation unit – for example a smart card, a hardware security module (HSM) or a cloud signature solution from an approved trust service provider. Each register thus receives a unique certificate. If the security device fails, the outage must be documented and the affected sales may be signed and recorded afterwards; longer outages must be reported via FinanzOnline.
Data collection log (DEP) and QR code
All cash sales are stored continuously in the data collection log (DEP) – the audit-proof collection of all signed sales. Each receipt carries a machine-readable code (usually a QR code) containing the signature value and the chaining information. This lets the tax authority – or the free BMF receipt-check app – verify the validity of the signature and the completeness of the chain at any time. The DEP must be exportable and available throughout the retention period.
Who is subject to the cash register obligation?
The cash register obligation – and thus the RKSV – applies when a business generates an annual turnover of more than €15,000 and its cash turnover exceeds €7,500 per year. Cash turnover here counts not only cash payments but also on-site payments by debit or credit card, vouchers or similar instruments. Once the thresholds are exceeded, a tamper-proof cash register must be operated from the start of the fourth following month.
In addition, the receipt-issuing obligation applies: a receipt must be issued to the customer for every cash sale. Conversely, the customer has a receipt-acceptance obligation – they must take the receipt and carry it until they leave the business premises. There are exceptions and simplifications for certain cases such as open-air "cold-hands" sales, vending machines or small club events. The exact classification in individual cases should be clarified with a tax advisor.
Start, monthly and annual receipts
The RKSV prescribes a fixed cycle of control receipts used to prove that the register is functioning. The start receipt is created immediately after the security device is put into operation and is verified with the BMF receipt-check app. It documents that the register was properly initialised and registered via FinanzOnline.
At the end of each month, a monthly receipt must be generated – a zero receipt with an amount of zero that records the monthly counter. The December monthly receipt is at the same time the annual receipt: it must be verified with the receipt-check app by 15 February of the following year at the latest. This recurring check ensures that the signature chain has remained intact throughout the year.
Why the RKSV matters
The RKSV is intended to prevent turnover suppression in the cash sphere and to ensure fair competition. Without technical safeguards, sales in simple register systems could be deleted retroactively without a trace; the signature and chaining make exactly that practically impossible. This gives tax audits a robust, audit-proof dataset that makes every cash sale traceable.
Violations are no trivial matter: anyone who fails to operate a tamper-proof cash register despite being obliged to, does not issue receipts or circumvents the security device risks tax penalties and – if the records are not in proper order – estimated assessments by the tax authority. A functioning, correctly registered register is therefore not only an obligation but also protects the business from evidentiary problems in the event of an audit.
RKSV in the ERP and POS system
Technically, the RKSV is implemented in the point-of-sale (POS) system, which drives the security device and maintains the data collection log. In practice, however, the register is rarely isolated: it is often connected to an ERP or inventory management system that supplies the item master, prices and stock levels and receives the signed sales back. It is important that the RKSV-relevant data – signed receipts, DEP, certificate information – are transferred to accounting unchanged and in full.
For operations, this means the interplay of register, ERP and financial accounting must preserve the chaining and ensure retention. Under Austrian tax law the DEP is subject to a seven-year retention obligation and must remain machine-readable throughout this period. Whether a specific solution meets the RKSV depends on the POS software used, the security device and correct registration – systems commonly used in the DACH region are linked under "Related systems", but they do not replace an assessment of the individual case.
Distinction: RKSV vs. the German KassenSichV/TSE
The RKSV and the German Cash Register Security Ordinance (KassenSichV) pursue the same goal – tamper-proof cash records – but differ in their technical approach. Austria relies on signature-based chaining of individual sales with a QR code on the receipt. Since 2020 Germany has required a certified technical security device (TSE) that secures every transaction with a transaction counter, signature counter and time stamp; the check value likewise appears on the receipt.
Both regulations are DACH-specific and not identical: a TSE certified for Germany does not automatically meet the Austrian RKSV requirements and vice versa. Anyone operating registers across borders must implement the requirements of both countries separately. Switzerland, by contrast, has no comparable statutory cash register obligation. For Germany, the term KassenSichV/TSE is the direct counterpart and is explained separately in the glossary.
Example
Example: hospitality business in Austria with a connected register
A Viennese restaurant with around €400,000 in annual turnover operates a cash register connected to a cloud signature solution. For every order, the register creates a receipt that is signed via the security device and chained to the previous sale; a QR code appears on the receipt. All sales flow continuously into the data collection log.
When it was put into operation, a start receipt was created and verified with the BMF receipt-check app, and the register is registered via FinanzOnline. At the end of the month, staff automatically generate a zero receipt as the monthly receipt; the December receipt serves as the annual receipt and is verified by 15 February. Via the ERP connection, the signed daily sales flow into financial accounting – in an audit, every cash sale can be traced back seamlessly to the signature chain.
Frequently asked questions
Related services
Sources
Questions about RKSV (Austrian Cash Register Security Regulation) in your ERP project?
We advise vendor-neutrally – and implement it ourselves on request.