BR-51

In accordance with card payments security standards an invoice should never include a full card primary account number (BT-87). At the moment PCI Security Standards Council has defined that the first 6 digits and last 4 digits are the maximum number of digits to be shown.

Official rule text

[BR-51]-In accordance with card payments security standards an invoice should never include a full card primary account number (BT-87). At the moment PCI Security Standards Council has defined that the first 6 digits and last 4 digits are the maximum number of digits to be shown.

[BR-51]-In accordance with card payments security standards an invoice should never include a full card primary account number (BT-97). At the moment PCI Security Standards Council has defined that the first 6 digits and last 4 digits are the maximum number of digits to be shown.

Where the rule applies

Fatal and error findings make the invoice invalid (valid: false); warnings and information do not.

Business terms concerned (EN 16931)

• BT-87
• BT-97

Technical check

Syntax

UBL · French rules BR-FR, EXTENDED-CTC-FR (1.4.0.04), HR-CIUS (eRačun) (1.0.4), Peppol BIS Billing 3.0 (3.0-2026.5), XRechnung with the CEN EN 16931 rules (3.0.2)

Context

cac:PaymentMeans/cac:CardAccount/cbc:PrimaryAccountNumberID

Test (must be true)

string-length(normalize-space(.))<=10

Syntax

CII · CIUS-RO (1.0.9), French rules BR-FR, EXTENDED-CTC-FR (1.4.0.04), XRechnung with the CEN EN 16931 rules (3.0.2), ZUGFeRD / Factur-X (2.5.2)

Context

//ram:ApplicableTradeSettlementFinancialCard

Test (must be true)

string-length(normalize-space(ram:ID)) <= 10

Syntax

UBL · CIUS-RO (1.0.9)

Context

cac:PaymentMeans/cac:CardAccount

Test (must be true)

string-length(cbc:PrimaryAccountNumberID)<=10

How the API reports this rule

Every finding of POST /v1/validate carries the rule id, severity, message, location (XPath) and rule set, and links this page (docUrl):

{
  "severity": "fatal",
  "ruleId": "BR-51",
  "message": "[BR-51]-In accordance with card payments security standards an invoice should never include a full card primary account number (BT-87). At the moment PCI Security Standards Council has defined that the first 6 digits and last 4 digits are the maximum number of digits to be shown.",
  "xpath": "/…",
  "source": "schematron:xrechnung@3.0.2",
  "docUrl": "https://einvoice-api.eu/rules/br-51.html"
}

Rule text and severity are taken unchanged from the official rule set; this page is generated from the API's configuration. Not legal advice.