BR-51: In accordance with card payments security standards an invoice should never include a…
Peppol BIS Billing 3.0.20 · UBL
Original rule text
[BR-51]-In accordance with card payments security standards an invoice should never include a full card primary account number (BT-87). At the moment PCI Security Standards Council has defined that the first 6 digits and last 4 digits are the maximum number of digits to be shown.
string-length(normalize-space(.))<=10BR-51 is a warning rule in the business layer of Peppol BIS Billing 3.0.20 · UBL. An invoice that breaks it is flagged but not rejected. It refers to BT-87.
What this rule requires
This warning rule checks cac:PaymentMeans/cac:CardAccount/cbc:PrimaryAccountNumberID (BT-87). The test requires that after ignoring leading and trailing whitespace, the value length is at most 10 characters. The message recommends showing at most the first 6 and last 4 digits of the card number, but the test only enforces the total length limit and does not verify that the value actually consists of those specific digits. A document with a value longer than 10 characters would be reported, not rejected.
How to fix
Set cbc:PrimaryAccountNumberID to a truncated card number of at most 10 characters, normally the first six and last four digits of the actual card number. If the value is longer than 10 characters, reduce it to that maximum. Since this is a warning, the document is not rejected, but the validator recommends the truncated format.
Guidance on this rule. The original text above is authoritative.
Where to go next
No published Peppol BIS Billing UBL release comparison lists a change to BR-51.
Validate an invoice against these rules · All release changes