Skip to content

TSE.md

Latest commit

 

History

History
194 lines (155 loc) · 6.53 KB

TSE.md

File metadata and controls

194 lines (155 loc) · 6.53 KB
Raw

KassenSichV Compliance Analysis for Fursuit Registration Tool

This document analyzes the current state of KassenSichV (German cash register security regulation) compliance for our Laravel 12 fursuit registration tool project.

Overview

The project uses Fiskaly cloud TSE integration for transaction signing and generates digital receipts. We have a solid foundation but are missing critical export functionality required by German tax law.

✅ Currently Implemented (Good Coverage)

1. Cloud TSE Integration with Fiskaly

  • ✅ Proper Fiskaly API integration (FiskalyService.php)
  • ✅ TSE client management with state tracking
  • ✅ Transaction signing via Fiskaly cloud TSE
  • ✅ QR code generation for receipts with Fiskaly data

2. Receipt Generation (Belegausgabepflicht)

  • ✅ Digital receipt generation as PDF
  • ✅ Email delivery of receipts
  • ✅ Proper receipt structure with required fields:
    • Company information (Eurofurence e.V.)
    • VAT ID (USt-IdNr-ID: DE219481694)
    • Receipt number format (FSB-{year}-{id})
    • Date and cashier information
    • Itemized positions with VAT
    • Payment method details
    • QR code with TSE signature data

3. TSE Infrastructure

  • ✅ Machine-to-TSE client mapping
  • ✅ Transaction state management
  • ✅ Fiskaly cloud TSE configuration
  • ✅ Admin authentication for TSE operations

❌ Missing Critical Components

1. DSFinV-K Export (CRITICAL)

Status: NOT IMPLEMENTED
Priority: URGENT - Required by law

We're missing the most important compliance requirement - the DSFinV-K export functionality. This is the standardized data export format that German tax authorities use to audit transactions.

2. Required Receipt Fields

Our receipts are missing several mandatory KassenSichV fields:

  • ❌ TSE serial number
  • ❌ Transaction signature counter
  • ❌ Start/end signature values
  • ❌ TSE timestamp
  • ❌ Transaction number from TSE

3. Tax Authority Export Interface

  • ❌ No standardized export functionality for Finanzamt
  • ❌ Missing GoBD-compliant data retention
  • ❌ No audit trail export capability

4. Receipt Compliance Details

Our current receipt template needs these additional fields:

<!-- Missing TSE Information Section -->
<div style="text-align:center; padding-top:5mm;">
    <div>============= TSE DATEN =============</div>
</div>
<table width="100%">
    <tr><td>TSE-Seriennummer:</td><td>{{ $tse_serial }}</td></tr>
    <tr><td>Transaktions-Nr.:</td><td>{{ $transaction_number }}</td></tr>
    <tr><td>Signaturzähler:</td><td>{{ $signature_counter }}</td></tr>
    <tr><td>Start-Signatur:</td><td>{{ $start_signature }}</td></tr>
    <tr><td>End-Signatur:</td><td>{{ $end_signature }}</td></tr>
    <tr><td>TSE-Zeitstempel:</td><td>{{ $tse_timestamp }}</td></tr>
</table>

🚨 Immediate Action Required

1. Update Receipt Template (Quick Fix)

Modify /resources/views/receipts/sale.blade.php to include missing TSE fields from Fiskaly response data.

2. Implement DSFinV-K Export (High Priority)

Create a new service class:

namespace App\Domain\Checkout\Services;

class DSFinVKExportService 
{
    public function generateExport($dateFrom, $dateTo)
    {
        // Export all transactions in DSFinV-K format
        // Required tables: transactions_v1, business_cases_v1, etc.
    }
}

3. Add Missing Database Fields

Add to checkout migration:

$table->string('tse_transaction_number')->nullable();
$table->string('tse_signature_counter')->nullable(); 
$table->text('tse_start_signature')->nullable();
$table->text('tse_end_signature')->nullable();
$table->timestamp('tse_timestamp')->nullable();

4. Enhanced Fiskaly Integration

Update FiskalyService.php to extract and store additional TSE data:

public function updateOrCreateTransaction(Checkout $checkout)
{
    $response = $this->request()->put(/* ... */)->throw();
    
    $fiskalyData = $response->json();
    $checkout->fiskaly_data = $fiskalyData;
    
    // Extract required TSE fields
    $checkout->tse_transaction_number = $fiskalyData['number'] ?? null;
    $checkout->tse_signature_counter = $fiskalyData['signature']['counter'] ?? null;
    $checkout->tse_start_signature = $fiskalyData['signature']['value'] ?? null;
    $checkout->tse_timestamp = $fiskalyData['time_start'] ?? null;
    
    $checkout->save();
}

Compliance Status

Current Compliance: ~70% ⚠️
- TSE Integration: ✅ Complete
- Receipt Generation: ✅ 80% (missing TSE fields)
- Data Export: ❌ 0% (Critical gap)
- Audit Trail: ❌ 0% (Critical gap)

Key Files Analyzed

  • app/Domain/Checkout/Services/FiskalyService.php - TSE integration
  • app/Domain/Checkout/Models/Checkout/Checkout.php - Transaction model
  • resources/views/receipts/sale.blade.php - Receipt template
  • app/Jobs/CreateReceiptFromCheckoutJob.php - Receipt generation
  • database/migrations/2024_09_14_200636_create_tse_clients_table.php - TSE client structure

Recommendations

Immediate (Within 1 week)

  1. Update receipt template with missing TSE fields
  2. Enhance Fiskaly service to capture all required TSE data
  3. Add database fields for TSE compliance data

Short-term (Within 2 weeks)

  1. Implement DSFinV-K export functionality
  2. Add audit trail logging
  3. Create tax authority export interface

Medium-term (Within 1 month)

  1. Add comprehensive data validation
  2. Implement backup/restore for TSE data
  3. Create compliance testing suite

Ongoing

  1. Test with actual tax authority export requirements
  2. Monitor Fiskaly API changes
  3. Stay updated on KassenSichV regulation changes

Legal Context

Based on the KassenSichV regulation:

  • Mandatory since September 30, 2020 for all cash register systems
  • DSFinV-K export is legally required for tax audits
  • Receipt compliance with TSE data is mandatory
  • Cloud TSE (like Fiskaly) requires internet connectivity but we handle offline scenarios
  • Data retention must be available for tax authority export at any time

Risk Assessment

High Risk: Missing DSFinV-K export could result in:

  • Tax audit failures
  • Potential fines
  • Business operation restrictions

Medium Risk: Incomplete receipt data could result in:

  • Receipt validity questions
  • Customer complaints
  • Compliance warnings

Low Risk: Current TSE integration is solid and meets core signing requirements.

Next Steps

  1. Prioritize DSFinV-K export implementation
  2. Complete receipt template compliance
  3. Test full compliance workflow
  4. Document all compliance procedures
  5. Create staff training materials