TSE — Technical Security Device¶

Since January 1, 2020, every electronic cash register in Germany is legally required to use a Technical Security Device (TSE). DiKAS works with certified TSEs and automatically signs all fiscally relevant transactions (§ 146a AO, KassenSichV).

Not tax advice

The notes on deadlines, obligations, and taxes on this page are guidance only and do not replace professional tax advice. Please clarify legal details with your tax advisor or the tax office.

What Is a TSE?¶

A TSE is a certified security module (hardware or cloud service) that digitally signs every register transaction. This allows the tax authority to verify whether register data has been altered after the fact. The legal basis is the Kassensicherungsverordnung (KassenSichV) based on § 146a of the Abgabenordnung (AO).

In short: The TSE is your digital notary for every checkout transaction.

What Is Signed?¶

DiKAS signs not only receipts but all fiscally relevant transactions:

Transaction	What happens?
Receipts	Every payment (cash, card, voucher, customer credit)
Orders	Every order in table service
Voids	Every void of a receipt
End-of-day reports	Every Z-report
Expenses	Every cash withdrawal from the register
Shift changes	Every shift opening and closing

Important: Signing happens fully automatically in the background. You do not need to do anything extra when checking out.

Setting Up the TSE¶

Step 1: Connect TSE Hardware¶

Insert the TSE (e.g., Swissbit USB stick) into a free USB port on the register server.

Step 2: Configure TSE in DiKAS¶

Open Admin → Settings → TSE
Click “Activate TSE now”. No additional confirmation is required.
Wait for the success message. DiKAS detects whether the TSE is new or already belongs to this installation, sets it up if necessary, and only enables it after successful completion.

ℹ️ There is no separate TSE type selector and no manual register serial-number field. For an unknown, already configured TSE, DiKAS makes no login attempt and asks only for the credentials of the previous system. Saving changed credentials starts exactly one attempt.

Hardware TSE (Swissbit)¶

The simplest option: A USB stick on the server.

Suitable for single registers or small businesses
No internet connection required
Cost: approx. 250–300 EUR one-time

TSE Proxy (Network)¶

For businesses with multiple registers:

A central TSE proxy server serves all registers in the network
Enter the proxy URL under TSE Server
Suitable for multi-location businesses and large hospitality operations

TSE Data on the Receipt¶

Every receipt automatically contains the TSE information:

══════════════════════════════════
  RECEIPT No. 20260313-0042
──────────────────────────────────
  2x Schnitzel          25.80
  1x Cola                3.50
──────────────────────────────────
  TOTAL                 29.30 EUR
  Cash                  30.00
  Change                 0.70
══════════════════════════════════
  TSE Information:
  Signature:   a8f3c2d1e5b7...
  Trans. No:   12345
  Sign. Cnt:   67890
  Start:       2026-03-13T18:30:00
  End:         2026-03-13T18:30:01
  Serial No:   ABCDEF1234567890

  [QR Code]
══════════════════════════════════

The QR code contains all TSE data in a standardized format (DSFinV-K). The tax authority can scan this QR code and immediately verify the authenticity of the receipt.

Checking TSE Status¶

You can view the current status of your TSE under Admin → Settings → TSE:

Display	Meaning
Available (green)	TSE is active and signing all transactions
Not available (red)	TSE is not reachable — see "TSE Failure"
Certificate valid until	Expiration date of the TSE certificate
Signatures used	Number of used / maximum signatures
Serial number	Unique identifier of your TSE

Tip: Regularly check whether the TSE has enough free signatures. For hardware TSEs, the number is limited (typically: 20 million). DiKAS shows you the current count.

TSE Login Locked or Credentials Unknown¶

If DiKAS cannot log in to the TSE, Admin → Settings → TSE shows one of two notices (the labels on this screen are in German):

Login locked: a highlighted block headed "Anmeldung an der TSE gesperrt" (TSE login locked). It lists the serial number, the remaining attempts (if the TSE reports them), the remaining PUK lock time and the line "Automatische Versuche: gestoppt" (automatic attempts: stopped).
Credentials unknown: a warning that the TSE has already been set up by another POS system, followed by the section "TSE aus anderem Kassensystem übernehmen" (take over a TSE from another POS system).

In both cases DiKAS makes no further attempt on its own. The system never guesses; every further attempt is a deliberate action.

Credentials unknown — enter the data of the previous system. DiKAS has detected a TSE that is already set up but cannot yet be assigned safely to this installation. The device is not logged in and no attempt is used up. The page now only shows an explanation and the input fields for the Admin PIN, Admin PUK and Time Admin PIN of the previous POS system. Tick the box "Ich habe die Werte geprüft …" (I have checked the values) and click "TSE übernehmen" (take over TSE). Only when you save changed data in this way does DiKAS start exactly one attempt automatically. If it succeeds, DiKAS takes over the TSE and switches its credentials to DiKAS for ongoing operation. See also Switching systems.

If the data entered is wrong, DiKAS stops immediately. Clicking again, reloading the page or a background service will not repeat the attempt. Check the documents of your previous provider and only then save corrected data; only an actual change starts another single attempt.

Login locked — unlock with the PUK. After too many wrong PIN attempts the TSE locks the login. Under "TSE mit der PUK entsperren" (unlock TSE with the PUK) you enter the Admin PUK; each click is one attempt, and you confirm twice beforehand that you are aware of the risk.

Three wrong PUK attempts make the TSE permanently unusable

All fiscal data on it would then be lost for audits. There is no trial run. If in doubt, do not click — ask your previous provider for the PUK or call DiKAS support. A rejected call for which the TSE did not count an attempt at all is reported as such — the screen never claims a counter the device has not reported.

Leave the box "Danach wieder auf die hinterlegte Admin-PIN zurücksetzen" (then reset to the stored Admin PIN) ticked: nothing changes at the till, and you do not need to remember a new PIN. The TSE requires a different PIN when unlocking — DiKAS therefore briefly sets an interim PIN it generates itself and immediately restores the stored one. The PUK is used only once. If the very last step fails, the screen shows the interim PIN once in plain text and saves it in the settings — the TSE is then unlocked and reachable; do not start a second unlock attempt.

Type PIN and PUK by hand

Values copied from a PDF or an e-mail often contain a typographic quotation mark or an invisible character. DiKAS rejects such input before the TSE is touched — type the values in by hand instead.

TSE Failure — What to Do?¶

If the TSE fails (defect, network problem, USB connection):

Operations continue — DiKAS does not block checkout
Automatic documentation — DiKAS automatically logs every failure (start time, duration, reason)
Recovery — As soon as the TSE is reachable again, the failure logs are closed
Tax authority — The failure documentation is retained for potential audits

Important: You are obligated to resolve a TSE failure promptly. DiKAS handles the documentation for you, but you should eliminate the cause (loose USB stick, network, defect) as soon as possible.

Exporting Data for Tax Audits¶

For a tax audit by the tax authority, you can export all data:

DSFinV-K Export¶

Admin → Settings → Export → DSFinV-K
Select time period
Click "Create export"
You receive a ZIP file with all required CSV files

TSE Data Export (TAR)¶

Admin → Settings → TSE
Click "TSE export" (optionally with date filter)
The TSE provides a TAR file with all signed transactions

GDPdU Export¶

Admin → Settings → Export → GDPdU
Select time period
"Create export"

Tip: Create regular backups of your TSE data, especially before a TSE replacement.

Frequently Asked Questions¶

Do I need a TSE? Yes, mandatory in Germany since 01.01.2020 for all electronic POS systems.

Which TSE does DiKAS support? Hardware TSE (Swissbit USB) and network-based TSE proxies.

How much does a TSE cost? Hardware TSE: approx. 250–300 EUR one-time.

Can I operate without a TSE? Technically yes — DiKAS does not block operations. Legally, however, you are obligated to operate a functioning TSE. Without a TSE, fines may be imposed.

What happens if the TSE is defective? DiKAS documents the failure automatically. Replace the TSE as quickly as possible. The failure logs serve as evidence for the tax authority.

Can the tax authority audit my data? Yes. Via the export functions (DSFinV-K, GDPdU, TSE TAR), you provide all data in the required formats.

Do I need to register the register serial number with the tax authority? Yes, since 01.01.2025 the reporting obligation under § 146a (4) AO applies. The report is submitted electronically via Mein ELSTER — step by step: Registering your POS with the tax office.

Next Step¶

→ End-of-Day Report — Create Z-report → DATEV Export — Data for the tax advisor