{
  "id": "BR-51",
  "country": "EU",
  "syntax": "ubl",
  "group": "document",
  "severity": "warning",
  "severity_note": "warning, from the Flag column of the Peppol BIS Billing 3.0 UBL rules index retrieved 2026-10-18.",
  "spec": "Peppol BIS Billing 3.0, May 2026 release, EN 16931 model bound to UBL",
  "statement": "In accordance with card payments security standards an invoice should never include a full card primary account number (BT-87). At the moment PCI Security Standards Council has defined that the first 6 digits and last 4 digits are the maximum number of digits to be shown.",
  "statement_lang": "en",
  "context": "cac:PaymentMeans/cac:CardAccount/cbc:PrimaryAccountNumberID",
  "test": "string-length(normalize-space(.))<=10",
  "meaning": "A card primary account number (BT-87) should never be a full number. The message says \"should never\", not \"shall\", and it lowercases \"an invoice\". It names BT-87 and ends with a period. The flag is warning. The context is the card account primary account number. The published test checks that the normalized string length is at most 10. The comparison is <=10 with no space before or after <=. It does not check which digits are present.",
  "fix": "Keep the card primary account number (BT-87) to at most 10 characters.",
  "example_fail": "The card primary account number is longer than 10 characters.",
  "example_pass": "That number is at most 10 characters.",
  "example_note": "Illustration of the condition in the official statement. Not an example published by the source.",
  "source_url": "https://docs.peppol.eu/poacc/billing/3.0/rules/ubl-tc434/BR-51/",
  "source_retrieved": "2026-10-18",
  "last_verified": "2026-10-18"
}