Counterfoil rule note
Quoted from a public specification. This page is not a validator, and it is not tax, legal, or accounting advice.
In accordance with card payments security standards an invoice should never include a full card primary account number (BT-87). At the moment PCI Security Standards Council has defined that the first 6 digits and last 4 digits are the maximum number of digits to be shown.
Source: https://docs.peppol.eu/poacc/billing/3.0/rules/ubl-tc434/BR-51/
Peppol BIS Billing 3.0, May 2026 release, EN 16931 model bound to UBL
Severity note: warning, from the Flag column of the Peppol BIS Billing 3.0 UBL rules index retrieved 2026-10-18.
A card primary account number (BT-87) should never be a full number. The message says "should never", not "shall", and it lowercases "an invoice". It names BT-87 and ends with a period. The flag is warning. The context is the card account primary account number. The published test checks that the normalized string length is at most 10. The comparison is <=10 with no space before or after <=. It does not check which digits are present.
Keep the card primary account number (BT-87) to at most 10 characters.
Illustration of the condition in the official statement. Not an example published by the source.
Fails the stated condition. The card primary account number is longer than 10 characters.
Passes the stated condition. That number is at most 10 characters.
Copied from the source. Not reimplemented on this page.
cac:PaymentMeans/cac:CardAccount/cbc:PrimaryAccountNumberID
string-length(normalize-space(.))<=10
All rule notes · JSON · Markdown · llms.txt · Invoice page · Privacy