BR-51

A full card primary account number must never appear in an invoice. Only the last digits may be transmitted, the rest masked — this is what the card payment security standards require.

Severity: Error
Applies to: CII, UBL
Rule set: v2026-01-31

Official rule text

In accordance with card payments security standards an invoice should never include a full card primary account number (BT-97). At the moment PCI Security Standards Council has defined that the first 6 digits and last 4 digits are the maximum number of digits to be shown.

Why does BR-51 happen?

The payment system holds the number in full and the mapping copies it across unchanged, because the target field has exactly that name. A number then travels into a document that is emailed and archived for years.

How do you fix BR-51?

Mask before writing and transmit at most the trailing digits in cac:PaymentMeans/cac:CardAccount/cbc:PrimaryAccountNumberID in UBL, ram:ApplicableTradeSettlementFinancialCard/ram:ID in CII. The masking belongs in the generation, not in a later clean-up.

In the XML

A UBL fragment. The CII path is named above — same change, different element names.

Fails

<cac:CardAccount>
  <cbc:PrimaryAccountNumberID>4111111111111111</cbc:PrimaryAccountNumberID>
  <cbc:NetworkID>NA</cbc:NetworkID>
</cac:CardAccount>

Fixed

<cac:CardAccount>
  <cbc:PrimaryAccountNumberID>************1111</cbc:PrimaryAccountNumberID>
  <cbc:NetworkID>NA</cbc:NetworkID>
</cac:CardAccount>

NormAPI provides technical validation, not tax or legal advice.