Card Receipts, Cash Drawers and PIN Pads: The Rules

What the receipt must actually show

Visa's Table 5-33 sets the required content for every transaction receipt: the payment credential, an authorisation code for transactions the issuer authorised, the card network name (it must contain "Visa"), a description of the goods or services, the merchant name used to identify itself to customers, the city and state or province of the merchant outlet, return and refund policies as required by the disclosure rule, the transaction amount with a currency symbol where the transaction currency is not local, the transaction date, and the transaction type — one of ATM Cash Disbursement, Cash-Back with no purchase, Credit, Manual Cash Disbursement, Load Transaction or Purchase. Two of those trip up small merchants regularly. The description of the purchase comes from your item catalogue, so a POS full of "Misc $12.00" buttons produces receipts that fail the requirement and dispute responses that fail with them. And the merchant name on the receipt is the name customers know you by, which should also be the name that reaches their statement.

Truncation: two rules, and the stricter one wins

US federal law is the floor. 15 U.S.C. 1681c(g) says no person accepting credit or debit cards "shall print more than the last 5 digits of the card number or the expiration date upon any receipt", and it applies only to receipts that are electronically printed at the point of sale — there is an express exception where the sole means of recording the account number is handwriting, an imprint or a copy of the card. Visa's rule is tighter: on the cardholder's copy, the payment credential "except for the final 4 digits, must be disguised or suppressed". Configure to four digits and you satisfy both. Visa also prohibits a receipt from carrying more information than is embossed or printed on the card, which is why a receipt should never show an expiry date or a security code.

The merchant and terminal ID rule with a 2027 date on it

This one is easy to miss because it arrives in two stages. Visa prohibits the cardholder's copy from carrying the full card acceptor identification number, full merchant identification number or full terminal identification number. It already applies to POS acceptance devices and payment gateways deployed on or after 15 October 2022, and effective 16 October 2027 it applies to all POS acceptance devices and payment gateways. There is a carve-out where the device or gateway connects to a processor host using PCI-validated point-to-point encryption or cryptographic keys for all host connectivity, and the acquirer may display the last 4 digits on the cardholder's copy while showing all digits on the merchant's copy. If you are buying a printer or terminal now, it is a fair question to put to the vendor: does the cardholder receipt template already comply, or does it become a change you have to chase in 2027?

Paper, email and text

Visa's delivery rule is the opposite of the usual assumption. For most transactions the merchant must offer a paper transaction receipt unless the cardholder agrees to an electronic one; only e-commerce, mail and phone order, and contactless-only acceptance devices may choose to offer one format alone, and that exception does not extend to a contactless-only device used for donations. If you do deliver electronically, the rules are specific: any link must be a direct link to the receipt, the receipt must stay available to the cardholder for at least 120 calendar days after the processing date, the email or message title must carry both the merchant name as it will appear in the clearing record and on the cardholder's statement and wording indicating it contains the receipt, and the receipt must be in a static format that cannot easily be manipulated afterwards. The clause worth reading twice: the merchant must not store or use the personal information the cardholder provided to enable receipt delivery for any other purpose without the cardholder's express consent. An email address collected to send a receipt is not, by itself, a marketing list.

What the cash drawer is allowed to do

Handing cash across the counter on a card sale is regulated, not discretionary. Visa's core rule says a merchant must not provide cash to a cardholder unless it is providing cash-back or cash-out, or selling foreign currency, and a prepaid card must not be redeemed for cash by a merchant that accepts it. Where cash-back is offered in the US, Table 5-15 and the general cash-back requirements apply together: it is allowed with or without a purchase, capped at USD 200, limited to debit and prepaid cards, and it must be authorised online, completed as a retail transaction in a face-to-face environment, and contain a PIN — in the US region specifically, a PIN. The cash-back portion of the amount must be uniquely identified, the transaction must be processed in the merchant's local currency, and no credit refund or credit transaction receipt may be processed for the cash-back component. All acquirers, issuers and merchants must participate in the Partial Authorization Service, and a partially approved amount must not be applied to the cash-back portion. Merchants may set a lower cash-back limit than USD 200 at their discretion, and many do.

PIN pads and the approved-device list

If the counter takes PINs, the hardware is in scope for the PCI PTS Point of Interaction standard, which sets "security requirements for the characteristics and management of devices used to protect cardholder PINs, account data, and other sensitive payment card data at the point of interaction". The standard covers PIN entry devices and unattended payment terminals, non-PIN acceptance devices evaluated for account data protection, encrypting PIN pads meant for integration into equipment such as ATMs, secure card readers as POS terminal components, and secure card reader-PINs intended for use with commercial off-the-shelf devices such as a phone or tablet. PCI SSC's guidance to merchants and their acquirers is to use the council's listing when selecting approved PTS POI devices. That is the check to run before buying a PIN pad from a marketplace listing, and it is the check to run again before redeploying an old one.

The choices that are still just preference

Plenty of peripheral decisions carry no rule at all, and it is worth being clear which ones. Thermal printers avoid ink costs. Wired ethernet or USB on a fixed counter avoids Bluetooth pairing failures during a queue. Kitchens choose between a heat-tolerant printer and a display screen on grounds of volume and durability. Grocery and delis add scales. Buy business-grade rather than consumer hardware for anything running a retail duty cycle. None of that is compliance, and no vendor should present it as such. Illustrative example, made-up round numbers: a shop comparing two printers at $200 and $400 should weigh the difference against the cost of a counter standing idle, not against a rate on a processing quote.