errorEN 16931

BR-51:Payment card primary account number not masked

The invoice contains a full credit card number (BT-87), which violates PCI security standards. Only the first 6 and last 4 digits should be shown.

Severity
Fatal
Rule set
EN 16931
Country
All EU
Fix type
AUTO-FIX

Engine Classification

Auto-fix: Mask the card number to show only first 6 and last 4 digits (e.g., 411111******1111). This is the PCI-compliant format for displaying card numbers.

What is BR-51?

BR-51 is a fatal validation rule defined in the EN 16931 specification. It validates the PrimaryAccountNumberID element under CardAccount in the UBL invoice XML.

When this rule fires, the invoice is non-compliant and will be rejected by Peppol access points and national validation services. The sending system receives a rejection response and the invoice does not reach the buyer.

Target path: //cac:PaymentMeans/cac:CardAccount/cbc:PrimaryAccountNumberID

Why This Error Matters

Security violation. Full card numbers must never be stored or transmitted in invoices per PCI-DSS requirements.

BR-51 is a hard failure. Invoices that trigger this rule are rejected at the access point and never reach the recipient. In Peppol networks, this means your sending system receives an MLR (Message Level Response) with a rejection status. The invoice must be corrected and re-sent, adding delay to your payment cycle.

Invoice Navigator can automatically correct this error in your pipeline. The fix is applied with full audit evidence, so your compliance trail remains intact.

Validator Behavior

  • ·Causes invoice rejection
  • ·Error returned: BR-51
  • ·Specification: EN 16931

How to Fix It

1.

Find card number

Locate cbc:PrimaryAccountNumberID in cac:CardAccount under PaymentMeans

2.

Mask middle digits

Replace middle digits with asterisks: 411111******1111

3.

Verify format

Result should show max 6 leading + 4 trailing digits visible

Before / After

Failing XML
<cac:PaymentMandate>
  <cbc:ID><!-- invalid or missing value --></cbc:ID>
</cac:PaymentMandate>
Corrected XML
<cac:PaymentMandate>
  <cbc:ID>correct-value</cbc:ID>
</cac:PaymentMandate>

Technical Reference

XPath//cac:PaymentMeans/cac:CardAccount/cbc:PrimaryAccountNumberID
SpecEN 16931
Operationnormalize
StrategyAuto-fix: Mask the card number to show only first 6 and last 4 digits (e.g., 411111******1111). This is the PCI-compliant format for displaying card numbers.

Code Example

<cac:Price>
  <cbc:PriceAmount currencyID="EUR">50.00</cbc:PriceAmount>
  <cbc:BaseQuantity unitCode="C62">10</cbc:BaseQuantity>
  <!-- Price is 50 EUR per 10 units = 5 EUR each -->
</cac:Price>

Common Causes

  • ·Full card PAN stored and exported from source system
  • ·Payment card details not masked before export
  • ·PCI-DSS compliance not enforced in ERP
  • ·Legacy system stores full card numbers
  • ·Card number copied from payment gateway without masking

Seeing this in production? The API handles BR-51 automatically. See the fix response →

Commonly Seen In

Wholesale/bulk invoicing systems

Frequently Asked Questions

When price is per multiple units, use BaseQuantity in Price element.

Set BaseQuantity when price is per multiple units. You can also use Invoice Navigator's automatic Fixer tool to correct this instantly.

BR-51 is a warning that may not always cause rejection, but it indicates a potential compliance issue that should be addressed to ensure full compatibility.

Many instances of BR-51 can be automatically corrected using Invoice Navigator's Fixer tool. Upload your invoice and the tool will identify and fix common issues, including price base quantity usage.

BR-51 is commonly seen in exports from Wholesale/bulk invoicing systems. These software packages sometimes generate invoices that need adjustment to meet full compliance standards.

See Also

Related Errors

Last updated: 27 February 2026

Share this guide:

Handle BR-51 Automatically in Your Pipeline

The compliance engine auto-remediates this error with controlled safety policies and evidence pack generation.