NF525 and card shops: what to know in 2026

Under France's anti-VAT-fraud law, any business recording customer payments through POS software must use a compliant tool: inalterability, security, retention and archiving of data (the four “ISCA” conditions). Card shops are concerned like any retailer.

The four conditions to meet

• Inalterability: a recorded sale can't be deleted or modified (a correction goes through a reverse operation).
• Security: authenticated access, traceability of operations.
• Retention: daily, monthly and annual closures with a perpetual running total.
• Archiving: a frozen, re-readable archive of register data.

Editor attestation: what changed in 2026

France's 2026 finance law reinstated the editor's ability to issue an individual attestation of compliance — an alternative to certification by an accredited body (AFNOR/LNE). In practice, the software editor attests that the product meets the four conditions, for a given version.

Risks of non-compliance

It's the retailer who must be able to present, on inspection, the attestation or certificate of the software they use. Using non-compliant software exposes you to a fine. Better to choose software that provides its attestation and genuinely handles closures and archiving.

Echo TCG is built for NF525 compliance (hash-chained sales, period closures, event journal, annual archive) and provides the editor attestation. This article is informational and does not replace professional advice.