warningEN 16931EN 16931 business ruleCIIUBLBT-87BT-97
In accordance with card payments security standards an invoice should never include a full card primary account number (BT-87). At the moment PCI Security Standards Council has defined that the first 6 digits and last 4 digits are the maximum number of digits to be shown.
A full card primary account number appears in BT-87. PCI DSS forbids storing or transmitting the full PAN.
Mask it: keep at most the first 6 and last 4 digits, e.g. 411111******1111. This is a warning, so the invoice still passes - but sending a full card number is a data protection incident waiting to happen, so fix it.
CII — context $Card_information
string-length(normalize-space(ram:ID)) <= 10
UBL — context $Card_information
string-length(normalize-space(.))<=10