ESIR, PFR and the security element: which does what

Anyone opening a shop in Serbia for the first time, or moving to a new register, hears three abbreviations in the same sentence: ESIR, PFR and the security element. They sound like three names for one thing. They are not. They are three separate parts of one system, each with its own job: the ESIR and the PFR are sometimes made by two different companies, and the security element is always issued by the Tax Administration.

The Law on Fiscalization („Службени гласник РС“ no. 153/2020, 96/2021, 138/2022 and 80/2026) defines them separately in article 2. Here is what that means in practice.

The electronic fiscal device is the umbrella term

What the law calls an electronic fiscal device (ЕФУ in Serbian) is a "hardware and/or software solution" that a taxpayer uses to issue a fiscal receipt. That wording matters: the device does not have to be a box on the counter. It can be pure software.

The device is made of three things that have to work together:

• one or more ESIRs, into which sales are entered,
• one PFR, which processes and signs that data,
• one security element, which the PFR uses to sign.

If any one of the three is missing you do not have a fiscal device and you cannot issue a fiscal receipt.

The ESIR is what the cashier sees

ESIR stands for електронски систем за издавање рачуна, an electronic system for issuing receipts. Under article 2 of the Law it is "a hardware or software element, whose use has been approved by the Tax Administration, into which the taxpayer enters data about a sale and from which the fiscal receipt is issued".

In other words, the ESIR is the register. It is the screen where a cashier types or scans items, sets quantities, applies a discount, picks a payment method and presses the button that issues the receipt. It holds the item catalogue, knows prices and tax labels, keeps a record and usually prints the receipt.

What an ESIR does not do is sign. It never declares a receipt fiscal on its own. When the cashier presses the button, the ESIR packs the receipt data, sends it to the PFR and waits for the answer.

An ESIR can be a dedicated device, a program on a computer, a phone app or a web application in a browser. As far as the law is concerned that makes no difference. What does make a difference is that every ESIR must be approved by the Tax Administration and entered in the Register of approved elements of an electronic fiscal device. The register is public and searchable on the Tax Administration site, and it is the first place to look when somebody offers you a register.

The PFR is what makes a receipt fiscal

Under the same article, a fiscal receipt processor is "a hardware or software element whose use has been approved by the Tax Administration, which exchanges data with the electronic system for issuing receipts".

It does the work an ESIR is not allowed to do:

1. receives the transaction data from the ESIR,
2. calculates tax at the rates and labels it holds itself,
3. assigns the receipt its PFR number, while the security element increments the receipt counters,
4. asks the security element for a digital signature,
5. builds the QR code and the verification address,
6. returns the finished, signed journal to the ESIR,
7. delivers the data to the Tax Administration.

A PFR comes in two variants, and that is the biggest practical split in the whole of fiscalization:

Which one suits you depends first of all on where you sell: as we understand article 6 paragraph 4 of the Law, anyone selling from business premises must have an L-PFR and may add a V-PFR. We take that apart in a separate article on choosing between an L-PFR and a V-PFR.

The security element is your signature, not the vendor's

The security element is "a hardware or software element containing the electronic certificate of the taxpayer", and the PFR uses it to sign receipts.

The key word in that definition is taxpayer. The certificate is issued in your name, against your TIN, not in the name of whoever sold you the register. The Tax Administration issues it, you request it separately, and it does not arrive with the software. Under the rulebook on the security element the Tax Administration has seven days from the application to generate it (by its own account, it is usually ready the next day), and the business premises have to be registered before that. That is why a company can configure a register in a day and then wait, because nobody requested the security element in time.

How it is requested, the form it arrives in and what happens when it expires are covered in the article on the security element.

Where the Tax Administration sits in all this

The fiscalization management system is, by law, a Tax Administration software application that receives all data from fiscal receipt processors. It is the end of the chain. You never talk to it directly: your PFR sends the data to it.

Article 8 of the Law requires a taxpayer to process every receipt through a PFR at the moment of sale, and to deliver the data over a permanent internet connection in real time. When there is no connection, the data goes out as soon as the connection is restored, and within five days of the day each receipt was issued at the latest.

That five day window is often misread as "the register may run for five days without internet". It applies to delivering the data from receipts that are already signed, and a receipt can only be signed offline if you have an L-PFR. The difference is large and we explain it in the article on working without internet.

Three parts, sometimes two manufacturers

Because the ESIR and the PFR are separately approved elements, they do not have to come from the same manufacturer. Three combinations are common in practice:

• ESIR plus V-PFR. The processor is the Tax Administration's own and the security element is a certificate file. With no other equipment this is, as we understand the law, enough only in the exceptions of article 6 paragraph 4, above all for a taxpayer selling exclusively over the internet; in business premises an L-PFR must run alongside the V-PFR. It needs a stable line.
• ESIR plus an L-PFR from another manufacturer. The register talks to a local processor over the network on the premises. It works offline.
• ESIR and L-PFR in one product. One supplier delivers both, usually as a device or as an installable package.

This split matters when you compare offers, because "register" in an offer sometimes means the ESIR alone and sometimes the whole package. The question that settles it is: which PFR does this use, and who provides the security element.

Short version

If you remember one sentence: the ESIR knows what you sold, the PFR knows what that is worth to the tax authority, and the security element is what says it was you.