Quick answer: A cash-accepting kiosk quote is only as good as the compliance scope attached to it. Before you request pricing, resolve six distinct layers — fiscal receipting, note and coin handling, payment data security, data privacy, product safety and CE, and accessibility. Vendors that lump these into one word (“compliance”) are telling you they have not scoped your market.
The pre-quote checklist: what to resolve before you ask for a kiosk price
A cash-accepting kiosk quote is only as good as the compliance scope attached to it. Before you request pricing, resolve six distinct layers — fiscal receipting, note and coin handling, payment data security, data privacy, product safety and CE, and accessibility. Vendors that lump these into one word (“compliance”) are telling you they have not scoped your market.
Two cautions up front. First, fiscal, tax, central-bank and certification rules differ by country and change without notice; nothing below replaces verification with the local tax authority, central bank or certification body. Second, the useful output of this exercise is not a feeling of reassurance — it is a document you attach to your RFQ so the manufacturer quotes against a defined scope rather than a default one.
Every item you lock down here is a post-install rework, a customs hold, or a site-acceptance failure you do not pay for later.
1. Fiscal receipt and cash-register obligations
Decide first what the kiosk must emit , because receipt hardware drives enclosure size, printer access and service intervals.
- Confirm whether the site requires a printed fiscal receipt, an electronic invoice, or both, and who generates each.
- Establish whether the kiosk must connect to a certified fiscal module or an approved external tax printer — and whether that module is supplied by the kiosk OEM or by a local fiscal-device vendor.
- List the exact data fields the receipt must carry in each target market (tax identifier, consecutive number, timestamp, operator data and so on) and put that list in the RFQ.
- Ask whether accepting cash triggers local cash-register registration or transaction-monitoring duties. Verify with the local tax authority.
If the fiscal module comes from a third party, the integration boundary — who certifies the combined system — must be settled before pricing, not after.
2. Currency acceptance and cash recycling
Cash still drives a meaningful share of transactions in many Latin American markets, which is precisely why cash-to-digital and cash-accepting options reach customer segments that card-only hardware misses ( Thunes, LATAM payments trends ). That reach only materialises if the hardware matches the local cash reality.
- Specify accepted note and coin denominations per country, and whether the kiosk must dispense change. A recycling module changes the bill of materials, the enclosure depth and the service access requirement compared with an exact-payment-only design.
- Map cassette capacity against expected transaction volume and your refill interval. Under-sized cassettes create operational cost, not compliance risk — but they surface as a complaint in the same conversation.
- Confirm jam handling and cash-box access from the front or rear, based on how the kiosk will sit in the room.
Cash-heavy configurations such as a currency exchange kiosk or a freestanding cash-handling self-service kiosk are the natural reference points when you write this section of the RFQ, because recycling, validation and dispensing are already engineered as one assembly.
3. Payment data security: PCI DSS scope, KYC and SCA
If the kiosk accepts cards as well as cash, the payment path is a separate compliance layer with its own evidence requirements.
- Confirm whether the kiosk tokenises card data or passes it to a certified gateway, and whether raw primary account numbers ever touch the device.
- For LatAm acquiring, some gateway providers position themselves as managing PCI DSS compliance and automated KYC and Strong Customer Authentication controls ( PayRetailers, LATAM payment gateways ). Treat that as a vendor-stated capability to be evidenced in writing, not as a transfer of your own obligations.
- Decide explicitly who owns each control — kiosk OEM, integrator, or payment service provider — and require that split in writing.
Card reader swaps are a common source of hidden recertification work. Our EMV module swap and recertification checklist walks through the questions to ask before you change a payment module mid-project.
4. Data privacy and identity checks in LatAm
Regional regulatory modernisation is moving toward fraud-management programmes, transaction limits, enhanced authentication and incident-reporting timelines. One regional compliance vendor summarises the direction of travel, including country-specific regimes in Brazil and Colombia, and country-specific monitoring frameworks ( Facephi, LATAM regulatory modernisation ). Use that only as a prompt list of questions, then confirm each one with the relevant national authority — the specifics, thresholds and applicability vary by country and by sector.
- Does the kiosk store, transmit or discard personal data? Request a written data-flow description rather than a verbal answer.
- If identity verification is in scope, who performs it — the kiosk, a hosted service, or site staff?
- What is the retention period, and who is the data controller under local law?
5. Product safety, CE and local certification
Electrical safety and electromagnetic compatibility sit at the hardware layer and are usually the easiest items to evidence — if you ask for the documents before the order.
- Confirm which safety and EMC requirements apply to the target market and which declarations the manufacturer must supply.
- Treat CE marking and any local conformity or certification scheme as verify with the certification body . Do not assume scope from a datasheet sentence.
- Require the conformity documentation list — declarations, test reports, and the model numbers they cover — to be attached to the quotation. A promise to provide them after order is not evidence.
6. Accessibility: the EU European Accessibility Act
Accessibility is now a purchasing gate in the EU, not a nice-to-have. The European Accessibility Act covers self-service kiosks and terminals — ATMs, ticket machines, check-in kiosks among them — with a stated first deadline of 28 June 2025 ( TPGi / Vispero, EAA and self-service kiosk accessibility ). Confirm current scope and any applicable deadlines with the relevant authority or notified body before sign-off.
Translate the requirement into hardware and software line items your RFQ can carry: reach height and approach space, tactile and high-contrast controls, screen-reader or assistive-mode support, audio guidance, and a documented accessibility conformance statement from the manufacturer. If you also sell into the United States, our ADA kiosk procurement checklist covers the parallel US requirements — the two regimes are separate and should not be merged in a specification.
7. Device cybersecurity and EU Cyber Resilience Act readiness
A connected kiosk is a product with software, which brings cybersecurity obligations into the pre-quote conversation rather than the post-install one.
- Ask whether the kiosk’s software falls within the scope of covered products under the EU Cyber Resilience Act, and how the manufacturer classifies it ( Anchore, EU CRA compliance checklist ). Classification drives everything downstream, so get it in writing.
- Request the manufacturer’s security-update and maintenance approach, including how long updates are provided and how they are delivered.
- Define who monitors, patches and decommissions endpoints during the kiosk’s service life.
Confirm the security posture against the manufacturer’s documentation and, where the risk profile warrants it, specialist advice — not against assumptions.
Compliance hand-off: what to attach to your RFQ
| Layer | Document to request from the manufacturer | How you verify it |
|---|---|---|
| Fiscal receipting | Receipt field layout, fiscal-module integration description, printer specification | Local tax authority / fiscal-device vendor confirms the format |
| Currency & recycling | Accepted denominations per market, cassette capacity, recycling vs. non-recycling configuration | Site walkthrough against the service access and floor space plan |
| Payment data security | PCI DSS posture, tokenisation method, control-ownership matrix | Your acquirer or PSP reviews the split in writing |
| Data privacy | Data-flow description, retention statement, controller/processor roles | Local legal counsel or data protection adviser |
| Safety & CE | Declarations of conformity, EMC and safety test reports with model references | Certification body confirms scope and applicability |
| Accessibility | Accessibility feature list and conformance statement | Authority or notified body confirms EAA scope for your device class |
| Cybersecurity | Update and maintenance policy, CRA scope classification | Manufacturer documentation plus specialist review where needed |
Mark every country-specific row as verify with local authority or certification body . A checklist that asserts a fixed rule for a market you have not confirmed is worse than no checklist, because it creates false confidence in a site-acceptance review.
Questions buyers ask before signing
Does the EU European Accessibility Act apply to self-service kiosks?
According to the TPGi / Vispero session on EAA and self-service kiosks, covered devices include ATMs, ticket machines and check-in kiosks, with a stated first deadline of 28 June 2025. Confirm the current scope for your specific device and market with the relevant EU authority or notified body.
What fiscal receipt requirements apply to cash-accepting kiosks in LatAm?
They vary by country and are not uniform across the region. Ask the local tax authority which receipt format, fields and device approvals apply to your transaction type, then put that answer in the RFQ as a fixed requirement.
Do cash-accepting kiosks need PCI DSS compliance?
Only the card-payment path is in scope. If the kiosk never touches card data — for example, a cash-only configuration — the PCI question may not apply at all. If it does accept cards, establish whether the device tokenises or outsources card data, and who owns each control.
Which certification documents should I require in a kiosk RFQ?
At minimum: declarations of conformity covering the exact model numbers quoted, EMC and electrical safety test reports, an accessibility conformance statement for EU deployments, and the security update policy. Request them attached to the quotation rather than promised after order.
Turn the checklist into a quote
A complete RFQ shortens the back-and-forth and removes the most expensive failure mode in a cash-accepting deployment: discovering a compliance gap after the unit is on site. Fill in the table above with your country, denominations, receipt format and accessibility requirements, then send it as the specification your supplier quotes against.
Compare configurations side by side before you finalise the scope — reviewing a freestanding cash-handling self-service kiosk alongside a currency exchange kiosk makes the recycling, cassette and enclosure trade-offs visible early, when they are still free to change.
Request a quote and compliance/spec documentation for your target markets. Send us your country list, accepted denominations, receipt format and accessibility requirements, and we will return pricing together with the conformity and specification documents your RFQ asks for.
