Serbia ESIR Receipt QR — QR Data Format standard

Overview

The Serbian fiscal receipt QR code is the verification code on every printed fiscal receipt under Serbia's e-fiscalisation system. It is required by Article 5 of the Law on Fiscalization (Zakon o fiskalizaciji), which lists a "two-dimensional bar code (QR)" for verification as a mandatory receipt element, with a verification hyperlink taking its place on electronic receipts ¹.

The symbol is a URL QR: an ordinary QR Code holding an https://suf.purs.gov.rs/v/?vl=… address ¹⁴. The vl parameter is a Base64 binary record carrying the receipt counters, total, timestamp, encrypted internal data and digital signature ¹⁰ ¹⁴. Scanning it opens the Tax Administration's verification system, which confirms the receipt and shows its contents ³.

History

Before e-fiscalisation, retail sales were recorded on fiscal cash registers under the Law on Fiscal Cash Registers (Official Gazette 135/04 and 93/12) ¹.

21 December 2020: the Law on Fiscalization was published in Official Gazette 153/2020 ¹.
31 March and 2 April 2021: the implementing rulebooks appeared in Official Gazette 31/2021 and the Government decree on electronic fiscal devices in 32/2021 ² ³ ⁶. The rulebooks were in force from 8 April 2021 and set a start date of 1 January 2022 ² ³ ²¹.
13 July 2021: the first edition of the technical guide for reviewing ESIR and L-PFR products is dated this day (the source uses DD.MM.YYYY) ⁹.
October 2021: amendments moved the start forward. Gazette 96/2021 set the law's application date at 1 November 2021, and an amending rulebook did the same for the verification rulebook, replacing 1 January 2022 ¹ ⁵. The consolidated text cites that amendment as Gazette 99/2021 ⁴.
1 November 2021 to 30 April 2022: the transition period for taxpayers ¹.
1 May 2022: the Law on Fiscal Cash Registers ceased to apply ¹, and the Tax Administration dates full application of e-fiscalisation to this day ⁷.
September 2022: a trade news site reported that a citizen check of receipts by QR scan had started the week before, alongside the new Tax Alarm reporting app ²⁶.
31 August 2026: Gazette 80/2026 added a specific penalty for false QR codes, in force from 8 September 2026 ¹ ²² (see Status).

The software behind the system is TaxCore, a product of Data Tech International (DTI) ²⁰. The Tax Administration's help portal is branded "TaxCore | СУФ Подршка" ¹², and the footer of its verification page carries a DTI copyright ¹³. DTI's generic developer guide predates the Serbian law: revision entries in version 2.6 run from at least December 2017, and the PDF was created in March 2020 ¹⁰.

Technical specification

Terms

Serbian term	Meaning	Source
EFU (elektronski fiskalni uređaj)	Electronic fiscal device: one PFR, one or more ESIRs, and a security element	¹
ESIR (elektronski sistem za izdavanje računa)	Approved system in which the sale is entered and from which the receipt is issued	¹
PFR (procesor fiskalnih računa)	Approved processor that formats the receipt, creates the electronic signature and transfers data to the SUF	¹
L-PFR / V-PFR	Local processor, or virtual processor run in the SUF	¹ ⁷
BE (bezbednosni element)	Security element holding the taxpayer's electronic certificate, used to sign receipts	¹
SUF (sistem za upravljanje fiskalizacijom)	The Tax Administration's fiscalisation management system	¹
ESF (elektronski servis za fiskalizaciju)	The taxpayers' portal for managing e-fiscalisation; it can also issue receipts	⁷ ¹²

The law gives a taxpayer two kinds of device: one with its own processor, which can keep issuing receipts when the internet is down, and one using a processor in the SUF, which works only online. A taxpayer on the online-only kind must generally keep at least one offline-capable device in each business premises; internet-only sellers are excepted ¹.

What the rules require of the symbol

Shape and size: square, not smaller than 40 × 40 mm and not larger than 50 × 50 mm ². The Tax Administration's technical review guide (version 1.15, 2023) repeats this ⁹.
No graphics: the code must not be printed on an image or logo, and must not contain one ².
Content: the rulebook says the code contains all elements of the electronic signature ². The technical review guide says it contains the URL for checking the receipt, plus the internal data and digital signature used for detailed analysis ⁹.
Electronic receipts: a verification hyperlink, reachable from any internet-connected device ². The verification rulebook, as amended, also covers scanning a QR code on a receipt sent to the buyer electronically ⁴.

The rulebook's annex shows a sample code ². No source fetched for this article sets the QR version or error-correction level. DTI's guide says the device returns the QR as a Base64-encoded GIF image ¹⁰, and its change log records that a 384 × 384 px dimension was removed in February 2018 ¹⁰. The Serbian guide requires the printers supported by an ESIR to be able to print the code ⁹.

URL and payload

The URL has this structure (structurally illustrative, with no real receipt data):

https://suf.purs.gov.rs/v/?vl=<URL-encoded Base64 of the binary record>

The host and the vl parameter come from a third-party parser, which rejects other hosts ¹⁴. DTI's guide says only that the base URL reaches the device through an "Update Verification URL" command, and that the Base64 string is further encoded to comply with URL rules ¹⁰. The parser warns that a plain query-string parser would turn + into a space ¹⁴.

Record layout, from DTI's generic guide ¹⁰ and the third-party parser ¹⁴:

Offset	Bytes	Field	Encoding
0	1	Version	`0x02` in DTI's guide
1	8	RequestedBy (UID)	ASCII
9	8	SignedBy (UID)	ASCII
17	4	Total counter	32-bit little-endian
21	4	Counter for this document type	32-bit little-endian
25	8	Total amount × 10,000	64-bit little-endian
33	8	Date and time, Unix milliseconds	64-bit big-endian
41	1	Invoice type	See below
42	1	Transaction type	`0` sale, `1` refund
43	1	Buyer ID length (n)	Unsigned byte
44	n	Buyer ID	ASCII
44 + n	256 or 512	Encrypted internal data	Binary
next	256	Signature	Binary
last	16	MD5 of all preceding bytes	Parser only, see Source limits

Reading the record:

UID: 8 alphanumeric characters assigned to each smart card and embedded in its certificate ¹⁰. The parser builds the printed receipt number as RequestedBy-SignedBy-TotalCounter ¹⁵.
Internal data: encrypted fiscal data that only the tax authority's system can read ¹⁰.
Invoice type: DTI's guide lists 0 normal, 1 pro forma, 2 copy, 3 training ¹⁰. The parser adds 4 advance, which matches Serbia's rulebook, where advance is a receipt type of its own ² ¹⁶.
Receipt counter suffix: the parser prints the type counter, total counter and a two-letter code, such as ПП (promet prodaja, normal sale) or АР (avans refundacija, advance refund) ¹⁵ ¹⁶. Most of these codes also appear on the verification form ¹³ and in the technical review guide ⁹.
Length: the parser accepts 572 to 848 bytes and reads 512 bytes of internal data when the record exceeds 592 bytes ¹⁴. Arithmetically, 572 is the record with no buyer ID (44 + 256 + 256 + 16), and 848 is 512-byte internal data with a 20-byte buyer ID. The 20-byte limit is an inference from those bounds, not a stated rule.
Buyer ID: a code prefix then a value, shown in the technical review guide as 10: followed by a tax number ⁹.

Worked sizes (computed for this article with segno 1.6.6 on random bytes, not taken from a real receipt or a spec): a 572-byte record gives a URL of about 850 characters, needing QR version 20 (97 × 97 modules) at level L or 23 (109 × 109) at level M. An 848-byte record gives about 1,220 characters, needing version 25 (117 × 117) at L or 29 (133 × 133) at M. At the permitted 40 to 50 mm, that means modules of roughly 0.3 to 0.5 mm, which is why the rule sets a large minimum for a code on a 58 or 80 mm receipt roll ⁹ ¹⁰. That last link is this article's reading, not a stated reason.

Verification

Under the verification rulebook ³ ⁴:

A buyer can check a receipt immediately after issue, whichever device issued it, and whether or not its data has yet reached the Tax Administration.
The check needs an internet connection and can be repeated, in more than one way.
The result is one of three notices: system unavailable, receipt incorrect, or receipt correct.
A correct receipt shows its contents, with an option to download an electronic copy and to join a fiscal lottery or similar promotion if one is running.
Checks remain possible for 10 years from the issue date.

The rule that a receipt can be checked before its data is submitted fits a URL that carries the signed record itself, but that link is an inference. Without a QR code or URL, a form at suf.purs.gov.rs/verify/ takes the PFR receipt number, the receipt counter, the total and the PFR time ¹³ ²⁴. A third-party report says it returns the same view as a scan, including the receipt's text in a "Journal" section ²⁴.

A help page titled "Scanning an invoice with JSON response" exists on the portal ¹², but its text could not be retrieved. The third-party parser sends a GET to the receipt URL with an Accept: application/json header and treats any status other than 200 as an error ²⁷. Treat that as observed client behaviour, not a documented contract.

Decoding is not verifying. A parser can read the amount, date and counters offline ¹⁷, and the parser's MD5 check only detects a damaged payload ¹⁴. Authenticity comes from the Tax Administration's check. Even that needs the buyer to compare what is shown with the receipt in hand: the 2026 bill describes codes copied from earlier genuine receipts onto fake ones ⁸.

Use cases

Consumer checks. Any buyer can confirm that a sale was recorded by scanning the code ³ ²⁶.
Inspection and enforcement. A code that fails verification, leads away from the Tax Administration's portal, or leads to another receipt is grounds for a one-year ban on activity ¹.
Non-receipt documents. Copies, training receipts and pro formas are issued through the same device, but must be marked "ОВО НИЈЕ ФИСКАЛНИ РАЧУН" ("this is not a fiscal receipt") in text at least twice the size of the rest ².
Online shops and vending machines. Internet-only sellers issue electronic receipts with the hyperlink, and vending operators may offer them ² ⁷.
Reporting. The verification system has help pages for reporting a suspicious receipt or a missing one ¹².
Expense and receipt tools. Open-source libraries turn the code into structured item, tax and store data ¹⁷ ¹⁸.

Implementations

No open-source encoder was found. A valid code requires a signature and encrypted internal data from a security element issued by the Tax Administration ¹ ¹⁰, so generating one is the job of an approved ESIR and PFR, listed in the Tax Administration's register ¹. The QR drawing itself is a standard URL QR task.

All the decoders found have fewer than 10 stars, and are listed because nothing larger turned up:

Project	Language	Stars	Last active	What it does
turanjanin/serbian-fiscal-receipts-parser	PHP 8.1+	4	March 2026	Decodes the `vl` record offline; fetches and parses receipts; MIT ¹⁷ ³⁰
Innovigo/sr-invoice-parser	Python	8	Not shown	Scrapes the receipt page from a QR URL or HTML, rather than decoding `vl` ¹⁸
tuckdesign/rs-invoice-qrcode-reader	PHP 7.4+	0	January 2025 (version 0.4)	Reads the QR from a PDF or image with optional zbar and xpdf tools, then gets JSON ¹⁹

The Tax Administration also publishes a free ESIR of its own, "ESIR Poreska uprava RS", with help pages on the portal ¹².

Comparison

	Serbian fiscal receipt QR	NBS IPS QR
Purpose	Prove a sale was recorded	Start a payment
Issuer of the rules	Tax Administration, Ministry of Finance ¹	National Bank of Serbia ²⁹
Payload	HTTPS URL with Base64 binary ¹⁴	Plain text `TAG:value` pairs, such as `K:PR\|V:01\|…` ²⁹
Scanned with	Any device that can scan a QR code and go online ³	A bank's m-banking app ²⁹
Signed	Yes, by the security element ¹	Not established by the sources used here

Choose by job: one is a tax proof after the sale, the other a payment instruction before it.

Within the URL QR family, this format differs from an ordinary link because the URL is not a pointer alone. The record travels with the signature inside it, so the code stays long and dense, as the worked sizes show. A short ID resolved by the server would give a smaller symbol, at the cost of the record no longer being carried by the receipt.

DTI says it has carried out fiscal projects for many governments ²⁰. Its generic TaxCore guide, with the same record layout, is also hosted on the Fiji Revenue and Customs Service's website ¹¹. Implementers should check each country's own rules before reusing a parser: invoice type 4, for one, appears in the Serbian parser but not in the generic table ¹⁰ ¹⁶.

Fun facts

Scanning a receipt also reports it: DTI says a scan sends the transaction details to the tax authority automatically and anonymously ²⁰. This is the vendor's claim, not found in the law or rulebooks.
The 2026 penalty came from a real inspection. A taxpayer ran a legal device and an unauthorised second system side by side in the same premises, and the second printed look-alike receipts with QR codes lifted from earlier genuine receipts ⁸.

Status

Active and mandatory. Article 4 makes every retail seller paying self-employment income tax or corporate profit tax record each retail sale on an electronic fiscal device, whatever the payment method. The Government may exempt certain activities by decree ¹. Article 5 makes the QR code or hyperlink a mandatory receipt element ¹. A receipt is printed by default, while internet-only sellers issue it electronically ² ⁷.

Latest legal change. Gazette 80/2026 of 31 August 2026 amended Article 12: a receipt with a QR code found not to have been generated through the Tax Administration's system, leading elsewhere than its portal, or leading to a receipt for a different sale, amount, date, items or taxpayer, brings a one-year ban, imposed immediately ¹. It replaces, for this case, the 15-day, 90-day and one-year ladder for other failures to record sales ¹ ²³. The law enters into force on the eighth day after publication, and KPMG gives 8 September 2026 ⁸ ²². It adds no new QR requirement, because the code was already mandatory.

Technical guides. The Tax Administration lists its guides on its site, with no versions shown ²⁸. The latest version found is 1.17, reported on 12 August 2024 by a trade news site ²⁵. A later version may exist.

Source limits

Serbian spec not retrieved. The Tax Administration's "Create Verification URL" and "QR code" help pages exist ¹² ¹⁴, but they returned redirects, connection failures or navigation only. The byte layout here rests on DTI's generic guide, version 2.6 of 2020, hosted by a third party ¹⁰, and on a third-party parser ¹⁴. Neither is a Serbian official text. The technical review guide confirms the code's general content, not the layout ⁹.
Offset conflict. DTI's table starts DateAndTime at byte 29, though the 8-byte amount before it starts at 25 ¹⁰ ¹¹. The guide's change log records the amount growing from 4 to 8 bytes in December 2017 ¹⁰, and the parser reads the field at 33 ¹⁴. This article uses 33, and its later offsets follow. The table's start column appears not to have been updated.
MD5 trailer. The 16-byte hash appears in the parser, which rejects records that fail it ¹⁴, but not in DTI's version 2.6 table ¹⁰. It may be a later or Serbian addition. This could not be confirmed.
Pro forma suffix. The parser uses РП and РР for pro formas ¹⁶, while the verification form lists ПД and РД in the matching place ¹³. The form does not explain its codes, so which is current could not be settled.
Rulebook consolidation. The size rule is quoted from the 2021 rulebook text ² and the 2023 guide ⁹. A consolidated rulebook text was not found, so later amendments to that article cannot be ruled out.

Sources

1 Zakon o fiskalizaciji (Law on Fiscalization), consolidated text with Official Gazette 153/2020, 96/2021, 138/2022 and 80/2026 — Ministry of Finance of Serbia, accessed 2026 2 Rulebook on types of fiscal receipts, transaction types, payment methods and other receipt elements, Official Gazette 31/2021 — Ministry of Finance of Serbia, accessed 2026 3 Rulebook on the manner of verifying reported fiscal receipts, Official Gazette 31/2021 — Ministry of Finance of Serbia, accessed 2026 4 Rulebook on the manner of verifying reported fiscal receipts, consolidated text — Ministry of Finance of Serbia, accessed 2026 5 Rulebook amending the rulebook on verifying reported fiscal receipts — Neobilten copy of the text, file dated October 2021, accessed 2026 6 Decree on the register of elements of electronic fiscal devices, Official Gazette 32/2021 — Ministry of Finance of Serbia, accessed 2026 7 Obaveze obveznika fiskalizacije (Obligations of fiscalisation taxpayers), January 2025 — Tax Administration of Serbia, accessed 2026 8 Bill amending the Law on Fiscalization, with explanatory statement — National Assembly of Serbia, 2026, accessed 2026 9 Technical instructions for the administrative and technical review of ESIR or L-PFR functionality, version 1.15 — Tax Administration of Serbia, copy hosted by the Republic Pension Fund (PIO), 2023, accessed 2026 10 Technical Instructions for E-SDC Developers, version 2.6 — Data Tech International, copy hosted by a third party, PDF created 2020, accessed 2026 11 Technical Instructions for E-SDC Developers, version 2.3 — Data Tech International, hosted by the Fiji Revenue and Customs Service, accessed 2026 12 TaxCore | СУФ Подршка help portal index — Tax Administration of Serbia, accessed 2026 13 Invoice verification form — Tax Administration of Serbia, accessed 2026 14 UrlDecoder.php, serbian-fiscal-receipts-parser — third-party open-source code, accessed 2026 15 UrlPayload.php, serbian-fiscal-receipts-parser — third-party open-source code, accessed 2026 16 ReceiptType.php, serbian-fiscal-receipts-parser — third-party open-source code, accessed 2026 17 turanjanin/serbian-fiscal-receipts-parser — GitHub, accessed 2026 18 Innovigo/sr-invoice-parser — GitHub, accessed 2026 19 tuckdesign/rs-invoice-qrcode-reader — GitHub, with the Packagist listing, accessed 2026 20 TaxCore FAQ — Data Tech International, accessed 2026 21 New Rulebooks Related to Application of the Law on Fiscalization Adopted — KPMG Serbia, 24 May 2021, accessed 2026 22 Serbia: Prohibition on performing activities for one year in cases of invalid QR codes on receipts — KPMG, September 2026, accessed 2026 23 Serbia updated the fiscal law relevant to cases of invalid QR codes on fiscal receipts — Fiscal Solutions, 10 September 2026, accessed 2026 24 Checking the fiscal receipts in Serbia if no QR code is not available — Fiscal Solutions, 16 December 2022, accessed 2026 25 Another version of Technical Guidelines for ESIR and LPFR 1.17 is published in Serbia — Fiscal Solutions, 12 August 2024, accessed 2026 26 Tax Alarm, a mobile application for reporting tax irregularities, is introduced in Serbia — Fiscal Solutions, 12 September 2022, accessed 2026 27 Fetcher.php, serbian-fiscal-receipts-parser — third-party open-source code, accessed 2026 28 Technical guides — Tax Administration of Serbia, accessed 2026 29 Serbia country report — Barcoder corpus, accessed 2026 30 Commit history, serbian-fiscal-receipts-parser — GitHub, accessed 2026

Deployments

No country reports mention this standard by name.