What to do if the electronic key of the cashier has expired?

How to Replace a Cashier's Electronic Key for PRRO at the Tax Office

To work with a Software RRO (PRRO), simply obtaining a new key file is not enough. Settlement operations on a PRRO can only be performed by individuals whose electronic signature and/or seal certificates are entered into the Register of Software RROs for a specific PRRO. Furthermore, signing electronic settlement documents is only possible if the corresponding public key certificate is valid. Therefore, replacing a cashier's key consists of two mandatory steps: obtaining a new key from an electronic trust service provider and submitting a notification to the State Tax Service (STS) regarding the new certificate for use with the PRRO. (dp.tax.gov.ua)

The replacement of a cashier's key itself is formalized through Form No. 5-PRRO (J/F1391802). While Form No. 1-PRRO is used for the registration of the PRRO itself, Form No. 5-PRRO is used to enter data regarding the certificates of cashiers and senior cashiers into the Register. This means that during a routine cashier key replacement, it is not necessary to re-register the PRRO. (tr.tax.gov.ua)

When the Key Must Be Replaced

The replacement should be done before the certificate's validity expires, as well as in cases where the key is revoked, blocked, if data specified in the certificate has changed, if errors are detected in the certificate's attributes, if the key carrier is lost, or if there is a suspicion that the private key has become known to other persons. (ca.tax.gov.ua)

Procedure

1. Obtain a New Key from an Electronic Trust Service Provider

Users who still have valid certificates can use online services for remote remote certificate generation. The STS Qualified Electronic Trust Service Provider (QETSP) resource states that this method allows users to independently extend the validity of certificates for 2 years. If the certificate has already expired or a signature is being obtained for the first time, you must prepare documents according to the rules of the chosen provider and visit a registration point. (ca.tax.gov.ua)

2. Submit Form No. 5-PRRO (J/F1391802) to the Tax Office

After receiving the new key, the business entity submits a notification via Form No. 5-PRRO (J/F1391802) to the controlling authority. This can be submitted through the Electronic Cabinet, the Unified Window for Electronic Reporting, or other software that supports electronic document exchange with the STS. This notification specifies information about the cashier's new certificate. (tr.tax.gov.ua)

In the column for the subject's key identifier, you must enter the value from the security certificate parameters of the new key. Form No. 5-PRRO explicitly states that this is the specific subject key identifier value from the qualified or advanced public key certificate. This identifier consists of a set of numbers and Latin letters.

3. Correctly Define the Role in the Form

In Form No. 5-PRRO, one of the following roles is indicated in the "Signature Type" column: "Cashier," "Senior Cashier," or "Cessation of Work." If the shift on the PRRO is already closed at the time of forming the new key, the "Cashier" role can be specified for the new key. However, if the new key is generated while a work shift is still open, the STS recommends submitting the form with the "Senior Cashier" role.

Practical example: a cashier opened a shift with an old key but received a new Qualified Electronic Signature (KES) before closing the shift. In this situation, Form No. 5-PRRO is submitted for the new key identifier, specifying the role as "Senior Cashier." (tr.tax.gov.ua)

4. Operate the PRRO Only After the New Certificate is Entered into the Register

The right to conduct settlement operations on a PRRO belongs only to the person whose certificate has been entered into the Register of Software RROs for that PRRO. Certificate data is entered into the Register specifically based on the Form No. 5-PRRO notifications. Consequently, the new key can be used for settlement operations only after the STS processes the submitted notification and the relevant data is recorded in the Register. (dp.tax.gov.ua)

What to Do with the Old Key

If the validity of the old key has simply expired or it has already been revoked, it is not necessary to separately submit Form No. 5-PRRO with the "Cessation of Work" signature type for that key. This is the direct position of the STS General Information and Reference Resource. (ZIR)

In a different situation—if the key is compromised, the carrier is lost, data in the certificate has changed, or errors are found in the certificate details—the user must immediately contact the provider to block or revoke the certificate. The STS QETSP specifically notes that a revoked certificate cannot be restored, while a blocked one can only be restored during the blocking period. (ca.tax.gov.ua)

Special Cases

If an individual entrepreneur (FOP) registered a PRRO using their passport series and number or ID card, but received an RNOKPP (Tax ID) and formed a new KES with the tax number during an open shift, Form No. 5-PRRO (F1391802) should be submitted with the new key identifier and the "Senior Cashier" role. (dp.tax.gov.ua)

If the message "Missing business units" appears when opening a shift on a PRRO, one of the reasons may be that Form J/F1391802 contains an incorrect subject key identifier or that the identifier was taken from the wrong certificate. The STS explicitly draws attention to this error. (vin.tax.gov.ua)

The "Senior Cashier" function is needed not only for initial setup. The STS explains that if one cashier has opened a shift on a PRRO, another cashier cannot enter the same shift, but a senior cashier can enter the already opened shift and close it. (tr.tax.gov.ua)

Liability for Violations

The law requires settlements to be conducted through registered RROs or PRROs and for a settlement document of the prescribed form to be issued to the buyer for the full amount of the operation. If a business entity effectively conducts settlements in violation of these requirements using an expired, invalid, or unregistered key, financial sanctions apply. The STS reminds that as of August 1, 2025, standard fines for violating paragraphs 1 and 2 of Article 3 of Law No. 265 are back in effect: 100% of the value of goods (works, services) for the first violation and 150% for each subsequent one. (tax.gov.ua)

In addition to financial sanctions for the business entity, administrative fines under Article 155-1 of the Code of Administrative Offenses (KUapP) are possible. For the first violation—from 34 to 85 UAH for persons conducting settlement operations and from 85 to 170 UAH for officials; for a repeated violation within a year—from 85 to 170 UAH and 170 to 340 UAH, respectively. (kr.tax.gov.ua)

How to Replace a Cashier's Key for PRRO in Torgsoft?

To replace a cashier's electronic key (KES) for working with a software RRO (PRRO) in Torgsoft, several steps must be completed. The most important rule is: the new key must first be registered with the State Tax Service (STS) before it can be added to the program.

Step 1. Register the New Key with the STS

Before adding the new cashier key to Torgsoft, you must submit Form No. 5-PRRO (Notification of providing information regarding qualified/advanced public key certificates used in PRRO).

Step 2. Prepare the Key File

Place the new private key file (usually in .dat, .jks, or .pfx formats) directly in the Torgsoft program folder. The recommended path is: C:\TORGSOFT\PROGRAM\Keys\Cashier_Full_Name\Key-6.dat.

Step 3. Replace the Key in the Employee (Cashier) Profile

To allow an employee to sign receipts with their own key, configure the following settings:

(Note: if you no longer wish to use an individual signature for a specific employee, simply clear the key field).

Step 4. Replace the Main Key in the PRRO Settings (If Needed)

If the cashier's key is also used as the primary key for the checkout counter itself (or if you are changing the general FOP/Director key), it must also be replaced in the PRRO settings:

Official Sources