Best practices for cash, QR codes, and SumUp machines

• Ensuring the safety and security of charity collection tins, QR codes, and point-of-sale devices such as SumUp machines is fundamental to maintaining public trust in SSAFA and safeguarding donations. This is why they should never be left unattended or with someone who is not an authorised representative of the charity.
• Physical collection tins must be sealed, clearly branded, and never left unattended, as they are vulnerable to theft or tampering. Proper handling, such as counting cash in the presence of a colleague and promptly delivering funds to the Finance team helps prevent loss and ensures transparency. For digital methods, QR codes should only be those supplied and approved by the charity, displayed in secure and visible locations, and regularly tested to confirm they direct donors to the correct, official donation platform. This is especially important given the rise in fraudulent QR code labelling, which can divert donations away from the intended charity.
• SumUp machines and other card readers introduce additional security considerations. Devices must be fully charged, connected to secure networks, and used only by authorised personnel. Card transactions should comply with Payment Card Industry Data Security Standards (PCI-DSS), and donor card details must never be stored on any device or platform.
• All digital and cash donations should be reconciled and recorded accurately, with any issues or incidents reported immediately.

By following these best practices, SSAFA not only protects the funds entrusted to us but also demonstrate our commitment to legal compliance, donor confidence, and the integrity of our fundraising operations.

SSAFA is regulated by the Fundraising Regulator and adheres to the Code of Fundraising Practice (2025).  Through the code, we aim to make sure that all our fundraising activities meet the following values: 

• Legal: our fundraising must meet the requirements of the law.

• Open: our fundraisers must be clear about their processes and willing to explain them when necessary.

• Honest: our fundraisers must act with integrity and must not mislead people when asking for donations.

• Respectful: our fundraisers must respect the people and places they interact with.

Collecting charity donations from members of the public requires care, transparency, and adherence to legal and organisational standards. The following guidelines outline best practices when collecting donations via cash, QR codes, and SumUp machines.

• Wear official charity identification and display any required permits or authorisations.
• Clearly explain the purpose of the collection and how the donations will be used.
• Ensure all collection activities comply with local laws and regulations.

• Use sealed and clearly branded collection buckets or tins with tamper-evident features.
• Never leave collection containers unattended.
• Count all cash received in the presence of a colleague or supervisor where possible.
• Record the amount collected and ensure prompt delivery to the charity’s finance team or designated person.
• Provide receipts or thank-you notes if requested by donors.

• Only use SSAFA-supplied QR codes.
• Display QR codes on posters, flyers, or stands in visible and accessible locations.
• Explain to donors how to use their smartphones to scan the QR code and complete the donation securely.
• Ensure the QR code links directly to an official charity donation platform or webpage when being used.
• Test QR codes regularly to confirm they are working and directing donors to the correct page.
• Offer assistance to those unfamiliar with QR codes or digital payments.

• Only use SSAFA branch-approved SumUp machines.
• Ensure SumUp (card) machines are fully charged and connected to the internet before starting collections.
• Clearly explain to donors how card payments are processed and reassure them about payment security.
• Enter the correct donation amount and show it to the donor before processing the transaction.
• Provide digital or printed receipts if requested.
• Secure and store the device when not in use and report any technical issues promptly to the charity’s IT support.

• Store all collected cash securely until it can be handed over as per organisational procedures.
• Reconcile and record all cash, QR code, and SumUp donations accurately.
• Thank all donors and volunteers for their support and participation.
• Report and document any issues or incidents encountered during the collection.

• Have you registered your proposed collection event with your Community Engagement Manager(CEM) ?
• Do you have an inventory of all collection tins, buckets and other donation payment systems like QR codes and SumUp machines?
• Do you ensure that tins &c. are signed out and collected back after use?
• Are your volunteers trained in supporting QR code and SumUp machine donations?
• Do you have agreed procedures for collecting and counting cash donations?
• When collecting personal data from supporters are you recording their consent to receive communications from SSAFA?
• Do you require a permit or license for your public fundraising activity?
• Do all SSAFA volunteers involved in collecting donations have SSAFA ID to identify themselves with the general public?

Following these guidelines will help ensure that charity collections are conducted safely, efficiently, and in line with public expectations and legal requirements. Please periodically check for any updates to processes and ensure all volunteers are properly trained and know where to get additional support.

Fundraising Regulator: cash collections: cash collections | Fundraising Regulator

Published 20 October 2025