What the eTIMS CU PIN Is (and Is Not)
The CU PIN (Control Unit PIN) is the local security code that authorises invoice issuance on your eTIMS device. Think of it like the PIN on your bank card - it proves the person pressing “issue invoice” is authorised to do so on this specific device.
The CU PIN is different from three other credentials you use with KRA:
KRA PIN (11-digit Personal Identification Number)
Your tax identity number on iTax. Used to log into iTax and eTIMS Lite. Not a password.
iTax Password
The password you use to log into itax.kra.go.ke. Also used for eTIMS Lite. Different from CU PIN.
eTIMS Client Login PIN
Some versions of eTIMS Client ask for a separate login PIN before you can use the app. This is also different from the CU PIN - the CU PIN is asked at the moment of invoice issuance, not at login.
The CU PIN was set in one of three places:
- By the device supplier during onboarding - you should have received a PIN slip or welcome email with the PIN written on it.
- By you the first time you logged into a new eTIMS Client installation - the app asked you to set a PIN and confirm it.
- By KRA support during a remote reactivation - they generate a temporary PIN and SMS it to your registered phone number.
Lost the PIN slip? Email your device supplier with the device serial and KRA PIN - they should have a record of the original PIN. If they cannot find it, only KRA eTIMS support (020 499 9999) can reset it. Never call back “PIN reset services” advertised on social media - they are scams.
Why the CU PIN Shows “Invalid”
Three root causes - ranked by frequency based on the cases we see:
You are typing the wrong PIN
Most common. The supplier's PIN slip is hard to read (a 5 can look like a 6, an 8 can look like a 0). Or a staff member set a new PIN and did not tell you. Check the original PIN slip - if you cannot find it, ask whoever in your team did the eTIMS onboarding what PIN they set.
The PIN was reset remotely without notice
KRA or the supplier can reset the CU PIN after a security event (a reported stolen device, a firmware update, a forced re-registration). They are supposed to SMS the new PIN to your registered phone, but SMS delivery from KRA is unreliable. If you have not invoiced in 2+ weeks and suddenly the PIN does not work, suspect a remote reset.
Temporary lockout from failed attempts
After 5 consecutive wrong PIN attempts, the device locks you out for 15-30 minutes. The error message usually says 'PIN locked, try again later' but some older OSCU models just show 'PIN invalid' even during the lockout period. Wait 30 minutes before trying again - do not keep guessing.
Firmware glitch after a power cut
Rare but real: a sudden power loss while the device is mid-authentication can corrupt the local PIN cache. The device starts rejecting every PIN. The fix is a soft reset (power off for 60 seconds, power on). If the soft reset does not work, the device needs a supplier hard reset.
Failed Attempt Lockouts - The Escalation Ladder
eTIMS uses a three-tier lockout system to slow down PIN guessing. Knowing which tier you are in tells you how long to wait before retrying.
| Failed attempts | Lockout tier | Wait before retry | What to do |
|---|---|---|---|
| 1-4 | None | Immediate | Check PIN slip, try again slowly |
| 5 | Temporary lockout 1 | 15-30 minutes | Stop. Find the PIN slip. Do not guess. |
| 6-10 (after Tier 1) | Temporary lockout 2 | 1-2 hours | Call supplier to confirm PIN |
| 11+ or 3x Tier 2 | Permanent lockout | Until KRA hard-reset | Call KRA 020 499 9999, request hard reset |
Do not factory-reset the device yourself
Some internet forums suggest pressing a hidden reset button on the OSCU. This permanently disables the device and voids the supplier warranty. The only safe reset is one performed by KRA or an authorised supplier with the device serial registered on KRA’s side.
How to Reset the CU PIN
The reset path depends on whether you know the current PIN or have forgotten it.
If you know the current PIN
- 01Open eTIMS Client (or OSCU menu on the device)
- 02Navigate to Settings → Security → Change CU PIN
- 03Enter the old PIN, then the new PIN twice
- 04Submit. The new PIN takes effect immediately - test with a KES 1 invoice.
If you have forgotten the PIN
- 01Email your device supplier with the device serial and KRA PIN. Ask them to confirm or reset the CU PIN.
- 02If the supplier cannot help within 48 hours, call KRA eTIMS support on 020 499 9999.
- 03Have these ready: KRA PIN, device serial, ID number, business name, and the date you bought the device.
- 04KRA will log a reset request. The new PIN is sent via SMS to your registered phone within 1-5 working days.
- 05When you receive the new PIN, log in and immediately change it to something you can remember.
Need a faster PIN reset?
We have direct contacts at the major eTIMS device suppliers and at the KRA eTIMS desk. We can usually get a PIN reset done in 24-48 hours instead of the standard 5 working days. Send us the device serial and KRA PIN by email.
Get PIN Reset HelpHow to Invoice While Waiting for a PIN Reset
A CU PIN reset can take up to 5 working days. You do not need to stop invoicing - use one of these two workarounds:
Use eTIMS Lite web portal
Log into etims.kra.go.ke with your KRA PIN and iTax password. eTIMS Lite does not ask for the CU PIN - it uses your iTax password instead. You can issue invoices online one at a time. Each invoice takes 2-3 minutes to generate. They are fully KRA-compliant and appear in real-time on KRA's servers.
Issue a manual VAT invoice and transmit later
Write or print a manual tax invoice with: invoice number, date, your business name + KRA PIN + VAT number, customer name + PIN, item description, quantity, unit price, VAT rate (16%), VAT amount, total. Keep a copy. When the CU PIN is reset, you can either re-enter these as historical invoices in eTIMS Client (with the original invoice date) or transmit them via eTIMS Lite.
Avoid the temptation to skip invoicing. If you stop issuing invoices while waiting for the PIN reset, you create a gap in your sales record that KRA can detect in your auto-populated VAT return. Even manual invoices must be issued and recorded - see our eTIMS invoicing guide for the manual invoice format.
Frequently Asked Questions
What is the eTIMS CU PIN?
The CU PIN (Control Unit PIN) is a 4-8 digit security code that authorises invoice issuance on an eTIMS OSCU/VSCU device or on the eTIMS Client app. It is separate from your iTax password and your KRA PIN. The CU PIN was set by the device supplier during onboarding, or by you the first time you logged into eTIMS Client. Without the correct CU PIN, the device will not generate or transmit invoices.
Why is my eTIMS CU PIN showing as invalid?
Three reasons: (1) you are typing the wrong PIN - check the original PIN slip from the supplier or the welcome email; (2) the PIN was reset remotely by KRA or the supplier after a security event and you were not notified; (3) you have entered the wrong PIN multiple times and the device has temporarily locked you out (usually 15-30 minutes) before you can try again.
How many failed CU PIN attempts before lockout?
Most eTIMS devices enforce lockout after 5 consecutive failed PIN attempts. The first lockout is temporary (15-30 minutes). After 3 temporary lockouts, the device enters a permanent lockout that requires KRA eTIMS support or your device supplier to reset. Do not keep guessing - each wrong attempt adds to the lockout counter.
How do I reset my eTIMS CU PIN?
If you know the current PIN: log into eTIMS Client or the OSCU menu, open Settings > Security > Change CU PIN, enter the old PIN, then enter the new PIN twice. If you have FORGOTTEN the PIN: only the device supplier or KRA eTIMS support (020 499 9999) can reset it. You will need your KRA PIN, device serial, and ID document. Resets take 1-5 working days depending on the supplier.
Can I still invoice while waiting for a CU PIN reset?
Yes, with two workarounds. (1) Use eTIMS Lite web portal (etims.kra.go.ke) to issue invoices online - it uses your iTax password, not the CU PIN. (2) Issue a manual VAT invoice with a serial number and transmit it via eTIMS Lite later. Both are fully KRA-compliant. The OSCU device stays unusable until the PIN is reset.
What happens if I permanently lock the CU PIN?
The device becomes unusable until KRA's back office performs a hard reset. This requires a physical visit to a KRA office or a formal request through your device supplier. Hard resets take 7-21 working days. During this time, you can still use eTIMS Lite. Do not attempt to factory-reset the device yourself - this can permanently disable it and void the supplier warranty.