UL 291 Automated Teller Systems

The UL 291 Automated Teller Systems standard, developed by Underwriters Laboratories (UL), describes requirements covering the construction and safety of equipment designed to automatically dispense cash when operated as intended by an authorized customer, and providing limited protection against unauthorized cash withdrawals. If the product also accepts deposits, the same level of protection must be provided for deposit transactions as well.

Records must be kept so that the authorized customer can be credited for the money dispensed. Limited protection should be provided against unauthorized manipulation or destruction of records, which would prevent correct crediting. The teller/cashier dispensing the money is not required to keep records.

These requirements cover products designed for permanent connection to branch circuits with a potential of 600 Volts or less, and products designed for cable connection to branch circuits with a potential of 300 Volts or less. Branch circuits and the methods used to supply units from them must comply with the National Electrical Code (NEC) and ANSI/NFPA 70 standard.

UL 291 is a widely recognized safety standard today. It specifically addresses the structural, electrical, and physical safety of automated teller systems, primarily ATMs and similar cash dispensing equipment.

This standard includes requirements for equipment that automatically dispenses cash when operated by an authorized user (e.g., via a valid card and PIN). It provides limited protection against unauthorized cash withdrawals through forced entry or tampering.

The key points covered by this standard are as follows:

It includes both self-service ATMs and teller cash dispensers (although the latter have fewer record-keeping requirements).
This applies to products connected to branch circuits up to 600 Volts (permanent connection) or up to 300 Volts (wired connection), in accordance with the national electrical code.
The structure focuses on (materials, design), electrical safety, and security against physical intrusions.

The UL 291 standard defines different levels of protection for the ATM depending on its operating environment and risk exposure:

Service hours: The lowest level (typically a 5-minute attack test) is suitable for machines unloaded overnight.
24-hour service level 1: Medium level protection.
24-hour service Level 2: Highest resistance.

Tests simulate real-world attacks using tools such as crowbars, drills, or other implements. A common industry reference is that many ATMs should be resistant to forced entry for approximately 15 minutes with basic tools (often informally expressed as 15 minutes and a crowbar). Exact requirements vary by level.

UL 291 certification indicates that the equipment has undergone rigorous testing in the following areas:

Resistance to theft (physical attack on the safe/cash container).
Fire resistance.
Environmental resilience.
Electrical safety.

Therefore, many financial institutions and ATM manufacturers require or refer to UL 291 standard compliance, especially in high-risk areas.

Practical applications of this standard include:

ATMs: Primary application.
Cash recycling machines, cash processing kiosks, or other automated dispensing systems.
It is often used in conjunction with insurance requirements or burglar alarm standards (for example, the “UL 681 Installation and classification of burglar alarm systems” standard applies to alarm systems).

In the kiosk sector, manufacturers sometimes make non-ATM cash processing devices compliant with the UL 291 standard for similar security expectations.

The reason the UL 291 standard exists is that ATMs handle large amounts of cash in public (or semi-public) locations, making them attractive targets for physical attacks by criminals seeking quick, high-value gains. Without standardized and tested physical security requirements, these machines become far more vulnerable to theft, leading to significant financial losses, property damage, security risks, and disruptions to banking services.

In general, ATMs have long been targeted using brute-force methods. These include:

Crashing and grabbing attacks: Using stolen vehicles, forklifts, or heavy equipment to crash into buildings, dislodge ATMs from their foundations, and then transport them for destruction.
Break-and-grab attacks: Smashing shop windows or directly attacking machinery with tools.
Using explosive or gas attacks.
Using crowbars, drills, levers, and other hand tools to force their way into the cash register.

Even unsuccessful attacks can cause costly damage to buildings, shops, or gas stations, sometimes far exceeding the value of stolen cash. In short, ATMs are an attractive target for criminals. Many attacks are designed to last less than a minute, representing potential profit.

In conclusion, the UL 291 standard remains a fundamental standard for ensuring that ATMs and similar devices are manufactured with reasonable safety measures against theft and electrical hazards, helping to protect both financial institutions and the public in the widespread age of self-service banking.

For many years, our organization, with its competent and experienced team, has been understanding the needs of its clients, providing the advanced testing services they require, and assisting them in the establishment, implementation, and improvement of management systems. Within this framework, we also provide testing services compliant with the UL 291 standard.