Can POS devices really generate random numbers? I am doing an implementation of a system designed by a payment company and I am a little skeptical about the way they have designed the end to end cryptography.

The system is as follows:

There are three parties in the data exchange


Sending party (A)
Switching party (B)
Receiving party (C)


Party (A) is a POS device having a very little computing power. 
Party (B) is the payment company 
Party (C) is an authorizing institution

On the POS device, biometric data is captured and POS device have a public key of (B). The POS device will generate a random 128-bit key and encrypt data using this key and then again encrypt the entire dataset with public key of (B) and send it to (B).

Party (B) also maintains symmetric keys for party (A) and (C). Once it has data from party (A) it decrypts it and then encrypts the data set using symmetric key of party (c) and sends it.

Party (C) will use its key to decrypt the data first and then uses 128-bit key received from dataset to decrypt the remaining data.

My concerns on this methodology is: Can POS devices really generate a random number?
Modern POS devices are designed to meet the strict security requirements of payments industry (search for PCI-DSS standards). They are typically based on a SoC designed specifically for secure payment applications. An example of such SoC:
https://www.broadcom.com/products/embedded-and-networking-processors/secure/bcm5892/#overview

From the datasheet:
"The random number generator (RNG) is a true random source. It utilizes free-running oscillators to capture thermal noise as the source of randomness. It has been used in numerous devices (such as BCM5820, BCM5821, BCM5841, or BCM5890) and been evaluated as a valid source for seeding FIPS approved pseudo-random number generators as the initial secret value"

If the POS in question runs Linux - it's fairly new, but if in doubt you can always query its vendor directly.