The Use of Quick-Response Codes in Payments | A

FOCUS NOTE

THE USE OF QUICK-RESPONSE

CODES IN PAYMENTS
Part of the World Bank Fast Payments Toolkit

SEPTEMBER 2021
B | Fast Payment Systems: Preliminary Analysis of Global Developments

CONTENTS

1. SETTING THE CONTEXT   1

2. BACKGROUND  2
3. QR CODE USE CASES   4
4. CONSIDERATIONS  5
4.1. Security Considerations  6
5. TYPES AND USE CASES   7
6. QR CODE COMPONENTS   10
7. QR CODES IN THE CONTEXT OF FPS 11
8. QR SPECIFICATIONS 12
8.1. Customization of EMVCo’s Specifications  14
8.2. Alipay’s Specifications  14
8.3. EMVCo and Alipay—A Quick Comparison  15
8.4. Considerations while Arriving at QR Code Specifications  15
9. APPROACH TO STANDARDIZATION   18
10. CROSS-BORDER PAYMENTS VIA QR CODES   20
11. CONCLUSION  22
12. ACKNOWLEDGMENTS  23
13. APPENDIX  24

FINANCE, COMPETITIVENESS & INNOVATION GLOBAL PRACTICE

Payment Systems Development Group

© 2021 International Bank for Reconstruction and Development / The World Bank
1818 H Street NW
Washington DC 20433
Telephone: 202-473-1000
Internet: www.worldbank.org

This volume is a product of the staff of the World Bank. The findings, interpretations, and conclusions expressed in this
volume do not necessarily reflect the views of the Executive Directors of the World Bank or the governments they represent.

The World Bank does not guarantee the accuracy of the data included in this work. The boundaries, colors, denominations,
and other information shown on any map in this work do not imply any judgment on the part of the World Bank
concerning the legal status of any territory or the endorsement or acceptance of such boundaries.

RIGHTS AND PERMISSIONS

The material in this publication is subject to copyright. Because the World Bank encourages dissemination of their
knowledge, this work may be reproduced, in whole or in part, for noncommercial purposes as long as full attribution
is given.
1 SETTING THE CONTEXT

The World Bank has been monitoring closely the development of fast pay-
ment systems (FPS) by central banks and private players across the globe.1
This comprehensive study of FPS implementations has resulted in a policy
toolkit. The toolkit was designed to guide countries and regions on the likely
alternatives and models that could assist them in their policy and implemen-
tation choices when they embark on their FPS journeys. Work on the FPS
Toolkit was supported by the Bill and Melinda Gates Foundation. The toolkit
can be found at fastpayments.worldbank.org and consists of the following
components:

• The main report Considerations and Lessons for the Development and
Implementation of Fast Payment Systems
• Case studies of countries that have already implemented fast payments
• A set of short focus notes on specific technical topics related to fast
payments

This note is part of the third component of the toolkit and aims to provide
inputs on quick-response (QR) codes from a payments perspective, with a
focus on fast payments. This topic is of high relevance, as adoption of QR
codes has been widespread in recent years, including as part of FPS imple-
mentations, owing to the multifold benefits that QR codes provide to both
merchants and customers.

| 1
2 BACKGROUND

QR code is a two-dimensional (2D) barcode.2 It consists of information can be written and scanned, thus increasing
black squares arranged in a square grid on a white back- its data-storage capacity. 2D QR codes store data horizon-
ground. Imaging devices such as smartphone cameras tally and vertically and can be read from any angle, making
can be used to read and interpret these codes.3 QR code them more flexible. 2D QR codes are also known to be more
was created in 1994 by Denso Wave, a Toyota subsidiary, secure and prone to fewer errors.
to assist in the manufacturing process by tracking vehicles As mobile penetration increased, the initial push for QR
and parts.4 Efforts were made to enhance the barcode tech- code in payment services came from market players as a
nology to facilitate increased information storage, and after way to exchange the information required to initiate and/or
various modifications, QR code took shape. receive payments. QR codes are used either to convey the
2D QR codes differ from traditional one-dimensional (1D) account details of payees, or for payers to convey their pay-
barcodes primarily with respect to their information storage ment account details to the payee. In the former case, once
and flexibility components. the information is captured, a credit transfer to the payee is
Barcodes are scanned horizontally, so the data that can initiated. In the latter case, a request to pay (RTP) is initiated
be stored is limited to the single dimension. 2D QR codes, by the payee.
on the other hand, have an additional dimension in which

FIGURE 1 Barcode and QR Code

Barcode QR Code

2 |
 The Use of Quick-Response Codes in Payments | 3

QR codes have been prevalent in China since the early also leverage the QR code as a means of making transac-
2000s.5 Countries around the world have typically been tions through other payment instruments such as e-wallets.
introducing QR code as an overlay service to their existing Many financial institutions around the world, such as
mobile-payment options for cards and fast payments. QR banks, have been leveraging QR codes for a range of activi-
code is becoming increasingly common both among mer- ties, such as marketing and promotional initiatives in which
chants and customers, and it provides flexibility to support QR codes link customers to additional details on a particu-
the needs of both. Merchants and acquirers are attracted lar offer or scheme, provide details on social initiatives, and
to QR code primarily due to its low cost of acquisition and allow customers to download a particular mobile applica-
maintenance, in comparison with traditional point-of-sale tion to manage their bank account or credit card, among
devices or their equivalents. Smaller merchants typically others. QR codes can also be used for nonfinancial appli-
used to observe price as a barrier for digital payments, and cations within the payments application. For example, they
the introduction of QR code payments has lifted this barrier, can be used to link customers to entertainment portals and
leading to smaller merchants transacting digitally. The ongo- to assert their identity and authentication.
ing maintenance expenses for merchant-presented QR code Regulators and central banks around the world observed
are limited to reprinting the sticker in the event of wear and success in select Asian countries and are working toward
tear. Thus, the paper-based QR code (sticker) is cost effec- advancing QR payments to digitize cash and also promote
tive.6 Cost centers to operate QR codes would typically be financial inclusion. The Central Bank of Ghana recently
similar to those seen in other acceptance infrastructure, announced the launch of the Universal QR Code in a step
such as technology maintenance, security and fraud man- toward increased adoption of digital payments. PayPal has
agement, and dispute management and resolution. also recognized the benefits associated with QR codes and
The success of QR code use cases depends on their abil- rolled out QR code payments via its mobile application.7
ity to meet customer needs and enhance their experience. Similarly, WhatsApp has also introduced a new payment fea-
Scanning a QR code with a handheld device is easier than ture that enables users to transfer money by scanning QR
entering bank account details or using an alias, such as a codes.8
mobile number. Moreover, QR codes provide the flexibility QR codes have also seen increased uptake during the
of invoking various other peripheral services, such as redi- COVID-19 pandemic. Payments made via QR codes limit
recting to a merchant’s website or running promotional person-to-person contact and interaction and help com-
campaigns, apart from facilitating payments (for example, ply with social-distancing norms. QR codes are being used
bill payments, invoice payments, installment payments). to substitute for physical menus at restaurants, to provide
Such services attract both merchant and customer adop- access to information and forms to be filled out to enable
tion of QR codes owing to enhanced customer experience. contract tracing at restaurants and sporting events, and to
Additionally, customers without bank accounts/cards can allow access to and payment for public transportation.

FIGURE 1 Benefits of QR Codes

Low cost of acquisition User-friendly and Flexible enough to invoke Limits person to person
and maintenance provides enhanced peripheral services contact and facilitates
customer experience social distancing
3 QR CODE USE CASES

QR codes can serve as the initiation mechanism for both 7. Providing access to information and forms to be filled
push and pull payments, including at physical merchants, out to enable contract tracing at restaurants, sporting
in e-commerce transactions, for bill payments, and during events, and other venues
person-to-person transfers. The nonpayment-related sce- 8. Allowing access to and payment for public transporta-
narios in which QR codes can be used include the following:9 tion
1. Redirecting to a merchant’s website 9. Securing product/initiative details
2. Running promotional campaigns 10. Initiating a service request with a business
3. Allowing customers to download a mobile application to While the use cases related to payments can be standard-
manage their bank account or credit card ized from the perspective of a unified customer experience
4. Linking employees to entertainment portals and security aspects, the nonpayment-related use cases can
5. Authenticating ID cards of employees at workplaces typically be proprietary.

6. Substituting for physical menus at restaurants

4 |
4 CONSIDERATIONS

Despite the multiple advantages of QR code payments, penetration, and merchant distribution. These need to be
the following considerations may inhibit the growth of this addressed to enhance the success of this access channel.
channel:
• The lack of harmonization and interoperability of QR
• QR code payments may be subject to legacy bias. While specifications could affect customer experience. Because
QR payments are gaining popularity in emerging mar- multiple providers have their own QR codes, consum-
kets, their growth has been slow in some more devel- ers are required to use multiple applications to transact
oped markets, such as the United States and Australia, with different merchants. This could be cumbersome
where consumers and merchants have a predisposition and time consuming, and it could deter consumers from
toward card-based or tap-and-go payments. Neverthe- transacting via QR codes. There should also be a focus on
less, there is growth potential in these markets, owing to user-journey standardization for both end users (registra-
the scope for innovation offered by QR codes. tion, scanning, and final payment) and merchants (regis-
tration, payment confirmation, and final reconciliation),
• It is critical to establish the benefits of digital payments
as the learning curve is significant when using the ser-
in general over cash to facilitate adoption by merchants.
vices of a particular payment service provider (PSP). This
This could be accomplished by emphasizing the cost of
keeps users and merchants from switching to a different
handling cash versus digital payments—QR code pay-
PSP and discourages healthy competition among PSPs.
ment costs are potentially lower, depending on how the
acquirers structure their pricing—or by promoting addi- • A delay in the onboarding process due to know-your-
tional merchant services in conjunction with QR pay- customer compliance, document collection, verification,
ments, such as insurance and payment reconciliation, and updates will apply for QR code-based acceptance
among others. In this regard, countries such as Mexico and can be a challenge for prospective merchants and
have introduced QR payments with no fees for the mer- acquiring entities, such as payment aggregators and
chant, to replicate the perceived benefits of cash while acquiring banks.
encouraging merchants and consumers to enter the dig-
• Language and currency may be a constraint even with
ital ecosystem.
interoperable QR codes. Supporting multiple currencies
• QR code merchant payments have several key enablers and languages can be explored to ensure that customers
and interdependencies, such as device affordability, in different countries can work in their native languages
given the need for smartphones for the most seamless and currencies.10
experience, internet connectivity, wallet/bank account

| 5
6 | The Use of Quick-Response Codes in Payments

• PSPs need to bear in mind that, to expand into rural areas, • Third-party entities can conduct the security test and
they may have to spend more time, money, and effort security audit of the application being used for QR code–
disseminating training material and building awareness based payments.14
among merchants and customers.
• Person-to-business QR scans should display meaningful
• There may be restrictions on who can develop QR user-friendly names to the payer. Generic names such as
functionalities. For example, in Mexico, merchants and “Verified Merchant” or “<Payment app> Merchant” make
developers that want to develop solutions for CoDi (FPS it difficult to build trust in the system and may lower mer-
service in Mexico) have to go through a special process chant and customer experience.15
that includes generating a letter of intent and a business
• EMVCo believes that the security principles for QR
case, signing a confidentiality agreement, and certifying
codes should be similar to those for any software-based
the solution with Banco de México.11
mobile-payment mechanism. On this basis, the typical
layered approach should be considered depending on
the implementation itself, with data-at-rest security,
4.1 SECURITY CONSIDERATIONS
data-under-processing security, and data-transmission
Security aspects related to QR codes, including fraud com- security.
mitted by replicating the QR code, identity impersonation, • To drive security and reduce fraud, similar to what hap-
and data protection, need to be carefully assessed. Invest- pens with a contactless transaction, the EMV16 QR code
ments in back-end security are necessary to ensure secure specification does not transmit any confidential infor-
data transmission and storage. There should be adequate mation.
focus on monitoring and enhancing security at the physical,
network, and application infrastructure levels.12 Additionally, Ant Group has been working with experts from
different markets in ISO/TC68 Financial Services/SC2 Secu-
• Payment applications should provide users with a deeper rity/WG19 Security on aspects of code-scanning payment,
understanding of security. The merchant name and to establish the new ISO 5201, an international standard on
masked credentials can be displayed in the app after financial services for code-scanning payment security. The
scanning a QR code, to enable safe transactions.13 standard17 covers security issues related to code-scanning
• Details of a payment transaction should be displayed for technologies used for payments and includes an overview,
validation before a payment is processed. The service a risk assessment, and minimum security requirements and
should also be complemented by real-time notifications extended security guidelines for code-scanning payment,
to both the payer and the payee. where the payer uses a device to operate the payment
transaction. The standard is applicable to cases where the
• Steps should be taken to verify the identity of the payee, code is both used to initiate a payment transaction and pre-
particularly when the QR codes are used in an RTP sented by the payer or the payee.
framework.
5 TYPES AND USE CASES

QR codes are classified based on two broad dimensions: the a point-of-sale terminal or smartphone to initiate push
type of information (static or dynamic) and the presenter payments by scanning the QR code. Dynamic QR is more
of the code (that is, merchant or consumer). The following secure, and cryptographic techniques and time stamps
types and use cases of the QRs are based on these dimen- can be applied for verification. Select use cases have
sions. been highlighted below.

• Merchant-presented static QR code: These QR codes – Merchant-presented dynamic QR codes could be

contain a fixed (static) set of data and cannot be overwrit- used to prefill transaction-dependent data, such
ten once generated. They are presented by merchants to as the transaction amount and details of goods, to
consumers to initiate payments by scanning the QR code. enhance the payment experience.
QR code payments usually tend to kick-start with this cat- – They could be used in promotional campaigns as
egory of QR codes, and they have been observed to be promotional codes that are circulated via email or
especially suitable for emerging markets and small mer- text message and entitle customers to a discount.
chants, as they are cost effective. (The cost is usually that The QR code can be displayed at a store, and the
of printing the QR code sticker.) In markets dominated by discount can be taken while making a purchase.
feature phones, customers who use feature phones that
– They could become an entry point to various kinds
cannot scan QR codes can manually key in the number
of value-added services, as merchants can push their
printed adjacent to the merchant’s QR code sticker (for
own digital services using these codes. For example,
example, the merchant ID) to initiate a USSD dialogue
scanning a QR code at a restaurant could lead to a
to complete the transaction.18 However, there are limita-
menu through which customers could place their
tions with such stickers related to security and constraints
orders and make payments digitally.
for offering value-added services owing to their static
nature. To overcome these limitations, dynamic QR codes While the use cases listed above are for merchants, similar
came into force. use cases may also be used for person-to-person transac-
• Merchant-presented dynamic QR code: These QR tions. Specifically, QR codes can act as a person-to-person
codes are generated dynamically and thereby provide transfer code that allows one person to collect or request
the option of customizing/changing data for each scan money from another person. QR codes are also becoming
(for example, transaction-specific data such as the trans- increasing popular in advertisements as means of offering
action amount and transaction cryptogram). Such QR access to additional product details, redirecting readers to a
codes are presented by merchants to consumers through page with a video/trailer, and facilitating e-commerce trans-

| 7
8 | The Use of Quick-Response Codes in Payments

FIGURE 3 Payment Flow for Merchant-Presented QR Code

NETWORK
3 Transaction initiation

4 Transaction outcome

MOBILE TRANSACTION POI MERCHANT ISSUER

2 Scan 4 Transaction outcome

PAYMENT NETWORK
1

Displays Displays Point of Initiation (POI)

transaction transaction generates QRC based
result result on merchant details
ACQUIRER

1 Merchant generates and displays QR code based on merchant details

2 Consumer scans QR code using a mobile application to initiate the transaction, with CDCVM if required
3 Mobile application sends the transaction initiation request to the Network
4 The Network processes the transaction and informs the Merchant and the Consumer of the transaction outcome

Source: EMVCo

actions. Consumers can scan QR codes displayed at check- • Consumer-presented QR code: These QR codes are
out during an online transaction instead of providing card generated by consumers (payers) on their smartphones,
details. Consumers can also scan the QR code associated and the merchant uses an optical scanner to scan them.
with a product in a store and save the code in their cart to The consumer-presented mode (CPM) has fewer oper-
purchase later. Social networks, such as WhatsApp, are also ational steps on the consumer side and brings more
leveraging QR code scanning to make it easy for customers control on the merchant side. It is important for consum-
to initiate conversations with businesses that have official er-presented QR codes to be dynamic and to have short
WhatsApp accounts. expiration times, to prevent fraud and control risks. This
Typically, only a few steps are involved on the merchant’s mode may be less suitable for regions with low smart-
end to generate and display a QR code. As an illustrative phone penetration. Select use cases have been high-
example, the following steps are involved for a merchant to lighted below.
generate the Bharat QR Code (India): – Consumer-presented QR codes can be used to make
1. Have a bank account payments for transportation, such as on buses or
trains, by placing the QR code in front of an installed
2. Link bank account with the BHIM application19 scanner.
3. Generate unique Bharat QR Code from the BHIM appli- – Large merchants that wish to upgrade to newer
cation devices for scanning 2D QR codes or that wish to
reuse existing barcode-scanning equipment to scan
4. Print the QR code and paste it inside the store in a place
1D barcodes20 prefer this type of QR code imple-
where it is clearly visible and convenient for customers to
mentation.
scan using their mobile phones
 The Use of Quick-Response Codes in Payments | 9

FIGURE 4 Payment Flow for Consumer-Presented QR Code

Consumer presented

PAYMENT
MOBILE QR Code POI ACQUIRER NETWORK ISSUER
APPLICATION Reader MERCHANT
Auth request
with EMV data
Scan
Auth response

Transaction
result Decode QR and
extract chip data

Source: EMVCo

1D barcodes have been adopted in multiple markets, typ- The QR code solution provider can provide the option
ically in combination with a 2D QR code containing the of using different sources of funds to make payments. The
same information, so that merchants can accept digital wallet/mobile app used by consumers typically asks them to
payments using the most convenient equipment. China is select their preferred payment method. In India, the BHIM
an advanced market where 1D barcodes for consumer-pre- QR code can be used to make payments via a mobile wal-
sented modes of payment are widely accepted, and the use let or a bank account linked to the wallet, while the Bharat
of both merchant-presented and consumer-presented QR QR Code can be used to make payments through a bank’s
codes is expanding as well. application via a debit or credit card offered by the bank.
Merchants accept payments through one or a combina- Some QR codes have a four-party scheme, where four
tion of the above types. While the static QR codes offer basic roles are involved in the payment flow: a customer, the
functionalities, dynamic QR codes expand the offerings and provider of the consumer digital wallet, the acquirer of a
provide heightened security. Additionally, the dynamic mer- merchant, and the merchant. If the digital wallet and the
chant-presented mode (MPM) has the potential to offer acquirer are different institutions, it is called the four-party
richer services and functionalities, whereas CPM reduces scheme. Others have a three-party scheme; when the digital
the steps on the consumer side. Overall, the merchant-pre- wallet provider and the acquirer in the payment flow are the
sented QR code has been taken up more prominently in same institution, it is called the three-party scheme.
countries around the world, while the consumer-presented
QR code is more common in urban areas of more advanced
QR markets, such as China.
6 QR CODE COMPONENTS

The data components of QR codes differ for card transac- users can choose from different sources of funds accessible
tions, for mobile-money payments, and for fast payments. from their mobile-wallet application—for example, a wallet
The differences in the payment methods can be elaborated balance, a debit card, a credit line, promotional benefits, or
with the following scenarios:21 a combination.

Card-based transaction: In the case of the UnionPay solu- Fast Payments: In the case of PromptPay (Thailand’s QR
tion used in China (card token) pertaining to CPM, both code), which supports only MPM, the bank account of the
barcode and QR code are supported. In the case of EMVCo payee is contained in the code. The payer can choose from
solution, only QR code is supported, but card token and chip their linked bank accounts to pay. Inter-bank transfer and
information can be used. collection is possible based on PromptPay network infra-
structure.
Mobile-money (or wallet-based) transaction: An MPM
code contains the merchant’s identifier, and a CPM code
contains the user’s account token. When making a payment,

10 |
7 QR CODES IN THE CONTEXT OF FPS

QR code is an access channel that can accommodate differ- An advantage that QR codes offer is that they lie at the
ent types of payments, which are cleared in different types interface. They allow the flexibility of following a phased,
of systems and not limited to FPS. QR-based payments modular approach and making changes and innovations
are predominantly used in the retail environment—that is, at the interface without making many changes at the back
where a consumer pays a merchant for goods/services pro- end, due to their limited link with FPS. Many countries have
vided (usually in store yet possibly online). For such payment included the QR code access channel as an overlay service or
flows to add value, the merchant should receive a (nearly) an application over the FPS. Countries that offer the QR code
instant confirmation of payment to be willing to hand over access channel through overlay mobile applications include
the goods/services to the consumer. The most evident way Australia (Osko), Mexico (CoDi), and Singapore (PayNow).
to accomplish this is the scenario in which instant confirma- The security of the physical point of sale has been
tion follows the actual instant transfer of funds—that is, as is strengthened over time, and similar security measures for
the case in a FPS. QR codes are evolving. One of the techniques adopted for
Over the last few years, FPS globally are introducing QR ensuring security is checking for modifications in the QR
code as an access channel. As early as 2011, Alipay launched code by comparing merchant data on the server side and
a code-scanning payment product in China. Due to its low seeking confirmation from the customer that the merchant
usage cost and good user experience, it soon became pop- is the one the customer wishes to pay. A similar technique
ular in China and has been adopted by more and more dig- is applied in India’s Unified Payment Interface (UPI) using
ital wallets. Subsequently, in 2014, WeChat also launched a a signed QR functionality, wherein the QR code signed
code-scanning payment product, further popularizing QR by the merchant using its private key is verified using the
code in China. Countries such as Australia, Bahrain and Mex- merchant’s public key in UPI, and the customer is notified
ico offer merchant-presented QR capabilities, while a few in case of discrepancies. It is important that security mea-
countries, such as China, India, Malaysia, and Thailand, offer sures are applied at the back end through risk engines that
both merchant-presented and consumer-presented QR analyze transactions that have passed through the system.
capabilities. Mexico and Hong Kong SAR, China are con- Security risks should be identified throughout the entire
sidering consumer-presented QR codes in their road map. process of scanning and making payments. Adequate
Adoption of this channel is observed to be picking up in focus should also be given to application and back-end
most developing countries. payment system security.

| 11
8 QR SPECIFICATIONS

Various QR specifications are being adopted by different There are predefined data fields for the transmission
systems (for example, FPS, mobile-money operators, and of data between the reader and provider. The EMV mer-
card schemes). Some FPS, such as PromptPay in Thailand, chant-presented QR code specification defines existing
FPS in Hong Kong SAR, China, PayNow in Singapore, and fields, including card-based and account-based payments,
Osko in Australia, have based their QR specification on EMV- and allows other payment-solution fields to be added to
Co’s QR specifications. accommodate different use cases. Another key reason for
EMVCo’s specifications are publicly available for countries using EMVCo’s QR specification has been enabling future
to adopt and flexible enough to accommodate different use interoperability, as these specifications are being adopted
cases and to cater to local and business needs. The specifi- by various operators and participants.
cations can be adapted to many payment systems and are Similar to chip transactions, EMVCo defines a set of data
available royalty free on the EMVCo website.22 For example, that could be included in QR codes (merchant presented
in Singapore, by reading the same QR code, a consumer and consumer presented), but the data always depends on
can select the best way to pay from eight payment systems, the use case and the implementation.
both international and domestic. (See figure 5.) The brand The EMV merchant-presented QR code includes the fol-
logos indicate to the consumer which payment system/ lowing information:23
application can be used for the QR code.
• The conventions used for the QR code content, such as
FIGURE 5 Example of QR Code in Singapore the Payload Format Indicator, which defines the version
of the QR code template and hence the conventions on
the identifiers, lengths, and values
• Merchant account information, including information
about the merchant account
• Additional information about the merchant, such as its
name, city, and postal code
• Information about the transaction value, if known, such
as the amount and currency
• Additional data in support of various use cases, such as
the bill number, mobile-phone number (of the merchant
or customer), and the purpose of the transaction

12 |
 Quick-Response Codes | 13

BOX 1 EMVCo’s QR CODE SPECIFICATIONS

EMVCo is an organization that facilitates interoperability are different. The CPM is in line with EMV’s four-corner
and secure payment transactions. Its activities are over- model, where the QR code is used to transmit consumer
seen by its six member organizations: American Express, data, similar to how it is done with a mobile phone/con-
Discover, JCB, Mastercard, UnionPay, and Visa. EMVCo tactless card. The MPM does not necessarily follow the
commenced its QR code payment activity in 2016. It four-corner model, and the list of data to be transmitted
has developed QR specifications for QR code payments is different. However, the high-level format for the two
to promote global interoperability and security. Dozens is the same: IDLV (IDentifier, Length, and Value). Many
of organizations from around the world participate as countries have already established or are in the process
EMVCo associates and subscribers, contributing their of establishing their QR specifications based on EMV-
knowledge and expertise to the EMV specifications. Co’s specifications and incorporating their own coun-
EMVCo’s CPM and MPM specifications support both try-specific customizations. EMVCo has seen growing
static and dynamic QR codes. For CPM, the solution is interest in the EMVCo specifications in Africa, Europe,
compatible with EMVCo’s existing payments ecosystem Asia, and South America.
and infrastructure. The specifications for the two modes

In the case of EMVCo’s CPM,24 the high-level functionality In India, Bharat QR Code is based on EMVCo merchant-
of various components of the QR code-processing architec- presented QR standards, which allow interoperability
ture on the consumer device is summarized below. across banks and card schemes. It supports all card pay-
• Mobile application/wallet: A consumer-facing user inter- ment network credentials and has provisions for domes-
face application provided by the issuer, merchant, or a tic payment methods, such as UPI/proprietary payment
third-party and provisioned to the consumer’s mobile methods.27 A similar case is that of the QR code standards
device. It includes the functionality to encode the pay- established in Nepal.28
ment credentials based on this specification and then In Hong Kong SAR, China, EMV QR standards were
displays the resulting QR code. adopted because they are well established and ensure eas-
ier interoperability. They would make it easy for other PSPs
• QR code payload: The payload, consisting of a perma-
to migrate their QR code standards to the one common
nent account number, payment token credentials, and/
QR code. Not much localization or customization is needed
or other data, converted to base 6425 and encoded in a
to the EMV standard QR code. EMVCo focuses on the data
QR code.
transmission. The format specified by EMVCo provides
The merchant device has the following two components:26 a way to encode QR code data that is flexible, to accom-
modate all needs, including the support of proprietary QR
• QR code reader: Scans the QR code, decodes it, and
code. EMVCo’s specifications are flexible enough to add as
sends the data recovered to the point-of-interaction sys-
many data fields that a country may wish to add. The com-
tem. This data constitutes the base 64–encoded QR code
pany also has a process in place to adapt specifications to
payload.
specific needs, and it is open to discussions with stakehold-
• Point-of-interaction application: The application devel- ers when needed. EMVCo will consider any changes to or
oped by the point-of-interaction vendor to process customizations of specifications, to avoid a negative impact
the base 64–encoded QR code payload. Its functions on interoperability and security. EMVCo’s QR specifications
include decoding the base 64 payload, parsing the data, also have scope to accommodate future requirements. The
checking the content and format, and processing the specifications are dynamic and can be updated based on
transaction. market needs and feedback received.
14 | The Use of Quick-Response Codes in Payments

8.1 CUSTOMIZATION OF EMVCO’S SPECIFICATIONS vi. Payer validates and accepts the payment for the RTP;
thus, the transfer order is generated.
Customization of EMVCo’s QR code, in the MPM, includes
customizations of the merchant ID, merchant category vii. The transfer order is settled—through the Interbank
code, transaction currency, and language. Customization Electronic Payment System (SPEI) or in the financial insti-
also refers to, and varies according to, each payment system tution’s core system if the payer and payee accounts are
supported. Details of select QR code payment platforms in the same financial institution—and the financial insti-
with customized specifications have been provided based tutions for the payee and payer are notified.
on findings from stakeholder interviews. viii. Payee’s financial institution notifies CoDi’s platform
For instance, custom-built specifications were preferred when the payee’s account has been credited.
for Mexico’s CoDi, to cater to customized needs. While the
strengths of existing specifications, including those pre- ix. CoDi’s platform sends a push notification to the financial
scribed by EMVCo, were acknowledged, CoDi developed its institution’s apps (payee and payer).
specifications to account for enhanced security measures. The specific security aspects on which Banco de México
Existing specifications were observed to be designed to focused included enhanced security to avoid the imperson-
cater to the needs of more developed countries with limited ation of an individual or business entity; enhanced security
fraud. The main differences between CoDi specifications to avoid an information security breach through the encryp-
and EMVCo’s specifications are the encryption capability tion of RTP messages; the elimination of the possibility of a
and representation format (json). Complete data encryption name change in an RTP message by carrying out onboard-
is not supported by EMVCo. To avoid the alteration of data, ing through an electronic certification; and higher message
including the account number and recipient’s name, CoDi’s sizes in ISO standards compared with proprietary standard.
QR codes are encrypted and generated only by previously CoDi’s specifications support both static and dynamic mer-
validated users. Given that CoDi’s QR codes are encrypted, chant-presented QR code. The development of consum-
the payee is required to send a request to the CoDi platform er-presented QR code is in their future road map.
for validation in order to process the payment. As part of Although both Singapore and Thailand are using EMV-
that process, the CoDi platform also validates that CoDi’s QR Co’s standards to define QR specifications, the countries
codes correspond to the agent that requested the payment have made several customizations based on local require-
by validating the key on it. The transaction flow for a CoDi ments. This limits interoperability between the two QR spec-
QR code payment is below. ifications.29 As per the EMV QR code specification for MPM,
Payee generates an encrypted CoDi QR code, which con- merchant account information values 26 to 51 are reserved
tains an RTP message, using an app previously registered for any payment networks. On this basis, there are some cus-
and certified by Banco de México. Encryption involves the tomizations on Thailand’s QR specifications. However, the
use of a key available only to the payee’s RTP-generation allocation of these values is out of scope for EMVCo and must
app and CoDi’s platform. be agreed between the local payment systems that need
i. Payer scans a QR code using a financial app. such a value. Thus, payment systems using EMVCo specifi-
cations should locally align to ensure that there is no conflict
ii. The payer’s financial app is incapable of decrypting with other payment systems using EMVCo specifications.
the scanned QR, so the payer’s financial app sends the
encrypted QR code to CoDi’s platform (web service).

iii. CoDi’s platform decrypts the QR code and validates its 8.2 ALIPAY’S SPECIFICATIONS
content.
In China, QR code payments are made through two of their
iv. If the validation is successful, the payer’s financial app most popular mobile-payment platforms: Tencent’s WeChat
receives an encrypted message (only visible on the pay- Pay and Alibaba’s payment arm, Alipay.30
er’s financial app and CoDi’s platform) including a key to
decrypt the QR code generated previously by the payee. Typical scenarios where an Alipay QR code is used have
The key is valid for the decryption of only this particular been included below.31
QR code. • Online payment: A user of KakaoPay (the biggest digital
v. Payer’s financial app displays the payment information wallet in South Korea) makes a purchase on AliExpress or
generated in the payee’s RTP. Bigo (an e-commerce website). The merchant displays the
QR code for the user to scan with KakaoPay to complete
 The Use of Quick-Response Codes in Payments | 15

BOX 2 ALIBABA’S ALIPAY QR CODE STANDARD

Alibaba’s Alipay QR code standard refers to a set of uni- QR code holds minimum data and the remaining data
versally adopted barcode standards. Both a digital wal- is extracted and processed at the back end through a
let and a merchant’s acquirer can issue codes. Currently, unique ID. For example, an identifier consisting of two
the Alipay QR code standard has been widely applied in parts—a code-issuer ID (that is, merchant, acquirer, and
three-party and four-party schemes for online payment so forth) and tokenized user account information that
and cross-border in-store payment scenarios. Alipay’s enables the code issuer to identify the user account—
QR specifications support static and dynamic QR codes, is stored in the consumer-presented QR code, and the
as well as merchant- and consumer-presented QR codes. remaining data is processed at the back end. Similarly,
Different types of QR codes address different needs data in the merchant-presented code is positioned as
and provide the opportunity to innovate. For example, an identifier to access/direct to the merchant’s online
the consumer-presented QR code is used during trans- resources or services. Alipay’s specifications are suitable
portation and to transact using digital wallets, while the for both domestic and cross-border scenarios. Alipay
merchant-presented QR code is usually displayed at can customize its technical solutions to support other
merchant shops. Alipay’s specifications are compatible QR code standards for compatibility. For example, Ali-
with both 2D QR codes and 1D barcodes. Its specifica- pay’s QR code specifications are compatible with other
tions follow the minimum data concept to reduce the specifications such as Singapore Quick Response Code,
cost of upgrading and enhance flexibility, where the which is based on EMVCo’s specifications.

the payment. AliExpress or Bigo as a merchant presents code and EMV’s QR code specifications are the key differ-
the QR code issued by their acquirers according to Alipay’s ence. In terms of infrastructural differences between the two
QR code standard. After the user scans the code, KakaoPay specifications, for MPM, the scanning capabilities of mobile
gets order information upon decoding by the acquirer and devices are the same for both EMVCo’s specifications and
guides the user through the remaining payment process. Alipay’s specifications. For CPM, on the other hand, Alipay’s
• In-store payment: An Alipay China user makes purchases code can be processed by 1D barcode scanners and 2D QR
at merchants in Japan. The user displays the QR code or code scanners, whereas EMVCo’s code can be processed
barcode in the wallet, and merchants of many different only by 2D QR code scanners.
acquirers can scan the code to initiate the collection Industry collaborations help EMVCo accommodate all
process. After the merchant scans the QR code, it then other specifications through constant feedback. As per EMV-
passes the code value to the corresponding code issuer Co’s knowledge, EMVCo’s specifications are flexible enough
through its acquirer. The code issuer verifies the code to support all other formats. So far, EMVCo has not received
and deducts from the corresponding user account. feedback that its specification does not cater to a particular
region’s desired format.
EMVCo’s format is flexible enough to accommodate Ali-
8.3 EMVCO AND ALIPAY—A QUICK COMPARISON pay’s format (example in Singapore). The approach is differ-
ent for CPM and MPM payments. These have been described
Alipay and EMVCo’s QR specifications have certain differ- in the appendix.
ences. Alipay’s standard is based on the Unified Modeling
Language (UML) format, while EMVCo’s format is the Inter-
active Data Language (IDL). For MPM, the payload data ele- 8.4 CONSIDERATIONS WHILE ARRIVING AT
ments are similar for both specifications. The differences are QR CODE SPECIFICATIONS
mainly in the code design philosophy—that is, whether to
put all the data elements or minimal data (just the address It is imperative to note that the QR code specifica-
and identifier to access online resources) into the code and tions are highly tailored to specific business requirements.
obtain the payload data elements from a trusted server. For On the one hand, this has allowed newer services to be
the CPM, the payload data elements needed for Alipay’s QR offered through QR codes. On the other hand, it has
16 | The Use of Quick-Response Codes in Payments

FIGURE 6 Factors for Arriving at QR Code Specifications

Types Technology Standardization Security

Assess whether they Evaluate what tech- Understand whether Establish security standards
want to support both nology will be adopted standards available in and relevant practices to
merchant-presented and based on local infra- other markets can be fulfill requirements on
customer-presented structure available with adopted, and tailor security, data protection,
QR payments, and both merchants and mobile specifications to be and compliance
dynamic and static internet infrastructure compatible with them
QR codes

created a proliferation of QR codes in the market, harm- QR code can be considered in jurisdictions with limited
ing compatibility and customer experience. Hence, har- literacy levels and where the willingness to experiment is
monizing QR specifications has become the need of limited. Consumer-presented QR code can be introduced
the hour. Achieving harmonization through standard- as a follow-on to merchant-presented QR code when the
ization will improve service levels and user experience, need arises, or in more digitally advanced markets with high
heighten security, lower cost, and provide interoperability smartphone penetration.
between players in different markets, and it will encour- Additionally, before building a QR specification, it’s
age more and more smaller merchants to go digital. important for the standard setter to define clearly its QR
While deciding whether to support static or dynamic QR payment business models, including what the target mar-
codes, factors such as the availability of the supporting infra- ket segments are and what the business requirements are,
structure, the penetration of mobile devices and technology, including application scenarios (for example, in-store and/
and the penetration of smartphones need to be assessed. or online to offline payment, transportation, promotion)
In developing countries, the static QR code has had a more and cross-border scenarios. Based on the targeted business
prominent uptake due to lower associated infrastructural model, corresponding standards and specifications should
expenses and ease of use. Similarly, the merchant-presented be built.
 The Use of Quick-Response Codes in Payments | 17

TABLE 1 Detailed Considerations for QR Code Specifications

STATIC DYNAMIC
MPM 1. L ow implementation cost and convenient 1. Higher requirement for point-of-interaction terminals
deployment 2. The merchant generates an order containing the payment
2. Save cashier’s efforts amount. After scanning the code, the user needs only to
confirm the order information without entering the payment
3. A
 pplicable scenarios: Static codes are applicable to
amount. This makes the experience smoother and reduces
merchants who can use sticker materials. Merchants
the error rate.
do not need to participate in the payment process
but only need to receive payment notification 3. A
 pplicable scenarios: Dynamic codes are applicable to
and confirm the payment results, which makes it terminals with a display screen, and order codes better suit
especially convenient for small and micro merchants scenarios such as vending machines.
to conduct in-store payment businesses at low cost.
In some scenarios, static codes are also used as
the entry point to a series of experiences, such as
shopping cart, checking out, obtaining promotional
benefits, and redeeming benefits. All these
diversified application scenarios are supported by
URL-based QR code. The URL-based code standard
has unique advantages here, as it’s widely supported
by underlying internet applications.
CPM No application due to security concerns. 1. W
 allets need to have the ability to generate code in online
and offline environments (with higher technical
requirements).
2. The CPM barcode displayed by a user is a payment token
generated with the user’s authorization. The code is refreshed
regularly, and each token can be used only once at most to
improve payment security.
3. M
 erchants participate in transaction confirmation, which
reduces the error rate.
4. Merchants must have a scanner, which can be any device
with optical recognition capability, such as a smart point of
sale, a “small white box,” or even mobile phones or tablets
in which a merchant code-scanning collection app has been
installed. For 1D CPM barcodes, a traditional barcodeStandardization
scanner
can be reused. Hence, for most supermarkets, no additional
investment is needed.
5. T
 he interaction is faster. It is suitable for small-amount and
high-frequency traffic scenarios that are speed sensitive.
6. Applicable scenarios: Large and medium-sized merchants
with code-scanning ability.
Source: Own elaboration Security
9 APPROACH TO STANDARDIZATION

Standardization is necessary both at the country level and at different times; hence, they coexist. Initiatives have
globally. One critical target of standardizing QR code speci- been taken to make Bharat QR and UPI QR interoperable,
fications is enabling interoperability, so that merchants enjoy so that customers can pay as per their will, regardless of
a unified solution to reach more consumers while consum- the app they are using.33 This has countered the incon-
ers enjoy a unified payment experience at more merchants. venience associated with multiple QR codes for differ-
To fulfill this requirement, it’s necessary to build unified ent wallets, for the merchant as well as the customer. In
standards to identify payment code issuers, rules for rout- October 2020, the Reserve Bank of India announced that
ing transactions, and standardized information exchange payment system operators that use proprietary QR codes
and processing. Interoperability can also produce cost effi- in India should shift to one or more interoperable QR
ciencies and enable superior risk management. On a global codes by March 31, 2022, and that no new proprietary
level, countries have recognized the need to adopt stan- QR codes could be launched by any payment system
dardized specifications. Standardization of a specific chan- operator for any payment transaction. This measure aims
nel is delinked from the way different payment systems are to reinforce the acceptance infrastructure, provide better
connected; thus, the standardization of the QR code can user convenience due to interoperability, and enhance
be addressed independently. It is important for providers system efficiency.34
to work toward harmonization and build compatible plat- • In many countries, such as Malaysia, Thailand, and Singa-
forms at this stage. QR code interoperability can be achieved pore, regulators, central banks, or payment councils have
by harmonizing QR code specifications, as is the case with taken a national approach to defining common QR spec-
different EMVCo-compliant QR codes, and through harmo- ifications. Singapore recognized the need for standard-
nization via API and/or back-end integration.32 The harmo- ization when consumers saw various e-payment solutions
nization of QR code specifications is at the front end, while at merchant shops and had to check manually if their
API harmonization is at the back end. Interoperability can be preferred method was accepted and merchants faced
achieved using either of these two mechanisms. logistical constraints of supporting multiple QR codes.
In the recent years, many countries have also realized the Thus, to promote interoperability, Singapore launched
need to establish a standard QR specification for use across the Singapore Quick Response Code by setting up a
payment systems, owing to interoperability issues and the task force comprising members from payment schemes,
subsequent lowering of customer experience. The following issuers, acquirers, banks, and government agencies to
approaches are being taken in this regard at different levels: enforce standardization of e-payments in the country
• In India, there are two QR specifications: Bharat QR and across providers. The code specifications are based on
UPI QR. The two QR code specifications were launched the specifications issued by EMVCo.35

18 |
 The Use of Quick-Response Codes in Payments | 19

• The regulator in Hong Kong SAR, China issued common QR code.37 Based on these specifications, which were
QR specifications for retail payments for the MPM based developed through industry collaboration, MyPromptQR
on EMVCo’s specifications to facilitate interoperability was launched in September 2019.38
with the international standard. This standard was devel- • In Australia, while the EMVCo-compliant QR codes of
oped in consultation with industry players, but leeway is New Payments Platform Australia and BPay have pene-
given to providers in terms of adoption, so that it can be trated the market to some extent, uptake of QR codes
driven by market needs and as per industry best prac- has not been as significant as in markets such as China
tices and business considerations. The common QR code and other Asian countries. Australia is experiencing a
solution enables merchants,36 especially small and medi- large uptake in tap-and-go payments due to the conve-
um-sized enterprises, to convert multiple merchant-pre- nience associated with them. Consequently, the demand
sented QR codes that are in accordance with the standard for QR hasn’t been large.
into a single code for accepting different payment
• Mobile-money providers are also expanding the value
schemes, instead of displaying multiple QR codes to their
of their specifications by expanding their footprint and
customers, to enhance user experience and convenience.
collaborating with other providers. For example, Tencent
The common QR code enables each PSP to put its own
has announced that it is sharing a common QR code
relevant information in the combined QR code into a
system for mobile payments with China’s state-owned
standard form. While this is the case, the common QR
UnionPay, under a new partnership. With the common
code itself would not enable payments across different
QR code system, merchants could provide the same code
payment schemes unless the concerned PSPs made both
for making payments to users of WeChat Pay and Union-
technical and commercial arrangements bilaterally or in a
Pay’s Quickpass.39
multilateral arrangement to enable interoperability. While
merchants in Hong Kong SAR, China are not mandated to • To enable Chinese Alipay consumers to pay in different
adopt the common QR code, to promote the wider use markets with their home wallet, Alipay has worked out
of mobile retail payments and bring greater convenience multiple technical solutions to support the QR specifica-
to customers and merchants, the Hong Kong Monetary tions of different countries with minimal impact on the
Authority encourages relevant PSPs in Hong Kong SAR, customers’ payment experience.
China to adopt and support the standard. Any PSPs, • Under MPM, Alipay started issuing the Singapore Quick
including those that are not participating in FPS, mer- Response Code according to the Alipay standard in 2018
chant acquirers, or merchants may adopt the standard. and the standard for the Network for Electronic Transfers
• Additionally, a common national QR code mobile appli- of Singapore (NETS) in 2019.
cation (Hong Kong Common QR Code), which is a tech- • Different CPM QR/barcode specifications can cause
nical solution, has also been launched in Hong Kong SAR, compatibility issues for consumers when paying, which
China. Various QR codes can be fed as input to generate a means they have to switch to different codes in differ-
common QR code as an output for scanning by consum- ent countries. To address this, Alipay has designed a CPM
ers, thus addressing the issue of multiple QRs without QR/barcode standard to support both local and inter-
standardizing all the specifications, therefore encourag- national scenarios, so that consumers can use one CPM
ing compatibility. The application follows the rules and code at more merchants in different markets.
requirements as set out in the standard to combine the
QR codes provided by participating PSPs as listed in the While the standardization wave is making its way across the
mobile application. So merchants may contact their PSPs globe, the challenge for achieving standardization is that
and request QR codes that conform to the standard and the payments ecosystem is very large, and it is critical to
use the mobile app to create a common QR code. onboard all operators, switching companies, and regulators
to achieve complete standardization. Isolated solutions will
• In Thailand, Mastercard, UnionPay International, and Visa
eventually limit adoption and functionality. A collaborative
have introduced a Standardized QR Code for payments to
approach across governments and ecosystem players would
support the Bank of Thailand’s cashless agenda to drive
benefit the community at large. To achieve that, various fac-
innovation, interoperability, and security in payments. To
tors must be taken into account to incorporate the require-
pay, consumers holding a Mastercard, UnionPay, or Visa
ments of such players as card schemes, mobile-money
card simply use a mobile application that supports the
players, and others while arriving at the common specifica-
Standardized QR Code to scan the merchant-presented
tion. The following aspects will have to be considered:
20 | The Use of Quick-Response Codes in Payments

• All underlying payment instruments, such as cards, Regulatory aspects and the markets’ commercial/business
mobile money, and e-wallets, need to be included. For requirements would also have to be considered. For emerg-
example, since the data requirements for card and mobile ing markets that would like to enable digital payments and
payments differ, achieving interoperability between quickly improve financial inclusion across the market, MPM
specifications will be a challenge because of redundant static QR code payment will be a reasonable starting point,
data fields and different ID numbers, which increase the but a signed QR code is recommended to address security
overhead. Hence, minimum common data requirements risks. For larger merchants with better integration capability
may be needed, as well as flexibility to incorporate any to generate dynamic codes or with the equipment to scan
additional requirements over and above these common CPM codes, MPM dynamic code and CPM dynamic code
specifications. specifications will be more suitable.
• A simplification of the format and data interaction For each business scenario, there are different aspects
between the merchant and customer, and the right bal- to focus on, including the QR code format standard, usage
ance of data to be handled at the interface and back end, rules, presentation standards, and relevant security stan-
would need to be arrived at considering requirements of dards. A CPM QR code payment would require certain
all ecosystem participants. equipment standards. And to minimize merchant imple-
mentation costs, Alipay adopts the 1D barcode format for
• Consensus would be required on security aspects and
CPM code, so that merchants can reuse existing barcode
their incorporation.
scanners and start accepting mobile payments easily. In
• Different messaging standards follow different meth- addition, since URL-based QR code is being used for many
odologies for defining merchant codes, acquirer codes, other payment-related scenarios, such as red packet code
and so on. Scheme owners further define the acquirer (scanning code to obtain promotional benefits before pay-
ID and issuer ID. However, common identification codes ments) and O2O code (scanning code to access offline ser-
and formats would be needed to achieve complete stan- vices and make payments online), different formats might
dardization. be considered under different business scenarios.
• The different types and uses cases would also need to From both a regulatory and customer-service point of
be taken into account to arrive at the common specifi- view, a security standard is also especially important for QR
cations. code payments.
10 CROSS-BORDER PAYMENTS VIA QR CODES

Cross-border payment interoperability has increasingly been • Eleven mobile-payment providers have come together
making headway. Such payments require additional consid- through an association, the European Mobile Payment
erations in terms of supporting payment systems to enable Systems Association, to unify the payment landscape
cross-border connectivity, the methodology for identifying across Europe by establishing and implementing a
common-code issuers, and so forth across the markets. The cross-platform framework that connects all association
following are examples of cross-border initiatives that are members and allows for payment processing for custom-
underway: ers. The initiative aims to allow users of the participating
• Thailand is aiming at cross-border QR payments with Sin- digital wallets to make QR code-based payments with
gapore and Cambodia.40 their home apps to local merchants in all participating
countries.43 The European Mobile Payment Systems Asso-
• Malaysia’s OCBC Bank has introduced OCBC OneCollect,
ciation covers Belgium (Bancontact Payconiq), Germany
Malaysia’s first merchant cross-border QR code-collection
and Austria (Bluecode), Denmark and Finland (Mobile-
service, which enables those who use the mobile app of
Pay), Portugal (SIBS/MB WAY), Slovenia (Bankart), Sweden
banks participating in Singapore’s PayNow ecosystem to
(Swish), Switzerland (TWINT), Norway (VIPPS), Italy (BAN-
make QR payments to OCBC merchants in Malaysia from
COMAT and Plick), and Poland (BLIK).44 Alipay has part-
their Singaporean bank accounts.41
nered with mobile-wallet players Bluecode, ePassi, momo
• A pilot demo of BHIM UPI QR-based payments was held pocket, Pagaqui, Pivo, and Vipps in Europe to adopt a
in Singapore in November 2019. The project is being unified QR code that will enable payment interoperability
developed jointly by the National Payments Corporation for travelers in Europe and China.45 The detailed process
of India and NETS. This QR code-based system would describing how the unified QR code is being created and
allow anyone with a BHIM app to scan the Singapore how the different underlying national schemes are iden-
Quick Response Code at NETS terminals for payments in tified in the QR code format has been presented in the
Singapore.42 Since the pilot, the system has gone live in appendix.
both Singapore and Bhutan.

| 21
11 CONCLUSION

After the successful application in China, more and more PSPs ability. Many countries have adopted EMVCo’s QR standards,
and FPS around the world have launched their code-scan- while others have chosen to develop standards best suited
ning payment solutions. This further promotes the use of to the needs of their own country. Countries have recog-
code-scanning payments in different markets. FPS are typi- nized the need to expand their offerings to other countries
cally the leading initiative to promote payment innovations to facilitate the acceptance of QR code payments in markets
such as code-scanning payments, giving more traction to QR abroad. On the one hand, interoperability between different
code usage. To encourage the adoption of QR codes, banks providers in the same country is required, while interoper-
can offer value-added services, and all relevant stakeholders ability to promote seamless cross-border transactions and
can carry out media campaigns to improve awareness. Addi- make payments globally is also necessary. Thus, a focused
tionally, regulatory pushes can also drive adoption. While approach is required, not only before launching QR codes as
FPS offer QR code payments, the proliferation of QR codes a channel in FPS but also before selecting specifications that
poses challenges in terms of interoperability because each ensure interoperability with existing modes and meet mar-
market player has its own specifications and customizations. ket-specific requirements. At a larger level across the world,
A unified standard will help lower the implementation cost while the need for standardization has been established, it
and improve each project’s future reusability and interoper- remains a goal that global players continue to work toward.

22 |
12 ACKNOWLEDGMENTS

Organization Contributor
Ant Group Meng Yan
Xi Sun
Mabel Lyu
Haiyan Lyu
Ji Zheng
Banco de México Miguel Diaz
Angel Salazhar
Deloitte India Deloitte India
EMVCo Bastien Latge
Simon Kleine
GSMA Bart-Jan Pors
World Bank Harish Natarajan
Nilima Ramteke
Holti Banka

| 23
13 APPENDIX

1. ACCOMMODATION OF ALIPAY QR CODE WITHIN EMV QR CODE

a. Consumer-Presented Mode
To make a CPM payment, the merchant scans a code presented by a consumer with a scanner and initiates
a payment request from the merchant side. Both EMVCo and Alipay have corresponding code standards.
While EMVCo supports only 2D QR code, Alipay supports both 1D barcodes and 2D QR codes.

TABLE 2 Payload Format for an EMVCo Code46

TAG VALUE LENGTH FORMAT PRESENCE

‘85’ Payload Format Indicator 5 an M

‘61’ Application Template var. b O

‘xxxx’ Additional BER-TLV coded data objects var. b O
‘63’ Application Specific Transparent Template var. b O
‘xxxx’ Additional BER-TLV coded data objects var. b O
‘61’ Application Template var. b O
‘xxxx’ Additional BER-TLV coded data objects var. b O
‘63’ Application Specific Transparent Template var. b O
‘xxxx’ Additional BER-TLV coded data objects var. b O
‘62’ Common Data Template var. b O
‘xxxx’ Additional BER-TLV coded data objects var. b O
‘64’ Common Data Transparent Template var. b O
‘xxxx’ Additional BER-TLV coded data objects var. b O
‘xx’ Other template var. b O
‘yy’ Another template or primitive data object var. b O

The Payload Format Indicator (tag ‘85’) defines the QR Code format version and is the first data project of the payload. In this version of the
specification, the Payload Format Indicator has the value of “CPV01”.

24 |
 The Use of Quick-Response Codes in Payments | 25

As shown in table 2, the EMVCo CPM QR code standard ment to the merchant. Both EMVCo and Alipay have MPM
caters to bankcard-based transactions and contains data QR code standards, and the design rationale behind each
elements of the EMVCo integrated-circuit card standard. is similar. An MPM QR code contains information that the
The Alipay CPM QR/barcode standard includes both 1D consumer’s digital wallet can recognize to process payment
and 2D barcodes, and the code information is minimal to transactions accordingly—normally, the merchant informa-
ensure recognition and processing efficiency. Since most of tion or an order information. When the digital wallet appli-
the EMV card data elements used in the EMVCo QR code cation scans the code, it should be able to obtain useful data
standard are not necessary for digital wallets, Alipay doesn’t elements from the QR code payload information. Therefore,
implement a compatibility solution in practice. when a merchant generates its own QR code, it can put Ali-
pay QR code payload information into an EMVCo QR code,
b. Merchant-Presented Mode and vice versa. For example, putting Alipay QR code payload
Under MPM, a consumer scans a merchant’s QR code with a information into EMVCo MPM QR code fields 26 to 51 is
digital wallet application in a mobile phone to initiate pay- shown in table 3.47

TABLE 3 Data Object ID Allocation in Merchant Account Information Template (IDs 26 to 51)

ID MEANING FORMAT LENGTH PRESENCE COMMENT

“00” Globally Unique Identifier ans var. up to “32” M An identifier that sets the context of the data that fol-
lows. The value is one of the following:
• an Application Identifier (AID);
• a [UUID] without the hyphen (-) separators;
• a reverse domain name
“00”–“99” Payment network specific S O Association of data objects to IDs and type of data object is
specific to the Globally Unique Identifier

TABLE 4 EMVCo QR Code Payload Incorporated into Alipay QR Code

DATA OBJECT ID LENGTH FORMAT MEANING PRESENCE

AMAD Var. Additional Merchant Account Data
01–99 Var., up to 99 S Other representation of the merchange account information At least one subdata
which can be used by the partner of code issuers object shall be
The value of each subdata object complies with the tem- present if this data
plate defined in Table 2.1.7. object exists

The data object AMAD indicates other identification information of the merchant which can e used by the partners of code issuers to identify the merchant
directly. The value of each subdata object represents a partner repressentation of the merchant, and the format of each representation is defined by the code
issuer or the partner for private use.

| 25
26 | The Use of Quick-Response Codes in Payments

2. CREATION OF UNIFIED QR CODES BY ALIPAY ties can recognize which national scheme has issued the
codes. Specifically, national schemes can indicate the code
Each party issues its own codes in accordance with the directory service (CDS) and code issuer in the code value
unified code-scanning payment standards. The design of as per the standard format of MPM code. When an acquirer
the code format as a part of the code standards can reflect issues the code to the merchant, the acquirer can also reg-
information such as the issuer and applicable scenarios of ister the merchant on a CDS platform. After users scan the
the code. The codes issued by each wallet can be scanned QR code with their wallets, the wallets can access CDS to
and recognized by each other. obtain the merchant information and guide the users to
National schemes can also adopt the same standards complete the payment.
to issue codes. Through code-issuer IDs, decoding par-

FIGURE 7 Code-Issuing Process

4 11

CDS platform

3 5 12 10

6 1 8 13
7 14
Acquirer 1 Acquirer 1 Merchant Acquirer 2 Acquirer 2
database 2 9 database

Merchant onboarding Merchant onboarding

process for Acquirer 1 process for Acquirer 2

Merchant onboarding process for acquirer 1 Same merchant onboarding process for acquirer 2
1. A merchant accepts a payment and provides its merchant infor- 1. The merchant accepts a payment and provides its merchant infor-
mation to acquirer 1 for verification. mation to acquirer 2 for verification. Acquirer 2 identifies that the
2. Acquirer 1 verifies the data and confirms whether the merchant merchant has been registered on the CDS platform, and it can
meets the eligibility requirements. scan the store code to get the merchant CDS index number.

3. Acquirer 1 registers the merchant on a CDS platform. 2. Acquirer 2 verifies the data and confirms whether the merchant
meets the eligibility requirements.
4. The CDS platform assigns a merchant index number to the mer-
chant and binds the acquiring information of acquirer 1 with this 3. Acquirer 2 uses the merchant CDS index number to request the
merchant index number. binding of its acquiring information with the merchant on the
CDS platform.
5. The CDS platform returns the merchant CDS index number to
acquirer 1. 4. The CDS platform binds the acquiring information of acquirer 2
for the merchant with the merchant CDS index number.
6. Acquirer 1 assigns its own merchant identifier in its system to
the merchant and binds the merchant information and merchant 5. The CDS platform returns the binding result to acquirer 2.
CDS index number with the merchant identifier. 6. Acquirer 2 assigns its own merchant identifier in its system to
7. Acquirer 1 puts the CDS platform identifier and the merchant the merchant and binds the merchant information and merchant
CDS index number into CDS data in a general payload where CDS index number with the merchant identifier.
some of the code-issuer reference data may also be included. 7. Acquirer 2 notifies the merchant that e-wallet apps that act as
Then acquirer 1 generates a store code and sends the store code acquirer 2 partners can consume the same store code.
to the merchant. The same process applies for other acquirers who bind their acquir-
The store code can now be used by consumers using e-wallet apps ing information of the merchant on the CDS platform. The same
to scan and pay. store code is shared among acquirers on the CDS platform for con-
sumers to scan and pay.
 The Use of Quick-Response Codes in Payments | 27

FIGURE 8 Payment Process Flow

Optional Optional
CDS platform

5 13

1 9

Consumer Issuing participant 1 Merchant Issuing participant 2 Consumer

2 4 6 8 16 14 12 10

3 8 16 11

Code-scanning payment process Code-scanning payment process

for PSP1 digital wallet for PSP2 digital wallet

1. A consumer opens an e-wallet app 1 and scans a store code pre- 6. The consumer confirms the merchant information, enters the
sented by a merchant. transaction value, and initiates a payment request.
2. The digital wallet app parses the code and sends the code data 7. The digital wallet server 1 processes the payment requests and
to its back-end server for processing. decides whether to authorize the payment.
3. The digital wallet server 1 processes the code data and extracts 8. The PSP server 1 sends the payment result to the consumer and
reference data from the code. If reference data does not exist, the merchant.
the server extracts the CDS data, and maps the data (the CDS Note: In the processing between step 3 and 4, a digital wallet may
platform identifier and the merchant CDS index number) with use the merchant index number to obtain all the acquiring informa-
merchant information in the system. tion of the merchant from the CDS platform and then choose the
4. The digital wallet server 1 finds the merchant information is acquiring information of an acquirer.
bound with the merchant CDS index number in its system and Similar steps apply for the process of e-wallet app provided by dig-
returns the merchant information to the app. ital wallet 2.
5. The app renders the merchant information page and displays the
page to the consumer for confirmation.
28 | The Use of Quick-Response Codes in Payments

NOTES

1. According to the Committee on Payments and Market Infrastructures, a fast payment can be defined as a
payment in which the “transmission of the payment message and the availability of ‘final’ funds to the payee
occur in real time or near-real time on as near to a 24-hour and seven-day (24/7) basis as possible.”
2. QR Code is a registered trademark of Denso Wave.
3. Reserve Bank of India, Report of the Committee on the Analysis of QR (Quick Response) Code (RBI, July 2020),
https://www.rbi.org.in/Scripts/PublicationReportDetails.aspx?UrlPage=&ID=1142.
4. http://www.mobile-qr-codes.org/history-of-qr-codes.html#:~:text=QR%20codes%20were%20first%20
created,the%20name%20Quick%20Response%20code
5. https://www.inspiry.com.cn/AboutUs
6. Reserve Bank of India, Report of the Committee on the Analysis of QR (Quick Response) Code (RBI, July 2020),
https://www.rbi.org.in/Scripts/PublicationReportDetails.aspx?UrlPage=&ID=1142.
7. https://www.nfcw.com/2020/05/19/366591/paypal-rolls-out-qr-payments-to-28-countries-around-the-
world/#:~:text=The%2028%20countries%20where%20the%2cSpain%2c%20the%20UK%20and%20the
8. https://gadgets.ndtv.com/apps/news/whatsapp-how-to-send-transfer-money-scan-qr-code-
payments-1828715
9. This is not an exhaustive list.
10. Reserve Bank of India, Report of the Committee on the Analysis of QR (Quick Response) Code (RBI, July 2020),
https://www.rbi.org.in/Scripts/PublicationReportDetails.aspx?UrlPage=&ID=1142.
11. https://www.codi.org.mx/paginas/guiaparticipacion.html
12. A separate note in the Fast Payments Toolkit focuses on customer authentication.
13. Reserve Bank of India, Report of the Committee on the Analysis of QR (Quick Response) Code (RBI, July 2020),
https://www.rbi.org.in/Scripts/PublicationReportDetails.aspx?UrlPage=&ID=1142.
14. Reserve Bank of India, Report of the Committee on the Analysis of QR (Quick Response) Code (RBI, July 2020),
https://www.rbi.org.in/Scripts/PublicationReportDetails.aspx?UrlPage=&ID=1142.
15. Reserve Bank of India, Report of the Committee on the Analysis of QR (Quick Response) Code (RBI, July 2020),
https://www.rbi.org.in/Scripts/PublicationReportDetails.aspx?UrlPage=&ID=1142.
16. EMV® is a registered trademark in the United States and other countries and an unregistered trademark
elsewhere. The EMV trademark is owned by EMVCo, LLC.
17. WG19 is working toward delivery of a draft international standard in the summer 2022.
18. GMSA, QR Code Merchant Payments: A Growth Opportunity for Mobile Money Providers.
19. BHIM is an aggregator for all UPI-based services offered by banks; UPI is India’s FPS.
20. One-dimensional (1D) barcodes are linear barcodes. They consist of vertical lines of varying widths with
specific gaps resulting in a particular pattern. 1D barcodes usually encode a string of numerals, such as
product numbers, production dates, types, sizes, and so on. The QR code stores larger amounts of data,
enabling more flexible usage.
21. Source: Ant Group.
22. https://www.emvco.com/emv-technologies/qrcodes/
23. https://www.emvco.com/emv-technologies/qrcodes/ and https://www.emvco.com/terms-of-use/?u=/
wp-content/uploads/documents/EMVCo-Merchant-Presented-QR-Specification-v1.1.pdf
24. https://www.emvco.com/emv-technologies/qrcodes/
25. Base 64 encoding is a way of encoding arbitrary binary data in ASCII text. In base 64 encoding, each six bits of
the input is essentially encoded in a 64-character alphabet.
26. For more details, please see EMVCo, EMV® QR Code Specification for Payment Systems (EMV QRCPS):
Consumer-Presented Mode (EMVCo, November 2020), https://www.emvco.com/terms-of-use/?u=/
wp-content/uploads/documents/EMVCo-Consumer-Presented-QR-Specification-v1.1.pdf.
27. Reserve Bank of India, Report of the Committee on the Analysis of QR (Quick Response) Code (RBI, July 2020),
https://www.rbi.org.in/Scripts/PublicationReportDetails.aspx?UrlPage=&ID=1142.
28. https://www.nrb.org.np/contents/uploads/2021/03/NepalQR-Standardization-Framework-and-Guidelines.pdf
29. Primary interview with a fintech player.
30. https://www.cnbc.com/2019/11/19/tencents-wechat-china-may-soon-use-facial-recognition-for-payments.
html
31. Source: Ant Group.

28 |
 The Use of Quick-Response Codes in Payments | 29

32. https://www.gsma.com/mobilefordevelopment/wp-content/uploads/2020/08/QR-Code-Merchant-Payments-
A-growth-opportunity-for-mobile-money-providers.pdf
33. https://www.npci.org.in/qr-codes-%E2%80%93-new-age-tech-shaping-india%E2%80%99s-digital-
payments-landscape
34. https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11987&Mode=0
35. https://www.imda.gov.sg/-/media/Imda/Files/About/Media-Releases/2018/Annex-A--Singapore-Quick-
Response-Code-SGQR.pdf?la=en
36. As mentioned subsequently, any PSPs (including those that are not participating in FPS), merchant acquirers,
or merchants may adopt the standard.
37. https://newsroom.mastercard.com/asia-pacific/press-releases/mastercard-unionpay-international-and-visa-
make-e-payments-in-thailand-easier-with-the-introduction-of-standardized-qr-code/
38. https://www.bot.or.th/Thai/AboutBOT/Activities/event/Documents/ADBI_bancha.pdf
39. https://kr-asia.com/tencent-and-state-owned-unionpay-to-merge-qr-code-systems-for-mobile-payments-in-
china
40. https://www.bangkokpost.com/business/1854194/thai-banks-spread-qr-code-in-asean
41. https://ringgitplus.com/en/blog/bank-news/ocbc-bank-introduces-ocbc-onecollect-malaysias-first-cross-
border-qr-code-payment-service.html
42. https://economictimes.indiatimes.com/small-biz/sme-sector/bhim-upi-goes-international-qr-code-based-
payments-demonstrated-at-singapore-fintech-festival/articleshow/72035005.cms
43. https://fintechnews.ch/mobilepayments/european-mobile-payment-system-association-empsa/30582/
44. https://empsa.org/#story
45. https://www.pymnts.com/news/mobile-payments/2019/europe-mobile-wallet-alipay-qr-code/
46. https://www.emvco.com/emv-technologies/qrcodes/
47. https://www.emvco.com/emv-technologies/qrcodes/