🔲 Interoperable QR codes around the world

A QR code is not a payment method

A payment QR code is a two-dimensional image whose modules encode a string of characters that a phone can read. A QR code is an initiation channel, separate from the payment instrument that carries out the transaction. It holds a payee address, sometimes an amount, and nothing else. The payer’s rights, the cost, the settlement time, and the fraud exposure all depend on the underlying rail the code points to. When negotiating an acceptance contract, that rail is what you are negotiating, and the code sets none of its terms.

• A QR code on top of an instant credit transfer. QRIS (Indonesia), Pix QR (Brazil), UPI QR (India), VietQR (Vietnam), Thai QR Payment (Thailand): the payment is an irrevocable credit transfer. No chargebacks, no preauthorization, final credit within seconds.
• A QR code on top of a card. SGQR aggregates international card schemes, and TR Karekod covers both cards and FAST credit transfers: the payment remains a card transaction, with interchange, scheme rules, and a dispute cycle.
• A QR code on top of a wallet. Alipay, WeChat Pay, GCash: the payment debits an e-money balance, with counterparty risk on the issuer and payout times set by contract.
• A QR code on top of mobile money. GIMACPAY in the CEMAC zone (Central Africa), TANQR in Tanzania: the balance is safeguarded e-money, and turning it into bank money requires a cash-out.

The distinction also explains why QR codes spread in markets where card acceptance had remained limited. QR acceptance needs no terminal. A laminated stand is enough, so the upfront cost of accepting payments drops to zero. In Indonesia, 32.71 million merchants were already enrolled on QRIS in 2024 (Bank Indonesia), a scale no POS terminal fleet reaches in an emerging market. In Bolivia, 88.4% of QR payments are under 500 bolivianos and 49.7% are under 50 bolivianos (Banco Central de Bolivia, Informe de Vigilancia del Sistema de Pagos 2025). There, QR codes handle small tickets that cards could not process at a cost acceptable to merchants.

EMV QRCPS: the standard beneath the standards

The EMV QRCPS specification defines the structure of the data encoded in a payment QR code, and the two ways the code can be presented. Almost every national QR standard in this guide claims EMVCo compliance, including QRIS, Thai QR Payment, QR Ph, DuitNow QR, LANKAQR, KHQR, and Pix QR. The reference document is the EMV® QR Code Specification for Payment Systems (EMV QRCPS), published by EMVCo in two separate volumes, both at version 1.1, dated November 27, 2020 (EMVCo, public specifications).

MPM dominates deployments worldwide because it shifts the equipment cost from the merchant to the customer, who already owns a phone. Its structure is a positional TLV. Each data object is a sequence of identifier (2 digits) + length (2 digits) + value, strung together with no separator. The content can be read in the clear from the image alone, with no key and nothing to decrypt. An MPM QR code holds no secret and is not authenticated. Anyone can copy one exactly or swap in a different one, and nothing in the format prevents it.

000201                      tag 00: Payload Format Indicator, value "01"
010212                      tag 01: Point of Initiation Method
                                     11 = STATIC (reusable)
                                     12 = DYNAMIC (single use)
26XX....                    tags 02 to 51: Merchant Account Information
                                     one template per scheme or per national
                                     standard; this is where the payee's real
                                     address lives (alias, VPA, Pix key,
                                     account number, wallet identifier)
52045812                    tag 52: Merchant Category Code (MCC, ISO 18245)
5303360                     tag 53: transaction currency (ISO 4217 numeric)
540512500                   tag 54: amount (absent on a static QR)
5502011                     tag 55: tip / convenience fee indicator
5802ID                      tag 58: country (ISO 3166-1 alpha-2)
5913WARUNG BU SRI           tag 59: merchant name (25 characters max)
6008SURABAYA               tag 60: merchant city (15 characters max)
62XX....                    tag 62: Additional Data Field Template
                                     01 bill number
                                     03 store label
                                     05 reference label (reconciliation)  <<< KEY
                                     07 terminal label
6304A1B2                    tag 63: CRC-16/CCITT-FALSE over the WHOLE payload,
                                     "6304" included, value excluded

CPM is built differently. The customer’s phone generates a Base64-encoded BER-TLV, whose application template carries the application identifier, the account data, and a cryptogram. It is the EMV logic of a contactless card, carried over into an image. The cryptogram authenticates the transaction, which no MPM code can do, and the merchant does the scanning, so it needs a scanner. CPM therefore takes hold where throughput matters and checkout equipment already exists, such as supermarket registers and transit, rather than where acceptance has to stay free to deploy.

Static and dynamic: two products, not two settings

Tag 01 of the payload, the Point of Initiation Method, takes only two values, which mark two different uses of the same format. A static QR code, value 11, is a printed address with no amount and no reference. It can be reused indefinitely and costs nothing to distribute. A dynamic QR code, value 12, is generated by the register for a single transaction. It carries the amount, the currency, and the reference, and it expires.

This split has a design consequence that is often missed. A dynamic QR code is a separate product from a static one, aimed at a different type of merchant, not an upgraded version of the same product. Countries where adoption took off started with static codes, precisely because they cost nothing and need no equipment. Only then did they connect dynamic codes to chain retailers’ registers. The reverse order, dynamic first, is a fairly reliable sign of a failed rollout. It limits acceptance to merchants that already have a register that can be integrated, which is the part of the market cards were already serving.

National QR standards around the world

A national QR standard always fits the same definition: a single code displayed by the merchant, readable by every licensed app in the country. What varies is the settlement rail underneath, the authority that sets the standard, and how strictly it is enforced. The table below covers the live standards in the main markets. Every figure comes with its source and year.

Who sets the standard: three governance models

The governance of a national QR standard comes down to who publishes the specification and decides whether it is mandatory. No national QR standard grew out of the market on its own. In every country, an authority made the call, and who that authority is predicts the adoption rate fairly well, along with fee levels and how stable the system will be over ten years. Three setups cover most cases.

What QR acceptance really costs

The cost of accepting a QR payment is the fee charged to the merchant, the merchant discount rate (MDR), plus the operating costs that come with the channel. QR is often sold as the free channel, but the actual rate cards say otherwise. How the fee is set varies widely by country, under five regimes. Indonesia has a regulated, published rate, India a legal ban on any fee, and Saudi Arabia a regulatory cap on the underlying card rail. Hungary chose zero fees mandated by the central bank, while Brazil and most other markets leave the price to be negotiated freely with the provider.

• Indonesia: the rate card above, with a cap of Rp10 million per transaction. Providers can add their own daily or monthly limits based on their risk assessment (Bank Indonesia).
• India: fees are prohibited by law. Since January 1, 2020, Section 10A of the Payment and Settlement Systems Act, 2007 and Section 269SU of the Income-tax Act, 1961 have barred any charge to either payer or payee on UPI and RuPay debit payments. The direct result: on UPI, acceptance is not a profit center, and the business model shifts to lending, product distribution, and data.
• Saudi Arabia: regulation caps the merchant fee on the mada card rail at 0.80%, with a ceiling of about SAR 40 per transaction (SAMA). That cap, not the QR channel, drives the economics of local acceptance.
• Hungary: qvik charges no fees to either merchant or customer, by regulatory design (Magyar Nemzeti Bank). It is a direct and openly declared attack on card interchange.
• Mexico: CoDi is completely free on both sides. It still has not taken off, because zero fees make up neither for its absence from banking apps nor for the lack of any incentive for merchants.
• Brazil: Pix is free for consumers by decision of Banco Central do Brasil, but on the merchant side, each participating institution sets its own price, not the central bank. Pricing varies more between Brazilian providers than between countries, so the comparison that matters happens within the market.

Cross-border links: the bilateral web and what comes next

Cross-border QR acceptance lets a traveler pay a foreign merchant with their usual payment app. Today it relies mostly on a web of bilateral agreements between central banks, not on a global standard. The traveler pays by scanning the host country’s national QR code with their usual domestic app. The merchant keeps its code, contract, and equipment. It receives a domestic credit, in its own currency, into its usual account.

The documented web of links is dense. Live links include Thailand–Cambodia (2020), Thailand–Vietnam (2021), Thailand–Malaysia (2021), Thailand–Singapore (2021), and Thailand–Indonesia (2022). They also include Malaysia–Singapore (2023), Malaysia–Indonesia (2023), Cambodia–Laos (2023), Cambodia–Vietnam (2023), Indonesia–Singapore (2023), Malaysia–Cambodia (2024), and Laos–Thailand (2024). In all, 29 QR and P2P links within ASEAN or with outside partners were counted as of December 2025 (regional sources, 2025–2026). Cambodia, with KHQR, has the densest network for its size, with links to Thailand, Laos, Vietnam, Malaysia, China, Singapore, and India.

• Outside ASEAN, India exports its QR code. UPI acceptance is live in Bhutan (2021, the first country in the world to accept UPI for merchant payments), the UAE through NeoPay (2022), Singapore, Nepal, Sri Lanka, Mauritius (2024), and Qatar through QNB (2024). The Nepal corridor, opened in February 2024, carried 134,701 transactions worth Rs 321 million in five months (Fonepay / NPCI International).
• Japan came late but moved fast. JPQR Global, launched on July 5, 2025, at the Expo 2025 Osaka, Kansai site, links JPQR with KHQR, then with QRIS from August 17, 2025.
• Laos built the UnionPay specifications into its national standard in late 2024 to capture Chinese tourist spending. It is the classic case of a small market opening up out of economic necessity.
• A competing private route exists: Alipay+ (Ant International, since 2020). It claims more than 2 billion accounts reachable through some 50 partner wallets, more than 150 million merchants, and more than 220 markets covered (alipayplus.com, checked in 2026). For a merchant, that means one integration instead of N bilateral agreements, at the cost of depending on a private intermediary.
• The Philippines and Myanmar remain outside the ASEAN QR network, with immediate operational consequences for anyone doing business in those markets.

What breaks in production

Operational incidents in QR acceptance are failures that keep a payment from going through or keep the funds from being identified. They recur with great regularity from one country to the next. They have less to do with cryptography than with the physical and accounting setup around the code. The table below lists them, with the root cause and the fix for each.

One last architectural choice determines long-term dependence. A standard encodes either a bank account or a wallet ID. VietQR encodes a bank account. That choice explains why Vietnam did not become dependent on a dominant wallet, unlike Indonesia or the Philippines. Taiwan Pay and QR Platba made the same choice. When a standard encodes a wallet ID, the ecosystem consolidates around two or three dominant players, and merchants gradually lose the ability to play one provider off against another.

Getting connected: who to talk to and what to demand

For a merchant, connecting to a national QR standard means obtaining an acceptance ID that the country’s licensed apps recognize. In nearly all these markets, direct access to the standard is limited to licensed institutions: banks, payment institutions, and e-money issuers. A merchant or foreign provider cannot get an ID from the central bank. It has to go through a participant. The first job in any project, before any technical question, is therefore to identify which entities are allowed to onboard a merchant in the target country.

• Identify the settlement rail before anything else: instant credit transfer, card, e-money, or mobile money. Everything else follows from that.
• Establish who is allowed to onboard a merchant: get the list of licensed participants published by the central bank or the operator, and check that the prospective partner is still on it.
• Get the applicable pricing: regulated and public (Indonesia), banned by law (India), capped (Saudi Arabia), or unregulated (most markets). The answer changes the negotiation completely.
• Test tag 62-05 end to end: QR generation, notification, settlement file, bank statement. Until the reference shows up at the last step, you cannot reconcile.
• Check how voids and refunds work: on an irrevocable rail, a refund is not a reversal but an outgoing credit transfer, with its own compliance checks and timing.
• Check the target market’s cross-border status: whether inbound QR payments are accepted, which origin countries are covered, and who bears the FX risk.
• Keep a register of every static code issued from day one, with store, date, and distribution channel. You cannot rebuild that inventory after the fact.