🌏 Payments in Southeast Asia

Ten countries, ten architectures: mapping the landscape

In retail payments, Southeast Asia is made up of 10 national markets whose infrastructure was built within a decade, nearly all of it driven directly by central banks. These markets share no currency, no regulator, and no common scheme, and no regional regulation binds them. They do, however, follow the same build method, applied everywhere in the same order. A national instant credit transfer rail comes first, then a proxy addressing layer on top of it, then a single mandatory QR standard. Since 2020, a web of bilateral agreements has been added so that one country's QR code can be scanned next door, without travelers having to open a local account or switch apps.

There is no single regional integration in Southeast Asia. Each country imposes its own national operator, often mandatory domestic routing, and its own licensing regime and API standard, so the cost of entry is paid once per target market. Expansion happens market by market: Indonesia, then Vietnam, then the Philippines, in that order or another. Every country added to the scope means one more full integration, with its own operator contract, license, and set of technical interfaces.

Indonesia (270 million people, an archipelago, partial access to banking), Vietnam (the fastest transition in the region), and the Philippines (a remittance-driven economy) account for most of the volume and most of the complexity. Thailand is the most advanced market in how intensively it uses real-time payments. Singapore is the governance hub and home to the regional projects, but not a volume market. Cambodia, Laos, Myanmar, and Brunei are small markets with modern infrastructure. International overviews often leave them out.

National instant rails and their addressing layer

An instant payment rail is interbank infrastructure that executes an account-to-account transfer in seconds and runs around the clock. In all 10 of the region's markets, this rail was built several years before the QR standard, which was then layered on top of it. NAPAS 247 opened in Vietnam in 2016, PromptPay in Thailand in 2017, DuitNow and InstaPay in 2018, Bakong in 2020, and BI-FAST in 2021. Singapore got a head start with FAST in 2014, and Brunei brought up the rear with tarus in 2025. ASEAN took less than 10 years to roll out real-time retail payments across the board, and everything else was then built on that foundation.

What these rails share is proxy addressing: the payee is identified by a phone number, a national ID number, or a business identifier, never by an account number. PromptPay accepts mobile numbers, national ID numbers, corporate tax IDs, and e-wallet IDs. DuitNow uses mobile numbers, the NRIC (the national ID card number), and business registration numbers. PayNow recognizes mobile numbers, the NRIC, and the UEN, Singapore's Unique Entity Number. The service was extended to businesses with PayNow Corporate, then to nonbank institutions. A merchant operating in several of these countries manages as many aliases as there are separate identity registries.

Batch-processed bulk rails survive in every country alongside real-time payments, and recurring billing depends on them. PESONet in the Philippines is an ACH credit system with same-day settlement, designed to replace checks for businesses and government. GIRO in Singapore (1984) still dominates recurring bills and taxes, with eGIRO for paperless mandate setup. Malaysia's Interbank GIRO, operated by PayNet, and Indonesia's SKNBI, which is gradually losing volume to BI-FAST, round out the picture. Creditor-initiated direct debit is the function the region's instant rails lack. In Malaysia, recurring debits go through DuitNow AutoDebit, because DuitNow Transfer and FPX are both payer-initiated.

National QR standards: regulatory mandate as the method

A national QR standard is a single quick response code specification for a country, made mandatory by its central bank, that every payment app must follow. The region's central banks imposed a single standard per country, based on the EMVCo specification, and banned proprietary codes. Elsewhere in the world, QR acceptance splintered into as many codes as there are wallets. Merchants get an acceptance model that costs almost nothing: one sticker that every app in the country can read, with no terminal to rent and no acceptance contract to negotiate wallet by wallet.

QRIS (Quick Response Code Indonesian Standard, 2019) is Indonesia's single QR standard and the global textbook case of this approach. Bank Indonesia, working with the Asosiasi Sistem Pembayaran Indonesia (ASPI), the national payment system association, used its mandate to end the QR war between GoPay, OVO, DANA, and ShopeePay. For the first half of 2025, the central bank reported 6.05 billion transactions worth IDR 579 trillion. The installed base reached 57 million users and 39.3 million merchants, 93.16% of them micro-businesses (Bank Indonesia press release, August 4, 2025). For full-year 2025, Bank Indonesia reports 59.53 million users, 42.75 million merchants, and volume growth of 139.9% year over year.

These QR standards are also part of a monetary sovereignty policy, and their operators say so openly. The Office of the US Trade Representative has challenged QRIS and Indonesia's GPN (its national payment gateway) as barriers to entry. Bank Indonesia, for its part, publicly justifies its Digital Rupiah by the “sovereignty of the rupiah in the digital era.” A regional strategy that assumes standards will converge runs up against this political dimension.

ASEAN cross-border links: what works and what doesn't

A cross-border link connects two national instant payment systems so that a payer in one country can pay a payee in the other from their usual app. In 2021, the PayNow–PromptPay link between Singapore and Thailand became the world's first link between two retail instant payment systems using proxy addressing. A mobile number was all it took to send money from one country to the other. The link predates UPI–PayNow (2023) and laid the groundwork for the whole regional effort. In 2022, five central banks signed the Regional Payment Connectivity (RPC) memorandum of understanding: Bank Indonesia, Bank Negara Malaysia, Bangko Sentral ng Pilipinas, the Monetary Authority of Singapore, and the Bank of Thailand. Vietnam, Brunei, and Laos joined later.

Two structural limits explain this ceiling. The first is foreign exchange: the rate applied and its transparency vary from link to link, and no regional rule governs it or makes it comparable across corridors. That issue remains unresolved. The second is the bilateral model itself: each link is a full project that two operators must negotiate, build, and run. Transaction caps are low, and the implementation cost does not scale. A full mesh of 10 countries would take 45 links. Two markets remain outside the bilateral QR mesh, the Philippines and Myanmar, even though the BSP signed the RPC memorandum. On the acceptance side, a Philippine merchant can work around the missing link through a private gateway or a BSP-licensed PSP that offers the regional wallets.

Super apps and wallets: payments are not the product

A super app is a mobile app that bundles several everyday services, such as ride-hailing, delivery, a marketplace, or messaging, and adds an e-wallet. The region invented this wallet model, which rests on high-frequency daily use rather than on payments themselves. Payments are a by-product of a service the user needs every day, and that sets these wallets apart from card scheme wallets. The user is already in the app for another reason, so acquiring the payer costs nothing.

The region has two unusual setups. The first is the de facto public wallet. Thailand's example is the เป๋าตัง (Paotang) app, published by Krung Thai Bank, a commercial bank controlled by a fund that is itself owned by the Bank of Thailand. Government stimulus and aid programs run through this channel, so Thai public transfers go through a state-owned commercial bank's app rather than central bank infrastructure. The second setup is the private cross-border gateway. Alipay+ (Ant International) connects dozens of national wallets to its merchant acceptance network through a single integration, including GCash, TrueMoney, Touch 'n Go, Kakao Pay, and AlipayHK. The gateway also links several national switches and is the main private competitor to the central bank QR links.

Cash on delivery: the payment method you can't ignore

Cash on delivery (COD) means paying for an online order in cash, handed to the courier on delivery. It is still the leading e-commerce payment method in several of the region's markets, though it is declining fast. No variable more clearly separates a business plan written from a mature market from one that can actually run locally. COD relies on a logistics chain that collects payment on the merchant's behalf, with its own risks and costs.

COD persists because of three real constraints: partial access to banking, limited trust in online sellers, and the lack, on push payment rails, of any dispute mechanism comparable to the card chargeback. Wherever instant payments and QR codes have taken hold, COD has dropped sharply, and it will keep dropping. This payment method is at the end of its cycle, not in a steady state.

• The return rate is the real cost. A COD order refused at the door goes back into inventory after a paid round trip, with no payment collected and the product sometimes damaged. Don't compare COD with an online payment on fees alone: compare it including the refusal rate and return costs.
• The courier becomes the collector. It collects the cash, pools it, and remits it to the merchant on its own schedule. The merchant therefore bears counterparty risk on a logistics provider, which is often not regulated as a payment institution, and the remittance delay weighs directly on its working capital needs.
• Reconciliation is manual by nature. Courier remittances arrive in aggregate, rarely order by order. Demanding a detailed remittance file by order number is part of the logistics negotiation, not the payments negotiation.
• Local alternatives exist and cost less. In Indonesia, the bank virtual account (a unique transfer reference generated for each order) provides the automatic reconciliation COD lacks, and payment at convenience stores (Alfamart, Indomaret) reaches unbanked customers without anyone handling cash at the door.
• A static QR code is not an alternative to COD. It just moves the problem: it collects without reconciling. Replacing COD takes a dynamic QR code tied to the order, or a virtual account.

Accepting payments locally: costs, licenses, and mandatory routing

Three factors set the cost of accepting payments in the region: the regulated fee schedule, where there is one; the domestic routing mandate; and the licensing regime, which determines whether you can operate at all. None of the three is negotiable with the acquirer, which is bound by them just as the merchant is. They are set by the central bank or the national legislature, so they vary across the 10 markets.

Elsewhere in the region, with no single regulated fee schedule, the price of acceptance is set by the market or by public policy. In Thailand, the Bank of Thailand made person-to-person transfers free. That wiped out most paid P2P services in the country and effectively caps what any provider can charge. In Malaysia, the DuitNow QR MDR is set by the acquirer. Bank Negara Malaysia and PayNet had to clarify this publicly in 2023, and most acquirers said they would keep exempting micro and small businesses. A Malaysian merchant's actual rate is therefore whatever its bank quotes, since an industry announcement is not a contractual commitment. In Indonesia, the central bank itself credits the 2025 QRIS growth to its 0% MDR policy on public channels.

• Indonesia, GPN. The Gerbang Pembayaran Nasional (National Payment Gateway, 2017) mandates domestic routing of card transactions through four licensed switches (Artajasa, Rintis, Alto, Jalin) and gave rise to a GPN debit card with lower interchange. It is a mandatory compliance item for any acquirer in Indonesia. The country has also launched a domestic credit card, Kartu Kredit Indonesia (KKI), initially limited to government spending.
• Malaysia, MyDebit. PayNet's domestic debit scheme, which requires debit transactions to be routed domestically first. It migrated in 2025 to NextSwitch, a switch PayNet developed and owns locally.
• Thailand, TPN / Local Switching. The local switching network for Thai debit cards, built by National ITMX with the four largest banks on UnionPay technical specifications, which were adopted as the industry standard. It routes most domestic debit transactions and sets local interchange.
• Vietnam, NAPAS. A domestic card scheme with its own chip standard (VCCS) and BIN 9704, mandated by the State Bank to phase out the magnetic stripe and bring routing onshore: more than 20,600 ATMs and 741,000 terminals are connected.
• Myanmar, MPU. Since the international schemes pulled out after 2021, the Myanmar Payment Union has been virtually the only usable card rail in the country. Any exposure to the Myanmar market calls for a dedicated compliance review before any technical decision.

The licensing regime is the most common sticking point for a foreign company. In Indonesia, the framework regulation for payment systems is PBI No. 22/23/PBI/2020, in force since July 1, 2021. It requires Indonesian individuals or entities to hold at least 51% of the voting shares of a nonbank payment service provider (PJP), with a floor of 15% of the capital. The threshold rises to 80% of voting rights for an infrastructure provider (PIP). In Malaysia, the national operator PayNet is itself majority-owned by the central bank, which has said it plans to reduce its stake. In Vietnam, payment collection has to go through the holder of a payment intermediary license issued by name by the State Bank. License No. 57/GP-NHNN of July 21, 2020, granted to Viettel Money, is one example. In Singapore, the MAS Major Payment Institution regime is the entry point. Grablink, Apaylater Financials (Atome), and StraitsX (XSGD) are listed by name.

What breaks in production

Recurring incidents in the region most often stem from assumptions borrowed from the card model and applied to push payment rails. A push payment is initiated by the payer from their own bank. It becomes final as soon as it is executed. It offers none of the guarantees or recourse that come with cards, whose model rests on a pull transaction initiated by the payee. The failures described below are the costliest to deal with in production.

• Entity identifiers are not interchangeable. Singapore's UEN, Malaysia's NRIC, Thailand's corporate tax ID, the QRIS merchant ID: each registry has its own format and governance. A data model that assumes a single regional merchant ID won't survive the second integration.
• Limits are low and differ everywhere. Cross-border links in particular are capped, and the central banks on both sides set those caps. Don't discover them in production.
• Settlement follows the national RTGS, not the 24×7 rail. A payment received at midnight on a Sunday via BI-FAST or PromptPay does not settle at midnight on Sunday at the settlement bank. The gap between finality for the payer and funds availability for the payee is the classic source of cash position discrepancies.
• The entity's status determines how funds are protected. An e-money issuer is not a bank, and balances are not covered by deposit insurance. This check belongs in the counterparty review, not the technical review.
• Merchant categories drive pricing. In Indonesia, the UMI / UKE / UME / UBE classification directly changes the MDR. A misclassification at onboarding can be fixed, but rarely retroactively.

INDONESIA
  [ ] SNAP API compliance (format, security, contract governance)
  [ ] merchant classification UMI / UKE / UME / UBE -> applicable MDR
  [ ] GPN routing through a licensed switch (Artajasa, Rintis, Alto, Jalin)
  [ ] ownership structure compliant with PBI 22/23/PBI/2020 if local entity
  [ ] dynamic QR confirmed by the acquirer (not just static)

THAILAND
  [ ] PromptPay alias registered under the trading name customers know
  [ ] free P2P: check what is actually billable in P2M
  [ ] TPN local switching for domestic debit

VIETNAM
  [ ] Decision 2345 thresholds: 10M VND / transaction, 20M VND / day cumulative
  [ ] prior biometric enrollment, and device changes
  [ ] partner's payment intermediary license (No. / GP-NHNN)
  [ ] COD -> VietQR flow instrumented and measured

PHILIPPINES
  [ ] QR Ph accepted through a BSP-licensed PSP (bank or EMI)
  [ ] wallet status, EMI vs. bank: are balances protected
  [ ] no bilateral ASEAN QR link: private gateway for inbound flows

MALAYSIA
  [ ] DuitNow QR MDR confirmed IN WRITING by the acquirer
  [ ] MyDebit domestic routing priority
  [ ] recurring: DuitNow AutoDebit, not DuitNow Transfer or FPX

Who to know, and the agenda for the years ahead

In this region, market access runs through a national operator owned by the central bank, a banking association, or the government, and rarely through an international scheme. These operators set each country's access rules, technical standards, and connection terms. An acquirer will always revise its pricing more readily than anyone can change an access rule set by the national operator, which is not up for negotiation.

On the acceptance side, a foreign merchant's technical entry point is almost always a local aggregator rather than an international acquirer. In Vietnam, VNPAY claims more than 450,000 VNPAY-QR acceptance points, 350,000 partner businesses, and more than 60 million users. Its QR code is built into more than 30 banking apps and about 15 wallets. In Indonesia, the go-to gateways are Xendit, Midtrans, DOKU, and Faspay. In Thailand, they are 2C2P, Opn, and GB Prime Pay; in the Philippines, Maya Business, PayMongo, Dragonpay, and Xendit; in Malaysia, iPay88, GHL, and Razer Merchant Services.

Consumer credit tied to e-commerce is a separate market, dominated by regional players operating in several countries at once. Akulaku (PT Akulaku Silvrr Indonesia) operates in Indonesia, the Philippines, Vietnam, and Malaysia and claims 33 million customers. Kredivo (FinAccel group) has operated in Indonesia since 2016 and in Vietnam since 2021, and controls Krom Bank Indonesia. SPayLater is part of the Shopee ecosystem, and Atome operates under Apaylater Financials, which holds Singapore payment services license PS20200511. Each market requires its own local lending license, so a brand's presence in one country says nothing about whether it may lend in another.