Same Code to Scan, Why Can't It Work Everywhere? QRIS, Global QR Payment Standards and Cross-Border Interoperability

On 21 September 2026, at an event held in New York during the United Nations General Assembly, QRIS Cross-Border, the cross-border QR payment service of Bank Indonesia (BI), won the Collaboration category of the 50-in-5 Awards 2026. Bank Indonesia then released a set of figures: as of July 2026, about 45.46 million merchants in Indonesia accepted the Quick Response Code Indonesian Standard (QRIS), 96.69% of them micro, small and medium enterprises, and QRIS Cross-Border was connected with Thailand, Malaysia, Singapore, Japan, South Korea and China^[1].

Over the following days, two more cooperation agreements were signed. On 24 September, Bank Indonesia and the Hong Kong Monetary Authority (HKMA) signed a memorandum of understanding to hold dialogues on the technical, operational and regulatory aspects of cross-border QR payments and to explore arrangements for making QR payments interoperable between the two places^[2]. On 25 September, Bank Indonesia and the Banco Central de Timor-Leste signed a memorandum that lists QRIS Cross-Border as one possible way to build payment connectivity between the two countries^[3].

Put these three announcements together and a natural question follows. Almost every country now has QR code payments, and many of them say their QR codes follow the same international specification, EMVCo QR. If so, why can't an Indonesian visitor in Malaysia simply use the app on their phone to scan a local merchant's code? Why does Indonesia still have to negotiate, sign and test separately with each market?

This article starts from QRIS, surveys the world's main QR payment standards, and then follows a single cross-border QR payment to see what still has to happen after the scan.

I. Starting from QRIS: Why QR Payments Are Going Cross-Border

1. Five Codes on One Shop Wall

Before QRIS, QR payments in Indonesia looked much like early QR payments in many other markets. E-wallets such as GoPay, OVO, DANA, ShopeePay and LinkAja, along with each bank's mobile banking app, signed up merchants and printed payment codes on their own. A roadside shop that wanted to accept several payment methods had to put up several codes; if a customer's app did not match the code in the shop, the customer could not pay. Merchants had to sign separate contracts, reconcile separately, and keep their funds spread across accounts at different institutions.

This situation is known as fragmentation of the acceptance network. Each institution was building its own acceptance network, the networks did not interoperate, and merchants and consumers bore the cost of the duplicated effort.

Bank Indonesia's response was to unify the standard. On 17 August 2019, Bank Indonesia launched QRIS and required it to be implemented nationwide from 1 January 2020, after which QR-based payments in Indonesia had to use the standard^[4]. QRIS was developed jointly by Bank Indonesia and the Indonesian Payment System Association (Asosiasi Sistem Pembayaran Indonesia, ASPI), based on EMVCo's international specifications with adjustments for local needs; its first phase covered merchant-presented codes^[4].

After unification, a merchant only needs to display one QRIS code, and consumers can scan and pay with any bank app or e-wallet connected to QRIS. Domestic switching companies in Indonesia handle the processing behind it.

2. From Domestic Unification to Cross-Border Connections

Once domestic acceptance reached scale, Bank Indonesia began extending QRIS abroad. According to public sources, progress in the main markets is roughly as follows:

Sources for the table: announcements by Bank Indonesia and Bank Negara Malaysia, and reports by Indonesian media^{[1][2][3][5][6][7][8]}. The links with Thailand, Malaysia, Singapore, Japan and South Korea are already usable. The link with China has had a soft launch, and according to local reports Alipay is currently the only channel accepting QRIS in China^[7]. Hong Kong and Timor-Leste have only signed memoranda; technical integration, rule negotiations, regulatory approval and testing still lie ahead.

3. Who Pays Whom More in Cross-Border Transactions

Bank Indonesia's September announcement also gave transaction data. From the 2022 launch to July 2026, users from partner markets scanning QRIS in Indonesia with their home apps made about 21 million transactions worth about IDR 5.90 trillion; Indonesian users scanning codes in partner markets made about 4.67 million transactions worth about IDR 1.73 trillion. The former exceeded the latter by about IDR 4.17 trillion^[1].

These figures show that, at least so far, QRIS Cross-Border mainly serves spending by overseas users in Indonesia. For Indonesia, it is a channel that makes it easier to turn the spending of foreign tourists and business travellers into revenue for local merchants.

Bank Indonesia Deputy Governor Filianingsih Hendarta noted in the announcement that QRIS Cross-Border shows interoperability does not require every country to use the same system. QRIS Cross-Border is therefore not a multilateral interconnection project in the way Nexus is^[1].

4. Everyone Uses EMVCo, So Why Can't You Just Scan?

Malaysia's DuitNow QR and Indonesia's QRIS are both based on the EMVCo specification. When an Indonesian visitor opens an Indonesian bank's app and scans the DuitNow QR code of a restaurant in Kuala Lumpur, the app can most likely read the data in the code: the merchant's name, the city and the currency, Malaysian ringgit. But being able to read the data does not mean the app can complete the payment.

It also needs to know several things. The payment scheme identified in the code is Malaysia's DuitNow; is this Indonesian bank authorised to accept it? The merchant account information in the code is encoded under Malaysian rules; can the Indonesian side translate it into a payee that can be routed? The transaction is paid in rupiah and credited in ringgit; who quotes the exchange rate and who converts the currency? How are the two countries'anti-money laundering requirements, transaction limits and refund rules aligned? And finally, how do institutions on the two sides clear, and where do they settle?

To use an analogy, staff at two banks who can write letters in the same language have not thereby opened a funds transfer service between their banks. Data that machines can parse is only the first step; whether an institution can initiate a transaction in the other side's payment network depends on network access, business rules and settlement arrangements. This is why QRIS needs to build an interconnection arrangement with each market one by one.

Cross-border transfers between fast payment systems have run into the same problems. As we discussed in Cross-Border Fast Payment Linkages: PayNow, PromptPay, and Payment Connect, when two countries'instant payment systems let users transfer money with proxies such as mobile numbers, they also have to deal with addressing, currency conversion and settlement. Cross-border QR payments and cross-border transfers are initiated in different ways, but they face many of the same infrastructure questions.

Since the international EMVCo specification already exists, why does Indonesia still need QRIS? The answer starts with what EMVCo does and does not specify.

II. Which Part of the QR Code Does EMVCo Standardise?

1. QR Codes Themselves and Payment QR Codes

What people usually call a QR code is the Quick Response Code. Its symbol encoding is defined by the international standard ISO/IEC 18004: how the black and white modules are arranged, where the finder patterns go, how error correction is calculated, and how a scanner turns the pattern back into a string of characters. This layer only cares about how characters are stored and read back. It does not care whether the string is a web address, a piece of text or a payment.

Payment QR codes add another layer of conventions on top: how the string that has been read should be structured, which part represents the merchant, which part the currency and which part the amount. EMVCo's QR code specifications deal with this layer.

EMVCo is a technical body jointly owned by American Express, Discover, JCB, Mastercard, UnionPay and Visa, best known for the EMV chip card specifications. It published its merchant-presented mode QR code specification in 2017 and later a consumer-presented mode specification. The current public version is 1.1, released in November 2020, and some data objects have since been added through technical bulletins^[9].

EMVCo is explicit about the scope of these specifications: they address the QR code itself and the way data is coded into it, while the specific messaging after the code is read and processed is left to payment providers^[9]. In other words, EMVCo specifies how payment information is written into the code, but not how the transaction is authorised, cleared or settled after the scan. It does not operate any payment network, and it is not a global QR clearing system.

Going from a scan to a completed payment involves several steps:

1. The scanning device reads the pattern as a string of characters;
2. The payer's app recognises a payment scheme that it supports;
3. The paying institution is eligible to access the payment network of that scheme and sends the transaction;
4. Institutions complete clearing, and the funds are finally discharged on settlement accounts.

Each step up requires new rules and arrangements. The first step is guaranteed by ISO/IEC 18004, the second relies on the data structures of EMVCo or national specifications, and the third and fourth depend on each payment network's own rules.

EMVCo's QR specifications are also easily confused with two other kinds of standards. They come from the same organisation as the EMV chip card specifications but are only one of many specifications EMVCo maintains. They also sit in a different place from the financial messaging standard ISO 20022: ISO 20022 defines how messages exchanged between financial institutions and between payment systems are structured, for example which fields a credit transfer must carry. QR code data stays on the payer's phone, while ISO 20022 messages travel between institutions. For more on the difference, see What Is ISO 20022? A Guide to Payment Infrastructure.

2. Merchant-Presented and Consumer-Presented Codes

EMVCo divides payment QR codes into two modes.

In Merchant-Presented Mode (MPM), the merchant puts the code on a wall or shows it on a screen; the consumer scans it with a phone, then confirms the amount and pays on the phone. In Consumer-Presented Mode (CPM), the consumer opens a payment code on the phone, the merchant reads it with a scanner, and the transaction is initiated from the merchant's side.

The two modes are covered by two separate specifications and organise data differently. MPM uses a text format with two-digit tags; CPM organises data in a way closer to EMV chip cards, carrying information about the payer's account or payment credential, which is then encoded into the QR code. So the difference between CPM and MPM goes beyond reversing the direction of the scan. The entire set of instruction routing, authentication, debit and credit models, and dispute and exception handling behind them is different.

When QRIS launched in 2019 it covered MPM first; CPM was added later. Cross-border use is also mainly MPM: the visitor scans the merchant's code, so the merchant does not need to change its checkout equipment or recognise foreign payment codes.

3. Static and Dynamic Codes

Another pair of concepts that is often mixed up is static and dynamic codes.

A static code can be used repeatedly and usually does not contain a specific amount. The payment code on the wall of a roadside shop is a static code; the consumer enters the amount after scanning. A dynamic code is generated for a particular transaction and can include the amount, order number or other transaction information, and it expires after use. The code shown on a restaurant's checkout screen at the end of a meal is often a dynamic code.

Static and dynamic describe how a code is generated; MPM and CPM describe who displays the code and which specification it follows. A merchant-presented code can be either static or dynamic. In EMVCo's MPM specification, this distinction is written in the code's second field.

4. What Is Inside a Merchant-Presented Code

EMVCo MPM data uses a Tag-Length-Value (TLV) structure: each data object starts with a two-digit tag, followed by a two-digit length and then the value itself. From start to finish, the string is simply one such data object after another. Common data objects include:

The fields in the table follow version 1.1 of the EMVCo MPM specification; specific sub-fields depend on the version used^[9].

For example, a value of 11 in tag 01 means a static code and 12 means a dynamic code. Tag 53 gives the currency as an ISO 4217 numeric code: the Indonesian rupiah is 360 and the Malaysian ringgit is 458. Tag 58 gives the country code under ISO 3166: Indonesia is ID and Malaysia is MY.

Tags 02 to 51 carry merchant account information. EMVCo reserves tags 02 to 25 for payment networks such as card schemes and leaves 26 to 51 for other payment schemes to define. Each payment scheme places a Globally Unique Identifier (GUID) in its own template to show which scheme the data belongs to, and then writes the merchant's identifier under that scheme according to its own rules.

The advantage of this design is that one code can hold information for several payment schemes at once, so a merchant displaying one code can accept payments through multiple schemes. This is exactly what allows national unified QR codes to bring different wallets together. But it also means that EMVCo does not define a single global merchant account format. The Indonesian scheme writes an Indonesian merchant number in its template, and the Malaysian scheme writes a Malaysian merchant identifier. A foreign app that reads this data still needs to know whom to hand it to for processing.

The final CRC field is a four-character hexadecimal check value used to detect errors when the data is generated and read. It can catch some input or reading errors, but it is not a digital signature and cannot prove that the code really belongs to the merchant. Anyone can generate a code that passes the check under the specification and stick it over someone else's payment board. The risk of QR code substitution fraud has to be controlled through payment institutions'merchant management and transaction risk controls.

To use a language analogy, EMVCo defines the fields and grammar of payment information. Information in a code that is grammatically correct does not mean the payee account has been opened, that the paying and receiving institutions recognise each other, or that the funds are ready.

III. The World's Main QR Standards: How They Are Alike and How They Differ

1. Four Layers

Before comparing countries'QR standards, it helps to set up an analytical framework. Under Luminale's cross-border payment infrastructure framework, QR code payments worldwide can be broken down into four layers:

This framework is for analysis only and does not imply that every standard is built layer by layer along the same technical lineage. Some QR schemes are built directly on EMVCo, some have taken their own route, and some mainly deal with acceptance marks without touching the underlying payment rails. The sections below look at representative approaches region by region.

2. Southeast Asia: National Unified QR Codes Led by Central Banks

Southeast Asia has the highest concentration of national unified QR codes, and the approaches of Indonesia, Thailand and Malaysia are representative.

Indonesia's QRIS is led by Bank Indonesia, with ASPI managing the standard, and covers both banks and non-bank e-wallets. Each merchant in the QRIS system has a National Merchant ID (NMID). Domestic transactions are processed by several domestic switching companies, referred to collectively in Bank Negara Malaysia's announcement as RAJA: Rintis, Artajasa, Jalin and Alto^[5].

Thailand's Thai QR Payment was promoted by the Bank of Thailand and adopted across the banking industry, and is likewise based on EMVCo. It is closely tied to Thailand's instant payment service PromptPay: PromptPay lets users receive money with a mobile number or national ID number, a merchant's Thai QR code can carry a PromptPay payee identifier, and after the consumer scans, the funds move through a PromptPay instant transfer.

Malaysia's DuitNow QR is operated by PayNet, the national payment network operator, which drew up its own data format specification with reference to EMVCo MPM^[10]. DuitNow is also the name of Malaysia's instant transfer service, and DuitNow QR is its QR-based initiation method. As with EMVCo, PayNet's published QR generation specification covers how codes are generated; network messages after the scan, participants'responsibilities and funds settlement are set out separately in other DuitNow business rules.

What the three markets have in common is that the central bank, or an institution it designates, maintains a national unified QR specification that banks and e-wallets must follow, and the codes are connected to domestic instant payment or switching networks. They differ in who maintains the standard, how merchant identifiers are encoded, which institutions may connect directly, which network processes transactions, and which route cross-border links take.

3. Singapore and Hong Kong: Unifying the Look and Acceptance of the Code

Singapore is different from Indonesia. In September 2018, the Monetary Authority of Singapore (MAS) and the Infocomm Media Development Authority (IMDA) launched the Singapore Quick Response Code (SGQR). SGQR combines the payment information of multiple payment providers into one code, so a merchant only needs to display one code, with the accepted payment methods listed beneath it.

SGQR unifies the display and acceptance mark of the QR code; there is no single payment rail behind it. The same SGQR code can carry PayNow payment information as well as merchant information for other wallets.

PayNow is something else. It is a proxy addressing service: users link their mobile number, national ID number or Unique Entity Number to a bank account, and others can then transfer money to them using those identifiers. The transfer itself is completed through Singapore's Fast and Secure Transfers (FAST) system.

So behind an SGQR code bearing the PayNow mark there are at least three layers: SGQR is the display and acceptance mark, PayNow is proxy addressing, and FAST is the instant payment system the funds actually move through. Each has its own role, and none can replace the others.

Because each payment scheme under SGQR is still contracted and acquired separately, merchants often have to deal with several institutions. In November 2023 MAS piloted SGQR+, exploring a model in which a merchant signs with a single acquirer and can then accept all payment apps that support SGQR.

Hong Kong's approach is similar to Singapore's. In December 2017, a working group led by the HKMA released the Hong Kong Common QR Code (HKQR) specification, based on EMVCo MPM, to let merchants, especially small and medium-sized merchants, combine several merchant-presented codes into one; the related implementation guideline took effect on 17 September 2018^[11]. In the same month Hong Kong's Faster Payment System (FPS) went live, and FPS payments can also be initiated through QR codes. If the memorandum between Indonesia and Hong Kong is put into practice, QRIS will be connecting with exactly this kind of market, where several payment schemes share one code.

4. India and Brazil: QR Codes as Entry Points to Instant Payment Networks

In India and Brazil, QR codes exist mainly as user entry points to national instant payment networks.

India has two QR codes that are often mentioned together. Bharat QR was launched in 2016 by the National Payments Corporation of India (NPCI) together with card networks such as Mastercard and Visa. Based on EMVCo, it was originally designed to let one code accept card payments from several card networks, and the Unified Payments Interface (UPI) was later added.

Today the most common code on Indian streets is the UPI QR code. Many UPI payment codes carry a uniform resource identifier beginning with upi://pay that contains the payee's virtual payment address, name and amount, a format different from EMVCo's TLV structure. Once the payer's app reads the address, the transaction is processed on the UPI network operated by NPCI. When analysing QR payments in India, it is worth separating a multi-scheme acceptance standard such as Bharat QR from UPI, an account-to-account payment network.

Brazil's Pix was launched by the Banco Central do Brasil in November 2020 and is an instant payment system run directly by the central bank. Pix QR codes use the BR Code format defined by the Brazilian central bank, and BR Code is based on EMVCo MPM. BR Code deals with how a payment is initiated, while Pix sets the rules for participant access, transaction processing, account addressing and settlement, with funds settled in real time in the instant payment system operated by the Brazilian central bank.

The two countries show that QR codes can become the user interface for instant transfers, but the payment infrastructure behind the interface needs to be analysed separately.

5. Europe and China: Two Different Paths

Europe's path is clearly different from Southeast Asia's. The European Payments Council (EPC) issued QR code guidelines years ago (EPC069-12) for printing a code on a paper bill or screen so that, after scanning, the payer's app automatically fills in the payee name, International Bank Account Number (IBAN), amount and remittance information for a Single Euro Payments Area (SEPA) credit transfer. The data in such codes is arranged line by line, in a format different from EMVCo MPM.

From 2022, the EPC also published a QR code standard for Mobile Initiated SEPA Credit Transfers (MSCT) (EPC024-22), which standardises both payee-presented and payer-presented codes, covers person-to-person, consumer-to-business and business-to-business payments, and applies to both SEPA Instant Credit Transfers and standard credit transfers^[12]. The EPC's starting point is to standardise how account-to-account payments are initiated across Europe, a different idea from Southeast Asia's use of national unified QR codes to consolidate wallet acceptance.

In China, QR code payments were scaled up first by commercial players. Alipay and WeChat Pay each promoted their own payment codes in the early days and built huge wallet ecosystems; China UnionPay also launched its own QR payments and the UnionPay QuickPass app. In December 2017 the People's Bank of China issued the Specifications for Barcode Payment Services (Trial), setting unified rules on business qualifications, risk management and transaction limits for barcode payments^[13]. Online payment business by payment institutions that involves bank accounts must be processed through NetsUnion Clearing Corporation or China UnionPay, which created a division of labour among wallets, clearing institutions and banks. For more, see Payment Clearing Explained: What NUCC and UnionPay Actually Clear. In recent years the People's Bank of China has also been pushing for mutual recognition of QR codes among Alipay, WeChat Pay and UnionPay QuickPass.

On the cross-border side, Chinese commercial players moved earlier. Ant Group's Alipay+ connects e-wallets from many countries and regions: users of overseas wallets can scan merchant codes in the Alipay ecosystem, and Alipay users abroad can scan merchant codes connected to Alipay+. Card networks are doing something similar. As we discussed in Mastercard Wallet Pay: Card Networks as Digital Wallet Infrastructure, Mastercard is turning its network into an intermediary layer that connects wallets across countries.

6. China's Cross-Border QR Code Unified Gateway

As its wallet ecosystem grew, the problem China ran into with cross-border QR payments was too many connections, scattered too widely. An overseas wallet that wanted to be used at merchants in mainland China often had to connect separately with Alipay, Tenpay, UnionPay and other institutions; Chinese institutions going abroad also had to negotiate separately with wallets and switching networks in each country. Every additional partner meant another interface, another set of rules and another reconciliation arrangement.

To address this, the China Payment & Clearing Association, together with China UnionPay and under the guidance of the People's Bank of China, built the Cross-Border QR Code Unified Gateway (the Unified Gateway). Construction began in earnest in early 2025, the gateway went into production on 30 July 2025 and began trial operation at the end of July^[14][15]. The Unified Gateway lets domestic and overseas institutions cooperate on cross-border QR payments through a single connection: domestic institutions connect through UnionPay's standard interface, and overseas partners can connect through UnionPay International^[14]. It provides a unified technical interface, routing and distribution of cross-border transaction information, and transaction monitoring and analysis, and it sets up a unified information interface covering both inbound use (overseas wallets used in China) and outbound use (Chinese wallets used abroad), supporting both customer-scans-merchant and merchant-scans-customer modes^[14][15].

The Unified Gateway's boundaries are spelled out clearly: it does not take part in processing fund transfers and does not provide services directly to wallet users or merchants^[15]. Participating institutions must fulfil their own obligations on customer due diligence, anti-money laundering, counter-terrorist financing and anti-tax evasion^[15]. In this article's four-layer framework, the Unified Gateway sits in Layer 4 and handles the routing of cross-border transaction information and the connection rules. How codes are generated is still determined by the specifications of each wallet and clearing institution, and how funds are settled is still arranged by the participating clearing institutions and settlement banks.

In the early stage of trial operation, the Unified Gateway gave priority to inbound use. The first partners included China UnionPay, NetsUnion, UnionPay International, Alipay and Tenpay, and users of wallets from Singapore, Malaysia, Thailand, Hong Kong SAR and Macao SAR could use it to pay by scanning codes at merchants in mainland China. As of 11 September 2025, the Unified Gateway had handled 1.981 million transactions worth CNY 427 million^[15]. In its RMB Internationalization Report (2026), the People's Bank of China said that as of the end of June 2026, UnionPay, NetsUnion and other clearing institutions had achieved QR network interconnection with 13 countries, including Malaysia, and had brought in more than 40 overseas wallets for inbound use^[16].

The Unified Gateway and QRIS address the same kind of problem from different starting points. QRIS first unified the code format at home and then connected abroad one link at a time. China's QR code formats have not been unified into one, so China unified things first at the cross-border interface layer, allowing an overseas institution to connect once and reach several domestic institutions. For a partner like Indonesia, the Unified Gateway means it only needs to deal with one entry point when connecting to the Chinese market, without connecting separately to multiple wallets and clearing institutions. In describing the Unified Gateway, UnionPay also noted that China's QR projects with Indonesia and Vietnam use a model of network interconnection plus local currency settlement^[14].

7. A Summary Table

Looking at these standards together, global QR codes are more standardised than many people assume, and a large share of national specifications are built on EMVCo. But standardisation means everyone writes codes with similar grammar; what each country puts in its codes is different, and so are the clearing networks behind them. Two countries that both use EMVCo are like two people who both speak English: it does not mean they bank at the same bank and can transfer money to each other directly.

IV. What Happens in a Cross-Border Payment After One Scan

1. An Example: An Indonesian Visitor Pays for a Meal in Kuala Lumpur

A concrete scenario ties the layers together. An Indonesian visitor has a meal at a restaurant in Kuala Lumpur, and the bill comes to MYR 100. A DuitNow QR code sits on the counter, and the visitor opens the bank app they use in Indonesia to scan and pay.

The joint announcement by Bank Negara Malaysia and Bank Indonesia disclosed some of the participants in this link: on the Malaysian side the operator is PayNet; on the Indonesian side they are ASPI and the four switching companies Rintis, Artajasa, Jalin and Alto; the settlement banks are CIMB Bank in Malaysia and Bank Mandiri and Bank Negara Indonesia (BNI) in Indonesia; and exchange rates use direct local currency quotes provided by Appointed Cross Currency Dealer (ACCD) banks under the bilateral Local Currency Settlement Framework (LCS)^[5].

Public sources do not disclose the link's full message routing, settlement frequency or position management. The flow below is a conceptual model based on these participants and the general principles of cross-border payments, intended to show how the work is divided; the actual details are governed by the formal rules of the two sides and the participating institutions.

2. Information Flow: How the Instruction Travels from Indonesia to Malaysia

Step one, scanning and recognition. The visitor's app reads the data in the DuitNow QR code and finds that the country code is MY, the currency code is 458, and the merchant account information belongs to the DuitNow scheme. The app needs to determine whether it supports cross-border scanning and whether this merchant is within the accepted range. If it is a dynamic code, the amount is already in the code; if it is a static code, the visitor enters MYR 100 themselves.

Step two, quoting and confirmation. The Indonesian side uses the ACCD bank's quote to calculate how many rupiah the MYR 100 will cost and shows this to the visitor together with any fees. Assuming a quote of IDR 3,700 per ringgit, the visitor will see an amount of about IDR 370,000 to pay. After the visitor confirms, the paying bank checks the account balance, runs risk and compliance checks, and holds or debits the funds.

Step three, routing and conversion. The payment instruction goes through Indonesia's domestic switching companies to the cross-border connection point and then into Malaysia's PayNet network. The two sides'message formats, field definitions and merchant identifiers are not necessarily the same, so the connection point needs to map fields or convert formats so that the Malaysian side can identify which merchant the transaction is for.

Step four, processing and notification on the receiving side. PayNet passes the transaction to the restaurant's acquirer or receiving bank. Once the receiving side confirms the transaction, a payment success message appears on the restaurant's checkout system or phone. The confirmation travels back the same way, and the visitor's app shows that the payment is complete.

The whole information flow usually finishes within a few seconds. When the visitor leaves the restaurant, they see that the money has been paid, and the restaurant sees that it has been received.

3. Funds Flow: How the Money Moves Behind the Scenes

When the information flow is complete, funds settlement is not yet finished. At the funds level, a cross-border QR payment has to deal with at least three things.

The first is the rupiah on the Indonesian side. The visitor's deposit at the Indonesian bank falls by about IDR 370,000. Through Indonesia's domestic clearing arrangements, this rupiah has to be gathered from the paying bank to an Indonesian bank acting as settlement bank, such as Bank Mandiri or Bank Negara Indonesia mentioned in the announcement.

The second is the ringgit on the Malaysian side. For the restaurant to receive MYR 100, a Malaysian settlement bank, such as CIMB Bank, has to pay the money through Malaysia's domestic clearing arrangements to the restaurant's bank, which then credits the restaurant's account.

The third is conversion and positions between the two currencies. The Indonesian side has taken in rupiah and the Malaysian side has paid out ringgit, so a cross-currency position that needs to be settled arises between the two settlement banks. Under the LCS framework, such positions can be converted directly between rupiah and ringgit by the appointed dealer banks, without first converting into US dollars and back.

To make this easier to follow, the changes on the books of the main participants can be simplified as follows (assuming an exchange rate of IDR 3,700 per ringgit and ignoring fees):

The visitor's Indonesian paying bank

The Malaysian receiving bank

How often the two settlement banks clear with each other, whether gross or net, and where final settlement takes place are not detailed in public sources. These arrangements determine who bears the other side's credit risk and for how long, and who has to pre-position how much ringgit or rupiah liquidity.

4. Five Questions

Extending this example, we can distil five questions that any cross-border QR link has to answer.

Who reads the QR code? The consumer's app has to understand the payment scheme identifier and merchant information in a foreign merchant's code. Countries encode merchant accounts differently, so a cross-border transaction often needs field mapping or message conversion at some point. This step determines whether the transaction can be initiated correctly.

Who converts the currency? The QR code itself does not convert currency. Who quotes the rate, who earns the spread and who bears the FX risk depend on how the link is arranged. In the QRIS–DuitNow link, quotes come from ACCD banks under the LCS framework^[5]; the link between Indonesia and South Korea also runs under the local currency transaction framework, with direct conversion between rupiah and won^[8]. Other links may rely on card networks, commercial aggregation platforms or specialist FX liquidity providers for conversion.

What is the user's money? The visitor may be paying with a bank deposit or with an e-money balance in an e-wallet. The former is a liability of the bank; the latter is usually a liability of the e-money issuer, backed by the customer funds it holds at banks. Different payment instruments come with different account relationships and customer fund protection arrangements.

Who handles clearing? Domestic instant payment networks, switching companies, acquirers, cross-border connection points and settlement banks each take on part of the clearing and reconciliation work. The operator of a QR scheme is not necessarily the institution that completes final settlement.

When is settlement final? The visitor seeing a successful payment, the restaurant receiving a credit notification, and the final discharge of obligations between the two countries'settlement banks may not happen at the same time. The first two happen within seconds; the last depends on the settlement arrangements and may happen later that day or even later. During this window, some institution has always advanced funds on behalf of another or taken on the other side's credit risk. We discussed similar issues around crediting and confirmation on the receiving side in Why Cross-Border Payments Stall at the Last Mile.

5. Local Currency Settlement and QRIS

QRIS Cross-Border is closely linked to Bank Indonesia's Local Currency Transaction (LCT) framework. LCT is a set of bilateral arrangements promoted by Bank Indonesia, originally called the Local Currency Settlement (LCS) framework and later extended to trade, investment and financial transactions, which encourages Indonesia and partner countries to settle directly in their two currencies and reduce reliance on the US dollar.

For Indonesia, cross-border QR payments are a retail-level application of LCT. Tourist spending involves small amounts and many transactions; if each one went through a US dollar conversion, conversion costs would be layered on again and again. Under the LCT framework, appointed banks quote rates directly between the two currencies, which shortens the conversion path. The trade-off is that these appointed banks have to hold and manage positions in both currencies, and for currency pairs with low volumes, the cost of quoting may not be low.

So the QR code is only the entry point to a transaction: payment networks make sure instructions are processed, and accounts and settlement arrangements ultimately determine how obligations are discharged.

V. What Needs to Be Unified Next for Cross-Border QR Links

1. A Common Data Format Is Only the First Step

Back to the question at the start of this article. If every merchant code in the world were generated in the same format, would cross-border QR payments simply connect on their own? The analysis above suggests not. Even if two countries'codes can be read by each other, they still need to coordinate how payees are identified, eligibility for network access, transaction routing, FX quotes, compliance checks, refunds and dispute handling.

Crossing jurisdictions adds another layer. If a consumer pays the wrong amount, a merchant refuses a refund, or a visitor finds a duplicate charge after returning home, whose rules apply? When transaction data is sent between two countries, whose data protection rules apply? Which side is responsible for anti-money laundering and countering the financing of terrorism (AML/CFT) screening? All of these questions need to be clearly agreed for each link.

2. Two Routes: National Interconnection and Commercial Aggregation

Looking at developments so far, cross-border QR payments are broadly moving along two routes.

The first is national-level infrastructure interconnection. National unified QR codes such as QRIS, Thai QR and DuitNow QR are connected through cooperation agreements signed by central banks, links built by domestic payment system operators, and services provided to users by participating banks and wallets. The strength of this route is that one connection can cover all participating institutions in a country and FX and settlement can be brought under a local currency settlement framework; the drawback is that every link requires one-by-one negotiation between the two countries'central banks and operators.

The second is commercial aggregation. Alipay+, card networks and other wallet connection networks achieve cross-market use through technical adaptation, merchant acceptance agreements, commercial contracts and their own settlement services. This route expands faster: when an aggregation platform connects a new wallet, it can bring that wallet's users into every market the platform covers. But it depends on the pricing and rules of commercial institutions, and national regulators have more limited information about the funds and data flows involved.

The two routes are not mutually exclusive. The QRIS link with China is currently delivered through Alipay acceptance^[7], while the link between Indonesia and Japan runs through JPQR Global, provided by the Japanese payment infrastructure operator Netstars^[6]. National unified QR codes and commercial networks can also be connected through commercial and technical interfaces. China's Unified Gateway adds a layer between the two: participating Alipay and Tenpay are commercial institutions, the Unified Gateway itself was built under the guidance of the People's Bank of China, and once overseas institutions connect, domestic clearing institutions and wallets each complete their own processing.

3. From Bilateral to Multilateral

QRIS already has six or seven bilateral links, and other Southeast Asian countries are also connecting pair by pair. In November 2022, the central banks of Indonesia, Malaysia, the Philippines, Singapore and Thailand signed a memorandum of understanding on regional payment connectivity in Bali, later joined by Vietnam and other countries, with cross-border QR payments as one of its main areas.

As bilateral links multiply, the cost of duplicated work becomes visible. Every link has to redo system integration, FX liquidity arrangements, compliance rules and settlement rules; connecting N countries pair by pair requires N(N−1)/2 links. The value of a multilateral arrangement lies in pooling reusable access standards, routing rules and operating rules so that each country connects only once.

In the fast payment space, Nexus, incubated by the BIS Innovation Hub and now taken forward by Nexus Global Payments (NGP), is one such attempt; we analysed its architecture in Nexus Multilateral Network: How It Rearchitects Cross-Border Fast Payments^[17]. Nexus is an interconnection scheme between fast payment systems that handles addressing, quoting and message routing for cross-border transfers; it is not itself a global QR data standard. If cross-border QR payments move towards a multilateral model, they may need a similar multilateral rules layer, but what it would have to unify is the resolution of merchant identifiers, acceptance rules and dispute handling, not just the code format.

China's Unified Gateway offers another approach: first centralise a country's external interfaces domestically, so that an overseas institution can connect once and reach multiple wallets and clearing institutions in that country. When two countries that both have a single entry point connect, they only need to handle one link.

Going multilateral also does not mean a single currency or a single global payment system. Each country's funds are still settled in its own domestic payment system; what a multilateral arrangement coordinates is the rules of connection.

4. Security and Governance

Once QR payments cross borders, existing risks are amplified and new ones appear.

• QR code substitution and fake merchants. The CRC check in a QR code cannot prove that a merchant is genuine, and across borders payers are less familiar with foreign merchants and find it harder to spot a substituted code. Having the payer's app show a verified merchant name on the confirmation screen is a fairly direct safeguard.
• Misdirected payments and refunds. Cross-border refunds involve converting currency back after the exchange rate has moved, so which side's currency determines the refunded amount needs to be agreed in advance.
• Cross-border disputes. The consumer and the merchant are in different jurisdictions, so the rules and time limits for handling disputes need to be harmonised at the level of the link.
• Operational risk. A system outage on either side affects the whole link, so the order of handling and the communication arrangements in case of failure need to be agreed.
• Data and compliance. Cross-border transmission of transaction data must comply with both countries'data rules, and the division of AML/CFT screening responsibilities needs to be written down in advance.

In all of these areas, the parties to a link need to coordinate the user experience and draw clear lines of institutional responsibility. A visitor whose QR payment fails abroad will go to their own bank at home, but the problem may lie somewhere in the other country.

5. The Focus of Competition Is Shifting

Over the past decade, competition in QR payments centred on merchant acceptance points: whoever got more merchants to display their code controlled the payment entry point. Since national unified QR codes appeared, competition for domestic acceptance points has largely come to an end in many markets.

Competition from here on is more likely to turn on who can organise cross-border networks, set common business rules, provide competitive exchange rates and liquidity, control fraud and compliance risks, and take operational responsibility for an entire link. Central bank payment systems, domestic switching companies, card networks and large wallet platforms each have a place in this, and they will also cooperate on some links.

Conclusion

Looking back from QRIS, the evolution of global QR payment standards has gone through roughly three stages: each wallet setting its own rules, countries stepping in to unify local acceptance, and then countries building links with each other. Each step adds another layer of parties to coordinate.

EMVCo lets different institutions write codes in a data structure they can all read; national unified QR codes address the fragmentation of local acceptance; and cross-border interconnection has to solve how two countries'payment systems work together in a single transaction. The QR code serves as the payment entry point and carries part of the data, while currency conversion, clearing and final settlement are completed by the banks, payment networks and settlement arrangements behind the code.

Bank Indonesia says interoperability does not require every country to use the same system. That statement can also be read from the other side: if countries keep their own systems, rules have to be built between those systems. Whether QR payments worldwide can become more interoperable depends on whether, after the scan, different countries'financial infrastructures can reliably work together to complete a transaction. Whether the same kind of QR code is printed everywhere is not the precondition.

More articles on cross-border payments can be found in the Luminale Fintech Observer | Cross-Border Payments column.

References

[1]: Bank Indonesia, QRIS Cross-Border Wins 50-in-5 Awards 2026, News Release, 22 September 2026. https://www.bi.go.id/en/publikasi/ruang-media/news-release/pages/sp_2819126.aspx ↩

[2]: Bank Indonesia, Hong Kong Monetary Authority and Bank Indonesia Sign Memorandum of Understanding on QR Code-Based Cross-Border Payments, News Release No. 28/194/DKom, 24 September 2026. https://www.bi.go.id/en/publikasi/ruang-media/news-release/Pages/sp_2819426.aspx ↩

[3]: Bank Indonesia, Bank Indonesia and Banco Central de Timor-Leste Sign Memorandum of Understanding, News Release, 25 September 2026. https://www.bi.go.id/en/publikasi/ruang-media/news-release/Pages/sp_2819826.aspx ↩

[4]: Bank Indonesia, Bank Indonesia Launches QR Code Indonesian Standard (QRIS), News Release, 17 August 2019. https://www.bi.go.id/en/publikasi/ruang-media/news-release/Pages/SP_216219.aspx ↩

[5]: Bank Negara Malaysia and Bank Indonesia, Malaysia and Indonesia Launch Cross-Border QR Payment Linkage, Joint Press Release, 27 January 2022. https://www.bnm.gov.my/-/duitnow-qris-link-my-id ↩

[6]: Bank Indonesia, QRIS Officially Available for Use in Japan, News Release, 17 August 2025. https://www.bi.go.id/en/publikasi/ruang-media/news-release/Pages/sp_2719325.aspx ↩

[7]: ANTARA News, Bank Indonesia launches QRIS cross-border payment system with China, 30 April 2026. https://en.antaranews.com/news/414208/bank-indonesia-launches-qris-cross-border-payment-system-with-china ↩

[8]: Indonesia Business Post, Indonesia, South Korea operationalize cross-border QRIS payments, 6 April 2026. https://indonesiabusinesspost.com/6424/markets-and-finance/indonesia-south-korea-operationalize-cross-border-qris-payments ↩

[9]: EMVCo, EMV QR Codes (including EMV QR Code Specification for Payment Systems: Merchant-Presented Mode v1.1 and Consumer-Presented Mode v1.1, November 2020). https://www.emvco.com/emv-technologies/qr-codes/ ↩

[10]: PayNet, DuitNow QR: Merchant Presented Mode – QR Generation Specification. https://docs.paynet.my/docs/duitnow-qr/merchant-presented-qr/qr-generation-specification/merchant-presented-mode ↩

[11]: Hong Kong Monetary Authority, Common QR Code Specification and Implementation Guideline on Common QR Code. https://www.hkma.gov.hk/media/eng/doc/key-functions/financial-infrastructure/infrastructure/retail-payment-initiatives/Implementation_Guideline_on_Common_QR_Code.pdf ↩

[12]: European Payments Council, Standardisation of QR-codes for MSCTs (EPC024-22 v2.0), January 2023. https://www.europeanpaymentscouncil.eu/document-library/guidance-documents/standardisation-qr-codes-mscts ↩

[13]: People's Bank of China, Notice of the People's Bank of China on Issuing the Specifications for Barcode Payment Services (Trial) (Yin Fa [2017] No. 296), December 2017. ↩

[14]: China UnionPay, China UnionPay Participates in Building the Cross-Border QR Code Unified Gateway to Foster a New Ecosystem for Payment Interconnection (in Chinese), 19 September 2025. https://cn.unionpay.com/upowhtml/cn/templates/newInfo-nosub/7885004da382485e8bde5a0ba000fdd3/20250919144500.html ↩

[15]: Xinhua, Cross-Border QR Code Payments Take Another Step Forward (in Chinese), 24 September 2025. http://www.news.cn/tech/20250924/9fece6513ce14a8cb88b0a812fc18356/c.html ↩

[16]: People's Bank of China, RMB Internationalization Report (2026), September 2026; as cited by mpaypass.com.cn, PBOC Report Reveals Progress in Cross-Border QR Code Payment Interconnection (in Chinese), 25 September 2026. https://m.mpaypass.com.cn/news/202609/25183527.html ↩

[17]: BIS Innovation Hub, Project Nexus. https://www.bis.org/about/bisih/topics/fmis/nexus.htm ↩

Originally published by Luminale Fintech Observer: https://luminale.cn/articles/qris-qr-payment-standards-cross-border-interoperability-en