THE Bangko Sentral ng Pilipinas (BSP) is proposing the creation of a centralized database of merchants accepting QR payments to strengthen fraud prevention and improve the traceability of digital payment transactions.
Under a draft circular, the BSP said it would establish, implement and maintain a National QR Code Merchant Database that would serve as a repository of merchant data.
This will “serve as a trusted repository of merchant information to support merchant identification and verification, strengthen fraud prevention and detection measures, facilitate interoperability among participating PSPs (payment service providers), and promote the safety, efficiency and reliability of QR-enabled payment services.”
The BSP’s existing regulatory framework already provides for the adoption of a national QR code standard, or QR Ph, which was designed to promote interoperability among QR-based payment services.
Under the draft rules, PSPs that “onboard, sponsor or maintain” merchant accounts participating in the National QR Code ecosystem will be required to “submit, maintain and update” merchant information according to standards, procedures and timelines prescribed by the BSP.
“PSPs shall ensure that merchant information submitted to the database is accurate, complete and kept current at all times,” the central bank said.
The proposed database will contain a broad range of information, including a unique merchant identifier, registered and trade names, merchant category or business classification and government-issued business registration details.
It will also include applicable registration and licensing status, foreign-merchant status where relevant, the merchant’s principal business address and contact information, countries of incorporation and operation, as well as websites, applications, online channels and physical store addresses.
The database will further contain information on PSPs relationships with each merchant, settlement account information and transaction account identifiers, merchant-presented QR identifiers and related credentials, as well as device, terminal, channel or other payment acceptance identifiers linked to the merchant’s QR code.
“The National QR Code Merchant Database shall provide for the timely dissemination of status changes to all other PSPs maintaining merchant relationships with the same merchant,” the central bank said.
Once notified, affected PSPs will be expected to conduct appropriate reviews and implement risk-management, monitoring, fraud-mitigation or due-diligence measures required under existing rules.
The database will not replace the responsibility of individual PSPs to conduct their own merchant due diligence, sanctions and targeted financial sanctions controls, transaction monitoring and risk assessments, the BSP said.
The central bank will approve the governance framework for the database, including its data dictionary, access categories, update deadlines, retention period, correction and dispute procedures, cybersecurity standards, business continuity requirements and arrangements for supervisory access.
Within 90 calendar days from effectivity of the circular, relevant PSPs, in coordination with the Payment System Management Body (PSMB), will have to establish an interim secure merchant information repository.
Within six months, the PSMB will have to submit to the BSP for approval the complete governance framework, data standards, application programming interface specifications, security requirements and implementation plan.
The production database needs to become operational no later than 12 months after the circular takes effect and all active merchant records must be migrated and validated within 15 months.
