QR Code Payment Systems 2025: DuitNow, PayNow, UPI, PromptPay & the EMVCo Standard Explained

QR code payments have crossed a threshold: in Southeast Asia, they now process more transaction volume than card swipes at physical merchants. This isn't a trend — it's a structural shift in how money moves. This guide explains the major QR payment systems country by country, the international EMVCo standard that's enabling cross-border interoperability, and what merchants need to do to accept QR payments correctly.

The Scale of QR Payments in 2025

To understand the significance, consider the numbers:

• India (UPI): 13.9 billion transactions in December 2024 alone — over 450 million per day. UPI now accounts for nearly 80% of all retail digital payments in India.
• Malaysia (DuitNow): Over RM 1.7 trillion in transactions processed in 2024. DuitNow QR is accepted at over 1.4 million merchant touchpoints.
• Singapore (PayNow): Over SGD 76 billion transacted annually. PayNow is accepted at essentially all Singapore retailers.
• Thailand (PromptPay): Over THB 46 trillion processed in 2024. Thailand has the highest QR payment penetration per capita in Southeast Asia.
• China (WeChat Pay / Alipay): The world's largest QR payment ecosystem, processing billions daily — though operating on separate standards from the countries above.

The common thread: all these systems are built on QR codes because QR requires no specialized hardware (no card reader terminal) — just a smartphone and a printed code.

The Technology Foundation: Merchant-Presented vs Consumer-Presented QR

There are two modes of QR payment, and understanding the difference is essential for merchants:

Merchant-Presented QR (MPM)

The merchant displays a static QR code (printed or on a screen). The customer scans it with their banking or e-wallet app and enters the payment amount. This is the most common model for small merchants — it requires no POS terminal upgrade, just a printed QR code.

Advantages: Zero hardware cost, works offline (static QR), any number of customers can scan the same code.

Limitations: Customer must manually enter the amount; no automatic amount pre-fill; requires the customer to confirm the merchant name matches.

Consumer-Presented QR (CPM)

The customer shows a dynamic QR code on their phone, and the merchant scans it with a POS terminal or scanner. This is the model used by transit systems (bus/MRT ticketing) and supermarket chains.

Advantages: Amount is pre-set by the merchant's POS; faster for high-volume environments.

Limitations: Requires merchant to have a QR scanner or upgraded POS terminal.

Country-by-Country Breakdown

🇲🇾 Malaysia: DuitNow QR

Operator: Payments Network Malaysia (PayNet)
Launched: 2019
Standard: EMVCo-compliant

DuitNow QR unified Malaysia's fragmented payment landscape by creating a single national QR standard. Before DuitNow, merchants needed separate QR codes for Maybank, CIMB, Touch 'n Go, GrabPay, and other e-wallets. Now, one DuitNow QR code accepts payment from all participating banks and e-wallets.

Supported wallets and banks: Maybank (MAE), CIMB (EVA), Public Bank, Hong Leong Connect, RHB, AmBank, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, BigPay, and 40+ others.

Merchant setup: Apply through your bank's business banking platform or through an approved payment facilitator. Static QR codes are free; dynamic QR integration requires a payment gateway API.

Transaction limits: Typically RM 5,000–50,000 per transaction depending on the payer's bank, RM 10,000–200,000 daily, varying by financial institution.

Fees: As of 2025, Bank Negara Malaysia mandates zero MDR (Merchant Discount Rate) for DuitNow QR transactions under RM 100 for micro-merchants. Fees for larger transactions vary by payment facilitator.

🇸🇬 Singapore: PayNow QR

Operator: Association of Banks in Singapore (ABS)
Launched: 2017 (P2P), 2018 (corporate)
Standard: SGQR (Singapore Quick Response Code) — EMVCo-based

Singapore's SGQR standard consolidated 27 different payment schemes into a single QR code for merchants. A SGQR sticker at a merchant displays one QR code that accepts PayNow, GrabPay, Liquid Pay, NETS QR, Singtel Dash, and more — all from the same scan.

PayNow unique features:

• Transfer via mobile number (registered to recipient's bank account) — no account number needed
• Transfer via NRIC/FIN number (Singapore ID)
• Transfer via UEN (Unique Entity Number) for businesses
• Linked to virtually all Singapore banks: DBS, OCBC, UOB, Standard Chartered, Citibank, HSBC, and more

Cross-border: PayNow is linked to Malaysia's DuitNow and Thailand's PromptPay, enabling cross-border QR payments between these countries — a significant milestone in ASEAN financial integration.

🇮🇳 India: UPI QR

Operator: National Payments Corporation of India (NPCI)
Launched: 2016
Standard: UPI QR (proprietary NPCI standard)

India's UPI (Unified Payments Interface) is the world's most successful real-time payment system by transaction volume. UPI QR codes encode a Virtual Payment Address (VPA) — a unique identifier like merchant@paytm or business@upi — that routes payment through the NPCI interbank settlement network.

Supported apps: PhonePe, Google Pay (GPay), Paytm, BHIM, Amazon Pay, Mobikwik, WhatsApp Pay, and all bank-specific UPI apps (SBI Pay, iMobile, etc.)

Key statistics:

• 13.9 billion transactions in December 2024
• Average transaction value: approximately INR 1,800 (~USD 22)
• Accepted by over 35 million merchants across India
• Zero MDR mandated by government for most merchant categories

Cross-border expansion: UPI is being deployed in UAE, Singapore, France, Bhutan, Nepal, Sri Lanka, and other countries, allowing Indian tourists and diaspora to pay using Indian bank accounts abroad.

🇹🇭 Thailand: PromptPay QR

Operator: Bank of Thailand / NITMX
Launched: 2017
Standard: EMVCo-compliant

PromptPay QR uses the Thai national payment infrastructure and is linked to national ID numbers or phone numbers. Thailand's QR adoption rate is remarkable — in many street markets and food courts, QR payment is the only electronic payment option (no card terminals).

Cross-border: PromptPay is linked to Singapore's PayNow, Malaysia's DuitNow, and Japan's J-Coin Pay, enabling multi-country QR payments across ASEAN and beyond.

🇵🇭 Philippines: QRPh

Operator: BSP (Bangko Sentral ng Pilipinas) / PPMI
Launched: 2021
Standard: EMVCo-based

QRPh (QR Philippines) is the national QR payment standard. Supported by GCash, Maya (PayMaya), and all BSP-regulated banks. While adoption is still growing compared to Malaysia and Singapore, the Philippines has one of the highest e-wallet penetration rates in Southeast Asia due to GCash's massive user base (over 90 million registered users).

The EMVCo QR Standard: Enabling Interoperability

EMVCo (owned jointly by American Express, Discover, JCB, Mastercard, UnionPay, and Visa) published the EMV QR Code Specification for Merchant-Presented QR Codes to standardize payment QR codes globally.

Key elements of an EMVCo-compliant merchant QR code:

• Payload Format Indicator (Tag 00): Must be "01" for EMVCo MPM
• Point of Initiation Method (Tag 01): "11" for static QR, "12" for dynamic QR
• Merchant Account Information (Tags 26–51): Network-specific merchant ID fields
• Merchant Category Code (Tag 52): ISO 18245 MCC code
• Transaction Currency (Tag 53): ISO 4217 numeric currency code
• Transaction Amount (Tag 54): Optional in static QR, mandatory in dynamic
• Country Code (Tag 58): ISO 3166-1 alpha-2
• Merchant Name (Tag 59) and Merchant City (Tag 60)
• CRC (Tag 63): 4-character CRC-16 checksum for data integrity verification

DuitNow, PayNow SGQR, PromptPay, and QRPh are all built on this EMVCo foundation, which is why cross-border QR payments between these countries are technically feasible — the underlying data structure is compatible.

How to Set Up QR Payments as a Merchant

Step 1: Choose Your Registration Channel

In most countries, you register for a merchant QR code through:

• Your business bank: Most banks offer QR merchant registration through their business banking portal
• Payment facilitators: Companies like Stripe, iPay88, Razer Merchant Services (MY), or PaySG (SG) handle registration and provide a QR code along with analytics
• E-wallet providers: GrabPay, Touch 'n Go, GCash etc. each have their own merchant onboarding — though for national interoperable QR (DuitNow, SGQR), you want the national standard, not individual wallet codes

Step 2: Gather Required Documents

Standard requirements for merchant QR registration:

• Business registration certificate (SSM in Malaysia, ACRA in Singapore, ROC in India, etc.)
• Business owner/director's identity document
• Bank account details (the account where payments will be settled)
• Business address and contact details
• Nature of business / MCC code (usually assigned by the payment provider)

Step 3: Obtain and Display Your QR Code

Once approved, you'll receive a QR code image file and typically a printed merchant QR stand or sticker. Best practices for display:

• Print at minimum A5 size (148 × 210 mm) for counter display — larger than you think you need
• Laminate to protect from spills and wear
• Position at eye level and customer-facing at the payment point
• Include your merchant name visibly next to the QR code — customers should be able to verify the name in their payment app matches what they see printed
• Display accepted payment method logos (DuitNow, PayNow, etc.)

Step 4: Verify Transactions

For static QR codes where the customer enters the amount:

• Enable SMS/push notifications from your bank for incoming transfers
• Ask customers to show their payment confirmation screen before releasing goods
• For high-value transactions, verify in your banking app before proceeding
• Consider a dynamic QR system (via payment gateway) for high-volume or high-value merchants — it generates a new QR per transaction with the exact amount pre-filled, reducing errors

Security: QR Payment Risks and How to Mitigate Them

QR Code Substitution Fraud

The most common QR payment scam: criminals place a fake QR code sticker over a legitimate merchant's QR code. Payments go to the fraudster's account. Merchants should:

• Inspect your QR code daily for signs of tampering or overlay stickers
• Use a QR code holder that makes sticker overlay visible
• Consider lamination that shows damage if peeled
• Register your QR with your bank's fraud monitoring program

Phishing QR Codes (QRishing)

Fake QR codes directing customers to counterfeit payment pages. Customer-side protection: always check the merchant name displayed in the payment app after scanning — it should match the physical merchant name.

Social Engineering

Fraudsters sometimes contact merchants claiming to be payment support and send a "replacement QR code" — which routes to their account. Always obtain QR codes only through your bank's official app or portal.

Cross-Border QR: The Future is ASEAN-Wide

One of the most significant developments in QR payments is the expansion of cross-border linkages:

The vision: a tourist from India can scan a merchant's QR code in a Kuala Lumpur market and pay directly from their Indian bank account in INR, with settlement handled by the interconnected payment networks at real-time FX rates. This is increasingly real, not theoretical.

Conclusion

QR code payment systems represent one of the most successful technology-driven financial inclusion stories of the past decade. By requiring only a smartphone — not a card reader, not a bank account with a card, not a Western financial infrastructure — they've enabled micro-merchants in emerging markets to accept digital payments for the first time.

For merchants operating in Malaysia, Singapore, India, Thailand, or the Philippines: QR payment acceptance is now a business requirement, not an option. The setup is free or very low cost, transaction fees are minimal or zero for small amounts, and the customer experience is as fast as any card payment.

Generate your merchant payment QR codes — including DuitNow, PayNow, and UPI formats — using our free QR code generator. For a technical deep dive into the encoding format, see our guide to payment QR code setup.