The new regulation focuses five aspects of payment security:
1. Business licenses: Non-bank payment processors should get a specific Internet Payment Business License to provide a bar code payment service.
2. Clearing requirement: Banks and payment processors should clear their interbank bar code payment business through the PBOC clearing system or a legally registered clearing entity and cannot use direct connections to clear payments.
3. Regulate business scope: Payment processors should not conduct security, insurance, loan, financing, wealth management, guarantee, currency exchange or cash deposit/withdrawal services based on their payment business.
4. Require fair market competition: Banks and payment providers should price their fees by referring to bank card payment charges and should not subsidize or provide below-cost prices to eliminate competitors or distort the market.
5. Rank risk levels and limits according to verification mode: The regulation states that banks and payment processors need to follow the new payment risk prevention standards and apply different payment limits according to verification methods.
|
Risk Prevention Ability |
Transaction Verification Method |
Transaction Limit (per person/day) |
||
|
Bank account (per bank account) |
Payment Processor (All payment accounts) |
|||
|
Dynamic Barcode |
Level A |
Verified by two different pieces of identification including a digital certificate or electronic signature. |
Independent Agreement |
Independent Agreement |
|
Level B |
Verified by two different piece of identification excluding a digital certificate or electronic signature. |
RMB 5,000 |
RMB 5,000 for all payment accounts |
|
|
Level C |
Verified by one piece of indentification or no verification. |
RMB 1,000 |
RMB 1,000 for all payment accounts |
|
|
Static Barcode |
Level D |
Only use static barcode |
RMB 500 |
RMB 500 for all payment accounts |
More security, little customer impact
This new regulation requires a lot of payment details to further guarantee account security, but for the most part, it should be seamless for the consumers once their account is setup. The change is important though as barcode payment is convenient for users, but it is easily thwarted by criminals and mobile cameras or cashier scanners cannot detect risks and alterations to the system. If someone hacked a bar code scanner, a user’s bank account could easily be drained.
Apart from providing a more secure payment environment, the only effect on the payment itself is that transactions over RMB 500 require a dynamic, not static barcode. This shouldn't be a huge issue as the PBOC indicated that 95% of barcode payments are less than RMB 500; the average transaction amount in the first half year of 2017 was RMB 108.
Impact on payment processors unclear
This is very first regulation on barcodes in the industry. Previously there was no requirement on qualifications to start a barcode payment business, however, now only processors with the required licenses can conduct such business. So there certainly will be an impact on the top players, but it is a bit unclear what the impact will be. This likely isn't the end of mobile payment regulation either. We should likely see additional follow-up regulations on fees, competition campaign and payment technology standards.
However, the processors are not waiting around to find out what the impact will be and have begun agressive marketing campaigns. WeChat Pay launched a ‘red pocket shop’ in October 2017 where users receive coupons or discounts when using WeChat wallet. In one month’s time, Tencent distributed nearly 200 million cash discounts. Alipay started a RMB 1 billion marketing campaign shortly after. Users use a coupon code in the app to get cash discounts every day, which has significantly increased the app's daily active users.