Recent media reports said China will soon release regulations that will effectively legalize payments using quick-response (QR) codes. For more than two years, QR code payment services, which include the popular Alipay and Tenpay, have existed in a regulatory gray zone, banned by the government, yet still continue operating. The rapidly expanding market has encouraged the government to finally sign off on the services, and even some State-owned banks have expressed interest in the technology. But with Alipay and Tenpay already dominating the market, it will be hard for any new entrant to get a foothold, experts said.
China is expected to roll out regulatory standards for payments through quick-response (QR) codes by the end of this month, effectively ending a ban the government imposed two years ago, media reports said last week.
For those people accustomed to buying things using QR codes on their smartphones, it was somewhat baffling to learn that this manner of payment has been in regulatory limbo since the ban.
In March 2014, the People's Bank of China (PBC), the country's central bank, called a halt to QR code payments, citing security concerns. But due to the relatively loose implementation of the suspension, China's major third-party payment service providers such as Alipay and Tenpay continued to use QR code payments.
The stakes have grown as QR code payments have become a primary way people pay for things with their mobile phones.
In the first quarter of this year, mobile transactions handled by third-party payment services providers surged 202.6 percent year-on-year and 33.4 percent quarter-on-quarter to 6.2 trillion yuan ($934.8 billion), according to data from Beijing-based market consultancy iResearch.
The rapidly expanding market has not only accelerated the legalization of QR code payments, which will end a regulatory gray zone for the service, but has also aroused interest from banks and other State-backed institutions, experts said. While the new standards will probably serve as guidelines for them to enter the market, it will be difficult for any new entrant to make a mark on a mobile payment market which is already dominated by Alipay and Tenpay.
Not much left to do
The PBC has officially authorized the Payment & Clearing Association of China (PCAC) to work with its members, which include banks and payment service providers, on rules for QR code payments, State broadcaster China Central Television reported last week.
A draft of the regulations, which specifies technical and business standards as well as requirements for the protection of personal information, capital security, encryption measures and storage of sensitive information, has already gone through public comment procedures, the report said, adding that the PCAC will likely issue the new regulations by the end of August.
A peek at the draft shows that the new regulations will ask payment service providers to verify QR code payments with a combination of static passwords, secure authentication through digital certificates or electronic signatures and verification of a one-time password or biometric such as a fingerprint.
The service providers will also have to set limits on how much each user can transfer each day, based on each individual's risk level.
The new regulations will officially legalize QR code payments, and technically speaking, there isn't much left for the established players such as Alipay and Tenpay to adopt, said Mu Chu, an analyst from mpaypass.com.cn, a Shenzhen-based mobile payment intelligence provider.
"But to a certain extent, the new regulations could be a constraint for them because in the future, any misconduct needs to be subject to regulatory supervision," Mu told the Global Times on Thursday.
According to Liu Dingding, an independent industry analyst, third-party payment services providers have the best cyber security teams, so even without regulations emphasizing security, they will still work hard to protect their users.
"Most of the theft cases involving mobile payments have been due to consumers accidentally revealing of their personal information, rather than because of vulnerabilities in the payment system," Liu told the Global Times on Thursday.
Before the PBC suspended QR code payments due to security concerns in March 2014, customers had been required to scan a QR code provided by the vendor, which was supposed to redirect customers to a payment page on their smartphones to complete the payment.
But the services could be easily abused by criminals, exposing customers to heightened security risks on the Internet. The code offered by the vendors could contain viruses allowing hackers to steal money from users' accounts.
Several months later, both Alipay and Tenpay improved their QR code payments and started heavily promoting the service on mobile.
Take Alipay as an example. Its current practice is to allow vendors to scan customers' QR codes generated by their Alipay wallets on the smartphones, thus shifting the risk from the customers to the vendors.
State interest
When the central bank imposed the QR code ban, some critics said regulators intended to protect China UnionPay, the State-owned bankcard association, because QR code payments circumvent its network.
Nevertheless, the fact that regulators allowed QR code payments to continue shows that State-backed institutions didn't care much about such a small part of the payment business, Mu said.
"What third-party payment service providers did at that time was serving the needs of customers who needed to make a lot of small transactions every day, which was something banks and other institutions didn't bother with," Mu said.
"It was not until the mobile payment market grew to a certain level that banks and other institutions started showing interest."
During the first quarter of this year, China's banking institutions handled 793.97 trillion yuan worth of electronic payments, including 52.13 trillion yuan in mobile payment, according to data from the central bank.
Once Tencent and Alibaba paved the way for mobile payments, UnionPay jumped on the bandwagon in 2015 by establishing its QuickPass payment service, which allows users to make payments by holding their smartphones equipped with near-field communication (NFC) chips to the QuickPass point-of-sale terminals.
"Though the NFC technology is more convenient and secure than QR code scanning, it didn't gain much market share," Liu said.
"The technology hasn't taken off, perhaps because it requires both customers and vendors to have NFC-enabled devices."
After the news broke about the QR code regulations, China UnionPay said it would also develop QR code payments as part of its services.
In July, State-owned Industry and Commercial Bank of China also launched a QR code payment service to facilitate its mobile payment business.
From the perspective of banks, the new regulations will provide them with guidance as to how to enter the market, Mu noted.
But he also pointed out that because Alipay and Tenpay both have their distinctive advantages, it will not be that easy to dislodge them from the mobile payment market.
