Malaysia has become one of the most QR-reliant economies in the world. Just last year, we ranked second globally for QR code payment adoption, at 66.1%. We’re only behind China, which leads at 67.4%. Now, BNM’s Interoperable Fund Transfer Framework is set to change how all of that connects.
DuitNow QR, which runs on PayNet’s infrastructure, is a critical juncture for this trajectory. For context, the nationwide total for registered DuitNow QR touchpoints has crossed 3 million.
Despite all these achievements, what’s been lacking is connectivity across QR codes. The new BNM Interoperable Fund Transfer Framework (IFTF) sets a 30 June 2028 deadline to change that, folding these closed networks into one shared system.
In practical terms, that means no more separate Boost or Touch ‘n Go QR codes at the counter. Any remaining closed-loop scheme run by a bank or e-wallet must be wound down. From 2028 onwards, the interoperable QR standard becomes the single standard.
Every merchant with a QR standee and every consumer with an e-wallet in Malaysia will see the change firsthand.
Now, what do we make out of all of this?
What is a Proprietary QR network?
A proprietary QR network is a closed loop. A merchant signs up with one provider, that provider issues the QR code, and only customers using the same provider’s app can scan and pay it. A different wallet gets rejected.
Malaysia ended up with several of these loops running in parallel. A single hawker stall might display three or four separate QR codes, one per network, because no single code could accept everyone.
Customers kept balances loaded across multiple apps, and merchants managed multiple accounts and reconciliations.
That fragmentation is what BNM is removing.
Who Does the Interoperable Fund Transfer Framework Apply To?
BNM’s Interoperable Fund Transfer Framework covers banks, Islamic banks, development financial institutions, e-money issuers, payment system operators and registered merchant acquirers.
Banks offering QR payments must allow their customers to pay any merchant connected to the shared system, not only merchants that use the same provider.
Similarly, merchant acquirers, which are the firms that sign shops up to accept payments, must allow those merchants to receive QR payments from customers of any participating institution.
What Happens to the Closed Networks?
Proprietary QR schemes have to be fully phased out by 30 June 2028.
During the transition, the institutions running them cannot onboard any new merchants onto the closed systems. Existing arrangements can wind down, but they cannot grow.
While the Real-time Retail Payments Platform (RPP) operated by PayNet is set to absorb mainstream payment networks, BNM does provide a narrow exception.
If an acquirer has a contract with an e-money issuer that sits outside the shared infrastructure (in practice, standard and limited-purpose EMIs, which aren’t required to join), it can still run a closed QR scheme. But that scheme can only serve customers of that one wallet.
Outside of this specific carve-out, existing closed arrangements must completely wind down.
Why is BNM Doing This Now?
When a payment habit becomes this widespread, fragmentation stops being a minor annoyance and starts working like a hidden cost across the system.
Merchants pay to maintain several acceptance points. Consumers spread money across several apps. New entrants struggle to compete because they cannot reach merchants locked into a rival’s closed network.
Shared infrastructure like the BNM Interoperable Fund Transfer Framework targets all three at once. A new wallet only has to connect to one platform to reach every merchant on it, which lowers the barrier for smaller players trying to enter the market.
What Else Does the Framework Cover Beyond QR Codes?
While the QR mandate has grabbed headlines, the framework also covers account-to-account (A2A) transfers. These are the everyday acts of sending money from one bank account or e-wallet to another. The second is QR payments to merchants.
For A2A transfers, banks and eligible e-money issuers must join a shared payment infrastructure and let their customers send money to customers of any other institution on the same system. It does not matter which bank or wallet the recipient uses.
They must also let customers register their details in the National Addressing Database. This is the directory behind the familiar experience of transferring money to someone’s mobile number instead of typing out a full account number.
The framework goes beyond Malaysia, too.
Banks on a shared payment infrastructure that offers a cross-border service must let their customers send money overseas through it, following a timeline set out in the framework.
BNM has said the timing for cross-border requirements will follow the launch of the Nexus scheme (a multi-country initiative to link national instant-payment systems so cross-border transfers work like domestic ones), with details to be announced later.
The treatment differs by transaction type, though. For account-to-account transfers, non-bank players like e-money issuers are encouraged, rather than required, to offer cross-border services.
Cross-border QR purchase payments are another matter: eligible e-money issuers on an infrastructure with a cross-border service must enable them, just like banks, unless BNM determines in writing that doing so would pose a material risk to the institution or the infrastructure.
Notably, once an institution starts offering cross-border transfers, any request to stop the service later has to be assessed by the infrastructure operator, in consultation with BNM, to make sure users are not left stranded.
What Should Malaysian Consumers Know?
For one, consumers should know that financial institutions must offer eligible domestic fund transfers of up to RM5,000 per transaction for free. This is provided that the money comes from a current account, savings account or e-money account.
The framework also sets consumer protection requirements. These cover online transaction limit controls, instant notifications when money moves, real-time balance checks, clear pricing disclosures, data protection obligations and safety alerts.
On top of all these, if a request comes in from a consumer and the consumer consents, a financial institution may disable instant notification services for transactions made or received. Before doing this, though, the financial institution has to make it clear that there are risks involved with disabling the service.
How Unified QR Codes Changed Singapore and Indonesia
Other Southeast Asian countries have enabled QR codes on one rail. Singapore and Indonesia moved earlier, and their results give a sense of what interoperability tends to deliver.
Singapore launched SGQR in September 2018, which the Monetary Authority of Singapore has referred to as the world’s first unified payment QR code. Before its arrival, a merchant wanting to accept several wallets had to display a separate code for each, from PayNow to GrabPay to DBS PayLah!.
SGQR combined them into a single label that worked with 27 payment schemes at launch. The country has since gone further with SGQR+, which lets a merchant accept a wide range of local and foreign schemes through a single acquirer.
The clearest payoff has been at the counter, aside from it lowering the barrier for foreign wallets to plug into the Singapore market.
Next, Indonesia has QRIS, introduced by Bank Indonesia in 2019. By late 2025, QRIS counted more than 58 million users and over 41 million merchants, the overwhelming majority of them micro, small and medium enterprises (MSMEs). Transaction volume also hit 10.33 billion in 2025.
If a single unified framework could do that much for other markets, the ceiling for one that starts with the second-highest QR payment adoption could be considerably higher.
By 30 June 2028, we will find out just how high.
Featured image edited by Fintech News Malaysia based on an image by freepik on Magnific
