DuitNow QR

TypeQR Code

PrimaryMY

MentionedMY

Completeness89%high

Overview

DuitNow QR is Malaysia's national unified QR payment standard, operated by PayNet (a Bank Negara Malaysia subsidiary established in 2017) under the BNM Interoperable Credit Transfer Framework (ICTF) [1, my-cro]. The DuitNow service launched in 2019, with DuitNow QR following shortly after as its merchant-presented QR layer; technical foundation is the EMVCo Merchant-Presented Mode (MPM) specification [1, 2]. In 2025 DuitNow QR processed 3 billion transactions (more than doubled from ~1.5 billion in 2024) across ~3 million registered merchant touchpoints; at the PayNet network level, total digital-payment volume crossed 8.44 billion transactions in 2025 (~23 million per day), with the average Malaysian making 538 cashless payments per year MY. Cross-border QR connectivity links Malaysia with Singapore, Thailand, Indonesia, China, and Cambodia; cross-border QR transactions grew 2.5× to 29.7 million in 2025, with India's UPI link slated for 2026 MY.

History

PayNet (Payments Network Malaysia Sdn Bhd) was established in 2017 as a consolidation of MEPS and MyClear, making it the sole national payment infrastructure operator overseen by Bank Negara Malaysia [3, my-cro]. PayNet is owned by 11 commercial banks with BNM as the largest shareholder MY.

In January 2019 PayNet went live with DuitNow Real-Time Retail Payments Platform (RPP) using ACI Worldwide's UP Real-Time Payments solution — the underlying instant-credit-transfer rail [2, 4]. The QR layer DuitNow QR followed in 2019 as the merchant-presented profile [1]. It was Malaysia's first national QR standard, deliberately designed for interoperability across banks and e-wallets rather than per-issuer fragmentation.

Adoption timeline [my-cro, 4]:

2019: DuitNow + DuitNow QR launch.
2023–2024: Cross-border bilateral integrations with Singapore (PayNow), Thailand (PromptPay), Indonesia (QRIS), China (Alipay+).
September 2024: Cambodia (Bakong) cross-border QR live.
August 2024: India UPI ↔ PayNet linkage announced (PM Modi–PM Anwar agreement).
August 2024: National Fraud Portal launched by BNM with PayNet and 16 institutions (anti-mule-account, real-time fraud response).
October 2025: New standardised DuitNow QR standee design rolled out (RHB Bank, Bank Islam, MBSB, Agrobank as early adopters).

Technical specification

DuitNow QR is an EMVCo Merchant-Presented Mode (MPM) profile [1, 5]. PayNet ships official integration material at docs.developer.paynet.my, including SDKs and Java sample applications for signing/verifying DuitNow QR JSON API messages [1].

EMVCo MPM foundation [5]:

Payload format: TLV (Tag-Length-Value) plain-text string, Payload Format Indicator (tag 00) = "02" in DuitNow QR per PayNet's QR Data Object spec [11].
Point of Initiation Method (tag 01) = "11" (static) or "12" (dynamic).
Integrity: CRC-16/CCITT-FALSE appended as field 63 (4-character alphanumeric).
Supports static and dynamic QR variants.

DuitNow-specific Merchant Account Information template (tag 26) [11]:

Sub-tag 00 (AID) = A0000006150001 — the Malaysia DuitNow Application Identifier.
Sub-tag 01 (Acquirer ID) — up to 6 characters, assigned by PayNet.
Sub-tag 02 (QR ID) — merchant/recipient identifier issued by the acquirer.
Sub-tag 03 (Merchant Descriptor) — optional, up to 20 chars.
Sub-tag 04 (Mobile Number) — optional, up to 15 chars.
Tag 27 is reserved for future use [11].

Header tags (DuitNow profile) [11]:

Tag 52 (Merchant Category Code) = 0000 for P2P, 6010 for POS Cash Out, or a standard MCC for merchant payments.
Tag 53 (Currency) = 458 (MYR, ISO 4217).
Tag 54 (Transaction Amount) — conditional; numeric, single decimal point allowed.
Tag 58 (Country Code) = MY.
Tag 59 / 60 — merchant name (≤25 chars) and city (≤15 chars; "MY" if not applicable).

JomPAY interoperability — tag 62 (Additional Data) is required for JomPAY QR codes and carries sub-tags 90 (RRN) and 91 (RRN2) so that JomPAY bill-presentment references survive a DuitNow QR scan [11].

Data integrity hash (uncommon) — tag 82 (Data Integrity) is an optional SHA-256 hash per ISO/IEC 10118-3 that DuitNow QR carries to let the scanning app verify the payload was not tampered with [11]. Most EMVCo MPM national profiles do not expose an integrity hash beyond the 16-bit CRC; DuitNow QR's tag-82 SHA-256 is one of its distinctive technical choices.

Service modes supported [1]:

Merchant-Presented QR (MPM) — merchant displays a QR (static or dynamic); customer scans with their banking/wallet app to pay. Covers domestic and cross-border (inbound + outbound) transactions.
Consumer-Presented QR (CPM) — customer displays a QR from their app; the merchant's POS scans it. Domestic only.

Settlement uses the underlying DuitNow real-time credit transfer rail (PayNet RPP / FPX rails) — settles in seconds MY.

DuitNow ID types for the addressed account MY:

Mobile number
NRIC (national ID)
Passport number
Business registration number
Army / police number

Currency code: MYR (458).

Transaction limits MY:

Consumer: MYR 50,000 per transaction
Business: MYR 10,000,000 per transaction

Integration APIs [1]:

Network administration (sign on/off with DuitNow)
QR generation specification (per-merchant onboarding)
Reversal services (refunds, disputed transactions)
Both Acquirer APIs and Issuer APIs across domestic, cross-border outbound, cross-border inbound, and consumer-presented transaction types

Use cases

DuitNow QR is the merchant-acceptance default across Malaysia and increasingly across the ASEAN region for inbound tourism payments:

Retail point of sale — every kind of merchant from hawkers and pasar malam stalls to chain supermarkets displays a DuitNow QR. 3 billion transactions in 2025 (more than double 2024's ~1.5 B), with 538 cashless payments per Malaysian per year MY.
F&B / hospitality — universal acceptance via the participating-banks-and-e-wallets interoperability.
E-commerce checkout — dynamic DuitNow QR generated per cart; customer scans with home banking app.
Bill payments — utility, telecom, insurance, government fees.
Cross-border tourism — Malaysian tourists abroad scan SGQR / PromptPay / QRIS / Bakong / Alipay+ with their Malaysian wallet; foreign tourists in Malaysia scan DuitNow QR with their home app MY.
Alipay+ inbound — handles ~80 % of inbound tourism QR payments via the Alipay+ cross-border network MY.

Government and BNM policy alignment: DuitNow QR adoption is tracked against the Financial Sector Blueprint 2022–2026 target of 15 %+ annual e-payment transaction growth, which Malaysia has been exceeding MY.

Implementations

The official integration channel is PayNet's developer portal (docs.developer.paynet.my) with Java SDKs and sample applications for JSON API message signing and verification [1]. Direct integration is bank- and e-wallet-mediated; community open-source libraries are thin.

Open-source encoders/decoders:

Repo	Language	Stars	License	Last release	Notes
natsu90/duitnowqr-test	JavaScript	15	—	active 2025	The most-cited community DuitNow-specific generator, built via reverse engineering of production QRs because PayNet's full spec is documentation-gated. Includes a working `generateDuitNowStr` function with merchant parameters (app ID, MCC, name, city, postcode, reference labels) [6]
mvallim/emv-qrcode	Java	128	Apache-2.0	v0.1.5, May 2026	Full MPM v1.1 + CPM v1.1 encode/decode with CRC16 + duplicate-tag checks; populate tag-26 sub-tag `00 = A0000006150001` for DuitNow [10]
mercari/go-emv-code	Go	70	MIT	v0.1.5, Aug 2023	Encoder/decoder for both Merchant- and Consumer-Presented modes; production-grade Go reference [12]
dongri/emv-qrcode	Go	58	—	2024	Independent Go MPM/CPM encoder/parser [13]

DuitNow QR is structurally an EMVCo MPM payload, so any compliant TLV encoder/decoder works at the wire-format level once tag-26 sub-tag 00 is configured with the Malaysia AID A0000006150001. Production integration still requires merchant onboarding through a PayNet acquirer who issues the sub-tag 01 Acquirer ID and sub-tag 02 QR ID.

Official PayNet SDKs. PayNet ships Java SDKs and sample applications at docs.developer.paynet.my for signing and verifying both XML and JSON API messages around DuitNow QR (network sign-on/off, QR generation, reversals); these are the canonical integration surface for licensed acquirers and issuers [1].

Production wallets (canonical implementations) MY:

Maybank MAE — leader in cross-border DuitNow QR adoption (83 % growth in QR payment value in 2024)
Touch 'n Go — leading non-bank e-wallet
GrabPay MY
Boost
ShopeePay
All major bank apps: Maybank2u, CIMB Clicks, RHB, Public Bank PBe, Hong Leong Connect

Payment gateway / acquirer SDKs:

Omise — provides DuitNow QR integration for international merchants [7]
HitPay — retail POS integration guide [8]
Standard Chartered — bank-mediated merchant integration [9]

Comparison

vs. sgqr (Singapore) and promptpay-qr (Thailand) — Same EMVCo MPM technical family; same central-bank-affiliated payment-operator pattern; launched in the same 2018–2019 window. SGQR is uniquely broad in its scheme participation (24+, including international card networks); DuitNow is more focused on Malaysian banks + e-wallets. PromptPay is bank-rail-only. All three are now interconnected via direct bilateral integrations as part of the ASEAN cross-border QR mesh [my-cro, sg-cro, th-cro].

vs. qris (Indonesia) — QRIS is Bank Indonesia's national unified QR (also EMVCo MPM based, launched August 2019). The two are direct regional peers in design and timing. DuitNow ↔ QRIS cross-border QR went live in 2023 MY.

vs. upi-qr (India) — Different technical lineage: UPI uses a upi://pay?... deep-link URI, DuitNow uses EMVCo TLV. The August 2024 UPI ↔ PayNet bilateral agreement (PM Modi–PM Anwar) requires a bridge that translates between the two formats at the network boundary [my-cro, in-cro].

Fun facts

DuitNow QR doubled in transaction volume year-over-year in 2024: 360 M transactions in 2023 → 870 M in 2024 (+142 %), with transaction value growing from MYR 14.6 B to MYR 31.1 B (+113 %) MY. This is one of the steepest year-over-year national QR adoption curves on record, second only to the early-Pix Brazil ramp.

Alipay+ handles ~80 % of inbound tourism QR payments in Malaysia MY — DuitNow QR's inbound scanning by Chinese tourists is largely mediated through Alipay+ rather than a direct China–Malaysia bilateral integration. This is a notable departure from the bilateral-central-bank-link pattern used for SG, TH, ID and KH.

Malaysia is a founding member of the BIS's Project Nexus initiative for multilateral cross-border instant payment connectivity MY. Nexus aims to replace bilateral country-to-country payment-system links (the current operating model for DuitNow's cross-border footprint) with a single multilateral hub. If Nexus delivers, DuitNow QR could become reachable from any participating country without per-country integration work.

SHA-256 payload-integrity hash, not just CRC. DuitNow QR's wire format reserves tag 82 as an optional ISO/IEC 10118-3 SHA-256 hash over the payload — a per-payload cryptographic integrity field on top of the standard CRC-16 [11]. Most EMVCo MPM national profiles (VietQR, QRIS, PromptPay, TR QR Code, etc.) stop at the 16-bit CRC; DuitNow's tag-82 is an unusual nod toward tamper-evidence at the QR-payload layer itself.

One QR, two national rails. Tag 62 Additional Data on a DuitNow QR can carry JomPAY reference numbers (sub-tags 90/91 RRN/RRN2), so a printed code can act simultaneously as a DuitNow merchant payment and a JomPAY bill — two of Malaysia's national rails sharing one EMVCo MPM container without an extra MAI template [11].

Reverse-engineered as the public spec. The most-cited open-source DuitNow QR encoder (natsu90/duitnowqr-test) was built by reverse-engineering production QRs because PayNet's full TLV layout sits behind a developer-portal login. The community had to scan, decode and document the format to produce a usable library — a recurring pattern in national-QR standards where the spec is "open" only to licensed acquirers [6].

Status

Active and growing fast. Latest metrics MY:

3 billion transactions / year (2025), +100 % YoY from ~1.5 B (2024)
MYR 31.1 billion annual value (2024), +113 % YoY
40+ participating banks and e-wallets
5 cross-border QR partner countries (SG, TH, ID, CN via Alipay+, KH)
8th country bilateral planned: India (UPI ↔ PayNet announced August 2024)

The October 2025 rollout of a new standardised DuitNow QR standee design indicates continued PayNet investment in consumer recognition. The 2024 National Fraud Portal addition is a security-stack maturation step rather than a change to the QR format itself.

No deprecation planned. Malaysia is positioned as a leading-edge implementer in the ASEAN cross-border QR network and Project Nexus, suggesting DuitNow QR will remain the canonical Malaysian merchant standard well beyond the FSB 2022–2026 planning horizon.

Sources

Deployments

Found in the following country reports (grep across reports/countries/):

MY — MY-malaysia.md