Category: Regulations

  • Indonesia’s QRIS Payment Scales Up—But Faces Headwinds

    Indonesia’s QRIS Payment Scales Up—But Faces Headwinds

    When a warung owner in Yogyakarta scans a customer’s phone these days, the payment hurtles through Bank Indonesia’s Quick Response Code Indonesian Standard (QRIS) and lands in her account seconds later. That ubiquity is by design: the scheme has signed up 56 million users, conducted 2.6 billion transactions representing Rp 262 trillion (approximately US$15.5 billion) in value, and recently recorded a 169% year-over-year increase. It now reaches small businesses and low-income groups in Indonesia, defining everyday commerce. Yet Jakarta’s leading fintech is facing criticism.

    In its 2025 National Trade Estimate report, the U.S. Trade Representative (USTR) argues that QRIS—and the wider National Payment Gateway—locks foreign players out by capping ownership (20% for switching, 49% of voting shares for e-wallets), forcing local data processing and, crucially, leaving international stakeholders neither informed nor consulted during rule-making.

    What’s Really at Stake?

    For Indonesia, QRIS is more than a payment standard; it is a digital public utility woven into a national sovereignty narrative. Officials point out that U.S. schemes still dominate high-value card spend, while QRIS levels the playing field for micro-merchants who could never afford a POS terminal. Bank Indonesia’s senior deputy governor Destry Damayanti even extended an olive branch: “If America is ready, we’re ready—why not collaborate?” Cooperation, she stressed, would not come at the expense of local control.

    Still, continued tensions with Washington could slow QRIS’s rollout in countries like India and South Korea, despite its successful integration with Singapore, Malaysia, and Thailand. Its label as a trade barrier also risks limiting overseas opportunities for Indonesian small businesses, even though the system was designed to streamline domestic and cross-border transactions.

    Behind the diplomatic smile lies a hard-nosed strategy. QRIS is already interoperable with Malaysia, Thailand, and Singapore; technical testing is in late stages with China, India, and South Korea, and a UnionPay pilot is pencilled in for Indonesia’s Independence Day, 17 August 2025.

    Every new corridor cements Jakarta as the network’s gravitational centre. That growing hub status makes QRIS not only a source of national pride, but also a geopolitical asset in Southeast Asia’s digital economy. Its expansion reflects Indonesia’s ambition to shape, not just adopt, global fintech norms.

    Washington’s Leverage—And Its Limits

    The trade spat is part of a broader negotiation over proposed 32% U.S. tariffs on Indonesian goods. During April talks in Washington, Economic Chief Airlangga Hartarto confirmed that national payment systems and QR code standards are on the bargaining table, even as he demanded a fair relationship that respects Indonesia’s policy space.

    American complaints do land on sympathetic ears among some Indonesian fintechs, who privately grumble that local-processing mandates increase cost and latency for cross-border settlements. Yet political reality favours the status quo. QRIS underwrites a populist promise—an instant, cash-lite economy owned by Indonesians. No minister wants to be remembered for diluting that pledge at the behest of foreign card giants.

    The Road Ahead

    • Negotiated tweaks, not a U-turn. Jakarta could offer procedural transparency—formal comment periods, perhaps a higher foreign-ownership ceiling for purely back-end tech suppliers—while preserving local switching control.
    • ASEAN cover fire. With Singapore and Malaysia already live on QR linkages, any U.S. WTO challenge risks alienating multiple Southeast Asian governments at once.
    • Time-based relief. Bank Indonesia’s own Payments Blueprint 2025 contemplates revisiting caps once domestic rails mature; Washington’s best bet may be to wait out the clock.

    A New Chapter of Global Trade

    QRIS has evolved from a domestic payment tool into a strategic pillar of Indonesia’s fintech agenda. While the U.S. may raise concerns—even hint at trade penalties—Jakarta is unlikely to retreat from an infrastructure that handles millions of daily transactions and is gaining regional traction. The friction reveals a wider pattern: as with chips and minerals, payment rails and infrastructure are now strategic assets. In this new era, digital standards are no longer just technical—they’re political.

  • Singapore Cracks Down on Foreign-Only Digital Token Services

    Singapore Cracks Down on Foreign-Only Digital Token Services

    On the 6th of June the Monetary Authority of Singapore (MAS) published a terse clarification with outsized impact: from 30 June 2025, any Singapore-incorporated firm that offers digital-token services solely to customers overseas must hold a Digital Token Service Provider (DTSP) licence—or shut down. In the same breath, the regulator warned that such licences will be granted only in “extremely limited circumstances,” citing money-laundering risk and the practical impossibility of supervising a business that has no Singapore-facing customer base.

    For years global exchanges and DeFi middle-layers treated Singapore as the perfect corporate perch: English law, deep capital markets, and a regulator friendly enough to issue sandbox exemptions while scrutinising domestic retail flows. The new stance flips that script. Offshore-only models—think liquidity-routing desks, token-issuance vehicles or staking pools headquartered in Singapore but serving India, Vietnam or Africa—now face a three-week countdown to licensing or exile. MAS knows exactly who they are; officials told Asian Banking & Finance they believe the group is “a very small number,” yet the message is aimed at the next wave of founders as much as the current cohort.

    Why MAS Is Pulling Up the Drawbridge

    The decision slots neatly into Singapore’s layering of digital-asset guardrails. Payment Services Act (PSA) licensing in 2020 brought exchange, transfer and custody businesses inside an AML/CFT perimeter. Stablecoin rules in 2023 imposed 100% reserve and audit requirements. Now MAS is closing what lawyers called the “locate-but-don’t-serve” loophole. In its June statement the authority argued that a firm with zero local users is harder to supervise, yet could still launder illicit proceeds through Singapore-based bank accounts. That risk calculus hardened after a S$3-billion money-laundering bust in 2023 that involved shell companies with nominally “foreign only” operations.

    Licensing is theoretically available, but MAS adds a twist: applicants must show “a meaningful nexus to Singapore’s digital-asset ecosystem.” Translation: a board of resident directors, local compliance staff, day-to-day decision-making plus a plan to serve domestic customers eventually. The bar is steep enough that MAS itself expects few, if any, approvals.

    Immediate Fallout: Move, Merge or Morph

    The clearest early signal came hours after the notice: WazirX, an India-focused exchange incorporated in Singapore, said it would redomicile to Panama and spin down its city-state entity before the deadline. Compliance advisers report a surge of calls from token-lending desks and yield-bearing stablecoin issuers asking whether a Cayman foundation plus Hong Kong operating subsidiary might keep Asian banking lines open without MAS approval. Banks, meanwhile, are triaging. One Singapore-based transactional-banking head tells me the “client continuance” review for every offshore-only crypto account is now top priority; cash accounts without a clear licensing path will be closed before MAS has to ask.

    The rule also reverberates through investor term sheets. Venture funds that tout Singapore legal entities as a badge of institutional readiness now face awkward renegotiations. “We liked the MAS halo,” one Series A fintech investor concedes, “but if the halo comes with an unpredictable licensing timeline, we’ll accept a UAE free-zone domicile just as happily.”

    Hub-and-Spoke No More?

    When MAS first floated a DTSP framework in 2022, the objective looked surgical: capture niche businesses such as crypto-on-ramp aggregators or token-issuance advisers that fell between PSA and securities law. Since then the policy mood has darkened. The June clarification states bluntly that the supervisory burden outweighs the benefits when all users sit abroad. Compare that with Hong Kong, which this year approved exchanges that pledge only professional-investor access and largely foreign order flow. Singapore’s pivot therefore redraws the Asian map: Dubai and Abu Dhabi become the obvious shelters for “serve-the-world” exchanges; Hong Kong vies for North Asian order books; Singapore doubles down on institutions, asset-tokenisation pilots and projects like JPMorgan’s Partior—use-cases where regulators can peer into every wallet.

    Data already hint at the divergence. MAS has granted just 16 in-principle approvals and 11 full licences under its Digital Payment Token category since 2020; Hong Kong’s SFC, by contrast, has okayed nine retail-facing exchanges in twelve months. If DTSP approvals prove rarer still, the city-state’s share of global spot-trading volume could fall even as it leads in permissioned pilots.

    What “Licence or Leave” Means for Compliance and Cost

    Obtaining a DTSP licence will not be a PSA redux. According to draft guidelines published last week, applicants must:

    • maintain minimum base capital of S$250,000 (higher if custody is involved);
    • appoint a Singapore-resident CEO and compliance lead;
    • demonstrate end-to-end chain-analysis for every supported token;
    • post an annual auditor’s report in MAS Form 3 within four months of fiscal year-end.

    Firms accustomed to remote-first staffing and offshore custody will need payroll, premises and local audit contracts—hard costs that erode the “light-touch HQ” appeal Singapore once offered.

    The AML bar is higher, too. Name-screening must cover both originator and beneficiary wallets, aligning with the FATF Travel Rule. MAS Notice FSM-N27 (issued alongside the clarification) spells out penalties up to S$1 million for each breach. In short: if a stablecoin desk cannot map wallet addresses to real-world names in real time, it will fail the licence test.

    Policy Rationale vs. Industry Concerns

    MAS insists the impact is contained. Officials told Asian Banking & Finance they see “only a very small number” of affected firms, and those are welcome to apply or pivot. Yet industry bodies counter that innovation suffers when sandbox graduates cannot scale globally from Singapore. The Singapore FinTech Association warns of a “talent drain” if engineers move with their employers to more permissive hubs. Lawyers note a tension: MAS promotes Project Guardian—its high-profile asset-tokenisation pilot with HSBC and UBS—while shutting the door on retail-lite crypto models that could feed liquidity to those very projects.

    MAS’s reply is unambiguous: quality over quantity. The regulator would rather host fewer, better-capitalised players than police a long tail of offshore profit centres. That stance dovetails with broader reputational goals after last year’s money-laundering scandal and ongoing U.S. pressure to tighten crypto AML standards.

    Comparison with Other Gateways

    JurisdictionLicence for offshore-only models?Typical approval timeNotable hurdles
    Singapore (DTSP)Yes, but “generally not issued”n/a (yet)Resident CEO, granular travel-rule compliance, capital S$250k+
    Hong Kong (VATP)Yes6-9 months98-point checklist, mandatory insurance, local cold-wallet storage
    Dubai (VARA MTL)Yes4-6 monthsTiered licence fees up to US$140k, substantial physical presence
    UK (FCA Crypto-asset register)Yes12-18 monthsAML focus, tough business-model scrutiny but no local-customer requirement

    For start-ups the lesson is that regulatory arbitrage is narrowing. A Singapore entity can still run offshore custody or marketing, but only with an MAS badge—otherwise founders might as well incorporate where that badge is easier to earn.

    What to Watch Before 30 June

    • Licence applications: MAS will reveal by mid-July how many firms applied; the number will signal whether industry views approval as plausible or pointless.
    • Bank de-risking: Expect local banks to demand DTSP licence evidence before extending credit lines beyond the deadline.
    • Migration wave: Tracker sites already log half-a-dozen Singapore entities reincorporating in the UAE and Panama.
    • Institutional pilots: Will MAS grant carve-outs for projects like tokenised Treasury repo platforms that currently serve offshore desks?

    The Bottom Line

    Singapore hasn’t slammed the door on crypto; it has narrowed the doorway to actors it can supervise face-to-face. For retail-lite exchanges, offshore staking pools and token-issuance SPVs, the message is blunt: become part of Singapore’s domestic ecosystem or pack your bags. Neat corporate structures that once signalled credibility now trigger higher scrutiny. As global regulators converge on AML expectations, the city-state is betting that being the well-lit room for digital assets is worth losing a few tenants who prefer the dark. Whether that bet lures more blue-chip tokenisation projects—or drives them to less demanding jurisdictions—will shape Asia’s crypto geography for years to come.

  • Hong Kong Lights Up Stablecoins, Yet Old Rules Dim the Glow

    Hong Kong Lights Up Stablecoins, Yet Old Rules Dim the Glow

    Hong Kong’s shiny new Stablecoin Bill is the best kind of progress: the sort that lets policymakers hold a ribbon-cutting ceremony while telling the rest of the world, “see, we’re open for business.”

    On May 21st, the Hong Kong LegCo waved the Bill through, giving the Hong Kong Monetary Authority (HKMA) clear authority to license any issuer of a fiat-referenced stablecoin sold to the public or backed by Hong Kong dollars. Issuers must keep 1-to-1 reserves, publish independent attestations, and offer same-day redemption – exactly the guard-rails investors have been begging for since “algorithmic” became a dirty word in 2022. Officials pitched the law as a “risk-based, same-activity = same-rules” upgrade to the city’s digital-asset playbook, and—credit where it’s due—it is.

    The carrot looks great. The stick—courtesy of the HKMA’s prudential playbook—could turn out to be a club.

    Since early 2024 the HKMA has been working to transplant Basel’s capital rules for crypto into local law. Under the draft Banking (Capital) (Amendment) Rules, exposures to anything that fails Basel’s “Group 1” quality tests—including most stablecoins—would attract eye-watering capital charges: up to a 1,250% risk-weight or an aggregate exposure limit of just 1% of Tier 1 capital. For banks, that is code for “don’t bother.” Consultation closed in February and the Authority aims to lodge the final rules with LegCo this quarter, for go-live on 1 January 2026.

    What does a “1,250% risk weight” really mean?

    Think of risk-weights as a banker’s seat-belt rule: the higher the number, the more of the bank’s own money (capital) it must set aside as a safety cushion for every dollar of exposure.

    AssetBasel risk weightCapital the bank must hold (8% of RWA)
    AAA government bond0%0¢ per $1 of bonds
    Typical corporate loan100%8¢ per $1 of loans
    Most crypto / “Group 2” assets1,250%$1 per $1 of crypto

    So at 1250%:

    • Every HK $10 million in stablecoins forces the bank to lock up HK $10 million of its own core equity.
    • That is money the bank can’t lend out, invest, or use to earn a return—it just sits in the vault as a fire-proof buffer.
    • By contrast, a normal corporate loan of HK $10 million only ties up HK $0.8 million in capital.

    In plain English: a 1250% risk weight tells banks, “If you want to touch this asset, be prepared to stump up a dollar for every dollar you hold.” For most balance-sheet managers, that’s a deal-breaker.

    Why that matters:

    • Liquidity needs a balance-sheet. Licensed issuers will still need banking partners for cash management and reserve segregation. If holding a client’s stablecoin float forces a bank to park 100 % of its own capital against the exposure, the economics break down fast.
    • Tokenised deposits collide with capital reality. Hong Kong’s e-HKD pilot and its Project mBridge experiments assume banks will someday tokenise real HKD deposits. Yet the prudential package treats most tokenised liabilities the same way it treats crypto—again, a 1,250% risk-weight if the token wanders outside Basel’s narrow “Group 1b” criteria.
    • Global banks will follow the harshest rule-set. The US and EU have yet to implement Basel’s crypto rules; if Hong Kong jumps first and hardest, foreign branch banks will simply cap local exposure rather than re-write balance-sheet models city-by-city.

    End result: you get a licensing regime that lets fintechs print compliant stablecoins—but no commercial bank is brave enough to hold or clear them at scale. Capital neutrality has been the secret sauce behind Hong Kong’s traditional FX market for decades; remove it and “stablecoin hub” becomes marketing, not market.

    Is there a middle path?

    The HKMA isn’t blind to the contradiction. Its January “soft consultation” floated an idea to recognise high-quality, fully-backed stablecoins—essentially pegged e-money with daily redemption—as Group 1 assets, subject to the same market-risk treatment as, say, dollars in a nostro account. Industry groups loved the sound of that but warned the definitions were still too tight. The ASIFMA response pointed out that requiring real-time, on-chain proof-of-reserve plus institutional-grade custody is doable, but only if banks get clarity that capital treatment will be closer to cash than to crypto roulette.

    Whether the regulator buys that argument will decide if the new Stablecoin Bill blossoms or withers. Delay the capital rules, carve out fully-backed coins, or align exposure limits with other high-quality liquid assets, and Hong Kong keeps its lead. Stay wedded to Basel’s harshest interpretation and licensed issuers will be forced to park their reserves offshore—or worse, watch Singapore sweep up the business.

    Bottom line

    Passing the Stablecoin Bill is like laying pristine asphalt on the start-up lane of a Formula E circuit. But if you slap a 25 km/h speed limit on every vehicle at the gate, don’t act surprised when the paddock stays empty. Hong Kong has proven—again—that it can pass sleek digital-asset laws quickly. Now it must prove it can square prudential orthodoxy with the innovation it’s so keen to court. If not, the only thing truly “stable” will be the city’s inability to turn legislation into living, breathing markets.

  • Payment Aggregator Licences Are India’s Next Fight Club

    Payment Aggregator Licences Are India’s Next Fight Club

    The Reserve Bank of India’s payment aggregator stamp has quietly become the most coveted badge in Indian fintech. Since January 2025, the central bank has issued just nine final approvals—PayU, BillDesk, Adyen and, in the past week alone, Quicktouch and Getepay—while hundreds of hopefuls remain in limbo. The figure is striking, given that over 185 companies applied for authorisation more than two years ago. A payment aggregator licence is beginning to look like a scarce operating permit—one that could decide who gets to dictate price, data access and bargaining power in India’s booming merchant-acquiring market.

    Licence scarcity and the coming knife-fight over merchants

    Every entity that touches customer funds on behalf of an online merchant must now hold a payment aggregator licence or risk being switched off. That alone invites turf wars, but scarcity supercharges them: with each new approval the remaining unlicensed rivals watch their addressable market shrink. Several fintechs have already whispered that licensed incumbents are nudging merchants to sign exclusivity clauses, arguing that “RBI-authorised” status shields them from regulatory surprises. Once the payment aggregator cohort settles around perhaps 60–70 entities, a plausible end-state given current approval rates, competition among the survivors could get messy.

    Pricing caps: the next round starts at 0.3%

    Into this mix walks a debate over merchant discount rates. A lobbying letter from the Payments Council of India, leaked late April, urges the Prime Minister’s Office to back a 0.3% MDR on large-ticket UPI transactions. Aggregators argue they need the fee to subsidise compliance overhead that now includes quarterly system audits, escrow maintenance and real-time fraud reporting. Consumer groups counter that any MDR will be passed straight to shoppers. RBI has not endorsed the PCI number, but officials tell journalists the Bank is “open-minded about sustainable economics” so long as small merchants stay shielded.

    The outcome matters because payment aggregator licences re-bundle costs that used to sit with disparate gateways and processors: escrow interest lost, collateral for settlement guarantees, periodic CERT-In audits, tokenisation infrastructure. Licensees need a revenue line to pay for those. If the MDR debate lands above zero but below 0.5%, the fight will turn on who can squeeze the most operating leverage from scale, data science and interchange rebates. Cut the cap any lower and only the best-funded aggregators will survive, cementing early movers’ dominance.

    Enter the Digital Competition Bill

    Scarcity and pricing power would normally bring the Competition Commission into the ring after the fact. This time the referee may arrive early. The Draft Digital Competition Bill (DCB), based on recommendations of the Committee on Digital Competition Law, is being polished for Parliament’s monsoon session and will give regulators ex-ante powers to label “systemically significant digital enterprises” (SSDEs) across nine “core digital services”, including payments. If passed in its current form, the bill could force the largest payment aggregators—think aggregators processing ₹1 trillion-plus a year—to pre-clear any preferential pricing, self-preferencing or exclusivity clauses and to open key APIs on fair, reasonable and non-discriminatory (FRAND) terms.

    Combine that with the RBI’s licensing scarcity and you get an intriguing tension: the central bank is narrowing the field to enforce safety and soundness, while the competition authority is preparing to police the victors for gate-keeping. Lawyers call it regulatory twin peaks; founders are already calling it a compliance minefield.

    A preview of the first skirmishes

    • Data access. Under RBI rules, aggregators must store customer card data only in tokenised form after August 2025, but they still retain rich behavioural metadata. Smaller payment processors fear licensed payment aggregators will amass an information advantage that can be parlayed into credit-scoring or loyalty-adtech businesses, precisely the kind of cross-market leverage the DCB wants to nip.
    • Bundled services. Several newly licensed aggregators are also offering point-of-sale hardware and SME loans. Competitors argue that tying escrow settlement to working-capital pricing could become anti-competitive if merchant lock-in raises switching costs. The DCB’s clause against “bundling that forecloses the market” would make such packages contestable.
    • On-soak and off-soak routing. Foreign card networks hope licensed payment aggregators will still let merchants route high-value payments over cards instead of UPI. If a handful of SSDE payment aggregators were to steer that volume preferentially to their own UPI-first pipes, the Competition Commission could intervene on grounds of discriminatory access.

    What’s next for payment aggregators

    Within the next month RBI is expected to publish an updated list of in-principle approvals and returns. Observers will parse whether household names like PhonePe or Google Pay finally move from the “pending” column to “authorised”, reshaping competitive dynamics overnight. Parliament’s monsoon calendar will signal whether the Digital Competition Bill is tabled in July or pushed to the winter. If both timelines hold, India’s biggest payment aggregators could find themselves juggling RBI compliance audits and ex-ante competition filings in the same quarter.

    For merchants and developers the message is: today’s supplier choice will decide tomorrow’s bargaining leverage. For investors, a payment aggregator licence is clearly gold—but fight club rules apply. In the coming mêlée over MDR caps, API access, and SSDE thresholds, everyone may trade blows. And the first rule of India’s next fintech fight club? You talk about fees, data, and power—because the regulators certainly will.