# DuitNow QR > Source: https://docs.barcoder.ai/docs/standards/duitnow-qr > research date 2026-05-30 · extracted at 2026-10-06 > Publisher: Barcoder — encyclopedia of QR, barcode and payment-code standards Specifications: - [DuitNow QR Developer Documentation — PayNet](https://docs.developer.paynet.my/docs/duitNow-QR/introduction/overview) - [DuitNow QR — PayNet Malaysia](https://www.duitnow.my/QR/index.html) - [EMV QR Code Specifications — EMVCo (Merchant-Presented Mode, July 2017)](https://www.emvco.com/emv-technologies/qr-codes/) ## Overview DuitNow QR is **Malaysia's national unified QR payment standard**, operated by [PayNet](https://paynet.my/) (a Bank Negara Malaysia subsidiary established in 2017) under the BNM **Interoperable Credit Transfer Framework (ICTF)** [1][1], [Malaysia report](https://docs.barcoder.ai/docs/payments/MY). The DuitNow service launched in 2019, with DuitNow QR following shortly after as its merchant-presented QR layer; technical foundation is the EMVCo Merchant-Presented Mode (MPM) specification [1][1], [2][2]. In 2025 DuitNow QR processed **3 billion transactions** (more than doubled from ~1.5 billion in 2024) across **~3 million registered merchant touchpoints**; at the PayNet network level, total digital-payment volume crossed **8.44 billion transactions in 2025** (~23 million per day), with the average Malaysian making **538 cashless payments per year** [Malaysia report](https://docs.barcoder.ai/docs/payments/MY). Cross-border QR connectivity links Malaysia with Singapore, Thailand, Indonesia, China, and Cambodia; cross-border QR transactions grew **2.5× to 29.7 million in 2025**, with India's UPI link slated for 2026 [Malaysia report](https://docs.barcoder.ai/docs/payments/MY). ## History **PayNet** (Payments Network Malaysia Sdn Bhd) was established in **2017** as a consolidation of MEPS and MyClear, making it the sole national payment infrastructure operator overseen by Bank Negara Malaysia [3][3], [Malaysia report](https://docs.barcoder.ai/docs/payments/MY). PayNet is owned by 11 commercial banks with BNM as the largest shareholder [Malaysia report](https://docs.barcoder.ai/docs/payments/MY). In **January 2019** PayNet went live with **DuitNow Real-Time Retail Payments Platform (RPP)** using ACI Worldwide's UP Real-Time Payments solution — the underlying instant-credit-transfer rail [2][2], [4][4]. The QR layer **DuitNow QR** followed in 2019 as the merchant-presented profile [1][1]. It was Malaysia's first national QR standard, deliberately designed for interoperability across banks and e-wallets rather than per-issuer fragmentation. **Adoption timeline** [Malaysia report](https://docs.barcoder.ai/docs/payments/MY), [4][4]: - **2019**: DuitNow + DuitNow QR launch. - **2023–2024**: Cross-border bilateral integrations with Singapore (PayNow), Thailand (PromptPay), Indonesia (QRIS), China (Alipay+). - **September 2024**: Cambodia (Bakong) cross-border QR live. - **August 2024**: India UPI ↔ PayNet linkage announced (PM Modi–PM Anwar agreement). - **August 2024**: National Fraud Portal launched by BNM with PayNet and 16 institutions (anti-mule-account, real-time fraud response). - **October 2025**: New standardised DuitNow QR standee design rolled out (RHB Bank, Bank Islam, MBSB, Agrobank as early adopters). ## Technical specification DuitNow QR is an **EMVCo Merchant-Presented Mode (MPM)** profile [1][1], [5][5]. PayNet ships official integration material at [docs.developer.paynet.my][1], including SDKs and Java sample applications for signing/verifying DuitNow QR JSON API messages [1][1]. **EMVCo MPM foundation** [5][5]: - Payload format: **TLV (Tag-Length-Value)** plain-text string, Payload Format Indicator (tag `00`) = `"02"` in DuitNow QR per PayNet's QR Data Object spec [11][11]. - Point of Initiation Method (tag `01`) = `"11"` (static) or `"12"` (dynamic). - Integrity: CRC-16/CCITT-FALSE appended as field `63` (4-character alphanumeric). - Supports static and dynamic QR variants. **DuitNow-specific Merchant Account Information template** (tag `26`) [11][11]: - Sub-tag `00` (AID) = **`A0000006150001`** — the Malaysia DuitNow Application Identifier. - Sub-tag `01` (Acquirer ID) — up to 6 characters, assigned by PayNet. - Sub-tag `02` (QR ID) — merchant/recipient identifier issued by the acquirer. - Sub-tag `03` (Merchant Descriptor) — optional, up to 20 chars. - Sub-tag `04` (Mobile Number) — optional, up to 15 chars. - Tag `27` is reserved for future use [11][11]. **Header tags** (DuitNow profile) [11][11]: - Tag `52` (Merchant Category Code) = `0000` for P2P, `6010` for POS Cash Out, or a standard MCC for merchant payments. - Tag `53` (Currency) = **`458`** (MYR, ISO 4217). - Tag `54` (Transaction Amount) — conditional; numeric, single decimal point allowed. - Tag `58` (Country Code) = **`MY`**. - Tag `59` / `60` — merchant name (≤25 chars) and city (≤15 chars; "MY" if not applicable). **JomPAY interoperability** — tag `62` (Additional Data) is **required** for JomPAY QR codes and carries sub-tags `90` (RRN) and `91` (RRN2) so that JomPAY bill-presentment references survive a DuitNow QR scan [11][11]. **Data integrity hash (uncommon)** — tag `82` (Data Integrity) is an **optional SHA-256 hash per ISO/IEC 10118-3** that DuitNow QR carries to let the scanning app verify the payload was not tampered with [11][11]. Most EMVCo MPM national profiles do not expose an integrity hash beyond the 16-bit CRC; DuitNow QR's tag-82 SHA-256 is one of its distinctive technical choices. **Service modes supported** [1][1]: - **Merchant-Presented QR (MPM)** — merchant displays a QR (static or dynamic); customer scans with their banking/wallet app to pay. Covers domestic and cross-border (inbound + outbound) transactions. - **Consumer-Presented QR (CPM)** — customer displays a QR from their app; the merchant's POS scans it. Domestic only. **Settlement** uses the underlying DuitNow real-time credit transfer rail (PayNet RPP / FPX rails) — settles in seconds [Malaysia report](https://docs.barcoder.ai/docs/payments/MY). **DuitNow ID types** for the addressed account [Malaysia report](https://docs.barcoder.ai/docs/payments/MY): - Mobile number - NRIC (national ID) - Passport number - Business registration number - Army / police number **Currency code**: MYR (`458`). **Transaction limits** [Malaysia report](https://docs.barcoder.ai/docs/payments/MY): - Consumer: MYR 50,000 per transaction - Business: MYR 10,000,000 per transaction **Integration APIs** [1][1]: - Network administration (sign on/off with DuitNow) - QR generation specification (per-merchant onboarding) - Reversal services (refunds, disputed transactions) - Both **Acquirer APIs** and **Issuer APIs** across domestic, cross-border outbound, cross-border inbound, and consumer-presented transaction types ## Use cases DuitNow QR is the merchant-acceptance default across Malaysia and increasingly across the ASEAN region for inbound tourism payments: - **Retail point of sale** — every kind of merchant from hawkers and pasar malam stalls to chain supermarkets displays a DuitNow QR. **3 billion transactions in 2025** (more than double 2024's ~1.5 B), with **538 cashless payments per Malaysian per year** [Malaysia report](https://docs.barcoder.ai/docs/payments/MY). - **F&B / hospitality** — universal acceptance via the participating-banks-and-e-wallets interoperability. - **E-commerce checkout** — dynamic DuitNow QR generated per cart; customer scans with home banking app. - **Bill payments** — utility, telecom, insurance, government fees. - **Cross-border tourism** — Malaysian tourists abroad scan SGQR / PromptPay / QRIS / Bakong / Alipay+ with their Malaysian wallet; foreign tourists in Malaysia scan DuitNow QR with their home app [Malaysia report](https://docs.barcoder.ai/docs/payments/MY). - **Alipay+ inbound** — handles ~80 % of inbound tourism QR payments via the Alipay+ cross-border network [Malaysia report](https://docs.barcoder.ai/docs/payments/MY). **Government and BNM policy alignment**: DuitNow QR adoption is tracked against the **Financial Sector Blueprint 2022–2026** target of 15 %+ annual e-payment transaction growth, which Malaysia has been exceeding [Malaysia report](https://docs.barcoder.ai/docs/payments/MY). ## Implementations The official integration channel is **PayNet's developer portal** ([docs.developer.paynet.my][1]) with Java SDKs and sample applications for JSON API message signing and verification [1][1]. Direct integration is bank- and e-wallet-mediated; community open-source libraries are thin. **Open-source encoders/decoders:** | Repo | Language | Stars | License | Last release | Notes | |---|---|---:|---|---|---| | [natsu90/duitnowqr-test](https://github.com/natsu90/duitnowqr-test) | JavaScript | 15 | — | active 2025 | The most-cited community **DuitNow-specific** generator, built via reverse engineering of production QRs because PayNet's full spec is documentation-gated. Includes a working `generateDuitNowStr` function with merchant parameters (app ID, MCC, name, city, postcode, reference labels) [6][6] | | [mvallim/emv-qrcode](https://github.com/mvallim/emv-qrcode) | Java | 128 | Apache-2.0 | v0.1.5, May 2026 | Full **MPM v1.1 + CPM v1.1** encode/decode with CRC16 + duplicate-tag checks; populate tag-26 sub-tag `00 = A0000006150001` for DuitNow [10][10] | | [mercari/go-emv-code](https://github.com/mercari/go-emv-code) | Go | 70 | MIT | v0.1.5, Aug 2023 | Encoder/decoder for both Merchant- and Consumer-Presented modes; production-grade Go reference [12][12] | | [dongri/emv-qrcode](https://github.com/dongri/emv-qrcode) | Go | 58 | — | 2024 | Independent Go MPM/CPM encoder/parser [13][13] | DuitNow QR is structurally an EMVCo MPM payload, so any compliant TLV encoder/decoder works at the wire-format level once tag-26 sub-tag `00` is configured with the Malaysia AID `A0000006150001`. Production integration still requires merchant onboarding through a PayNet acquirer who issues the sub-tag `01` Acquirer ID and sub-tag `02` QR ID. **Official PayNet SDKs.** PayNet ships **Java SDKs and sample applications** at [docs.developer.paynet.my][1] for signing and verifying both **XML and JSON** API messages around DuitNow QR (network sign-on/off, QR generation, reversals); these are the canonical integration surface for licensed acquirers and issuers [1][1]. **Production wallets** (canonical implementations) [Malaysia report](https://docs.barcoder.ai/docs/payments/MY): - **Maybank MAE** — leader in cross-border DuitNow QR adoption (83 % growth in QR payment value in 2024) - **Touch 'n Go** — leading non-bank e-wallet - **GrabPay MY** - **Boost** - **ShopeePay** - All major bank apps: Maybank2u, CIMB Clicks, RHB, Public Bank PBe, Hong Leong Connect **Payment gateway / acquirer SDKs:** - **Omise** — provides DuitNow QR integration for international merchants [7][7] - **HitPay** — retail POS integration guide [8][8] - **Standard Chartered** — bank-mediated merchant integration [9][9] ## Comparison **vs. [SGQR](https://docs.barcoder.ai/docs/standards/sgqr) (Singapore) and [PromptPay QR](https://docs.barcoder.ai/docs/standards/promptpay-qr) (Thailand)** — Same EMVCo MPM technical family; same central-bank-affiliated payment-operator pattern; launched in the same 2018–2019 window. SGQR is uniquely broad in its scheme participation (24+, including international card networks); DuitNow is more focused on Malaysian banks + e-wallets. PromptPay is bank-rail-only. All three are now interconnected via direct bilateral integrations as part of the ASEAN cross-border QR mesh [Malaysia report](https://docs.barcoder.ai/docs/payments/MY), [Singapore report](https://docs.barcoder.ai/docs/payments/SG), [Thailand report](https://docs.barcoder.ai/docs/payments/TH). **vs. [QRIS](https://docs.barcoder.ai/docs/standards/qris) (Indonesia)** — QRIS is Bank Indonesia's national unified QR (also EMVCo MPM based, launched August 2019). The two are direct regional peers in design and timing. DuitNow ↔ QRIS cross-border QR went live in 2023 [Malaysia report](https://docs.barcoder.ai/docs/payments/MY). **vs. [UPI QR](https://docs.barcoder.ai/docs/standards/upi-qr) (India)** — Different technical lineage: UPI uses a `upi://pay?...` deep-link URI, DuitNow uses EMVCo TLV. The August 2024 UPI ↔ PayNet bilateral agreement (PM Modi–PM Anwar) requires a bridge that translates between the two formats at the network boundary [Malaysia report](https://docs.barcoder.ai/docs/payments/MY), [India report](https://docs.barcoder.ai/docs/payments/IN). ## Fun facts DuitNow QR **doubled in transaction volume year-over-year in 2024**: 360 M transactions in 2023 → 870 M in 2024 (+142 %), with transaction value growing from MYR 14.6 B to MYR 31.1 B (+113 %) [Malaysia report](https://docs.barcoder.ai/docs/payments/MY). This is one of the steepest year-over-year national QR adoption curves on record, second only to the early-Pix Brazil ramp. **Alipay+ handles ~80 % of inbound tourism QR payments in Malaysia** [Malaysia report](https://docs.barcoder.ai/docs/payments/MY) — DuitNow QR's inbound scanning by Chinese tourists is largely mediated through Alipay+ rather than a direct China–Malaysia bilateral integration. This is a notable departure from the bilateral-central-bank-link pattern used for SG, TH, ID and KH. Malaysia is a **founding member of the BIS's Project Nexus** initiative for multilateral cross-border instant payment connectivity [Malaysia report](https://docs.barcoder.ai/docs/payments/MY). Nexus aims to replace bilateral country-to-country payment-system links (the current operating model for DuitNow's cross-border footprint) with a single multilateral hub. If Nexus delivers, DuitNow QR could become reachable from any participating country without per-country integration work. **SHA-256 payload-integrity hash, not just CRC.** DuitNow QR's wire format reserves **tag `82` as an optional ISO/IEC 10118-3 SHA-256 hash** over the payload — a per-payload cryptographic integrity field on top of the standard CRC-16 [11][11]. Most EMVCo MPM national profiles (VietQR, QRIS, PromptPay, TR QR Code, etc.) stop at the 16-bit CRC; DuitNow's tag-82 is an unusual nod toward tamper-evidence at the QR-payload layer itself. **One QR, two national rails.** Tag `62` Additional Data on a DuitNow QR can carry **JomPAY** reference numbers (sub-tags `90`/`91` RRN/RRN2), so a printed code can act simultaneously as a DuitNow merchant payment *and* a JomPAY bill — two of Malaysia's national rails sharing one EMVCo MPM container without an extra MAI template [11][11]. **Reverse-engineered as the public spec.** The most-cited open-source DuitNow QR encoder (`natsu90/duitnowqr-test`) was built **by reverse-engineering production QRs** because PayNet's full TLV layout sits behind a developer-portal login. The community had to scan, decode and document the format to produce a usable library — a recurring pattern in national-QR standards where the spec is "open" only to licensed acquirers [6][6]. ## Status **Active and growing fast.** Latest metrics [Malaysia report](https://docs.barcoder.ai/docs/payments/MY): - **3 billion transactions / year (2025)**, +100 % YoY from ~1.5 B (2024) - **MYR 31.1 billion annual value (2024)**, +113 % YoY - **40+ participating banks and e-wallets** - **5 cross-border QR partner countries** (SG, TH, ID, CN via Alipay+, KH) - **8th country bilateral planned**: India (UPI ↔ PayNet announced August 2024) The October 2025 rollout of a new standardised DuitNow QR standee design indicates continued PayNet investment in consumer recognition. The 2024 National Fraud Portal addition is a security-stack maturation step rather than a change to the QR format itself. No deprecation planned. Malaysia is positioned as a leading-edge implementer in the ASEAN cross-border QR network and Project Nexus, suggesting DuitNow QR will remain the canonical Malaysian merchant standard well beyond the FSB 2022–2026 planning horizon. ## Sources [1]: https://docs.developer.paynet.my/docs/duitNow-QR/introduction/overview [2]: https://www.aciworldwide.com/blog/putting-malaysia-on-the-path-to-payments-innovation [3]: https://paynet.my/about-paynet.html [4]: https://www.businesswire.com/news/home/20190113005020/en/ACI-Worldwide-Powers-Successful-Launch-of-DuitNow-Real-Time-Payments-in-Malaysia [5]: https://www.emvco.com/emv-technologies/qr-codes/ [6]: https://github.com/natsu90/duitnowqr-test [7]: https://docs.omise.co/duitnow-qr/malaysia [8]: https://hitpayapp.com/blog/how-to-integrate-duitnow-qr-into-your-retail-pos-(step-by-step-hitpay-implementation-for-2025) [9]: https://www.sc.com/my/bank-with-us/scan-and-pay/ [10]: https://github.com/mvallim/emv-qrcode [11]: https://docs.developer.paynet.my/docs/duitNow-QR/integration/QR-generation-specification/merchant-presented-mode/qr-data-object [12]: https://github.com/mercari/go-emv-code [13]: https://github.com/dongri/emv-qrcode [pix-utils]: https://github.com/thalesog/pix-utils [my-cro]: https://docs.barcoder.ai/docs/payments/MY [sg-cro]: https://docs.barcoder.ai/docs/payments/SG [th-cro]: https://docs.barcoder.ai/docs/payments/TH [in-cro]: https://docs.barcoder.ai/docs/payments/IN 1. [DuitNow QR Developer Documentation — PayNet][1] 2. [Putting Malaysia on the Path to Payments Innovation — ACI Worldwide][2] 3. [About PayNet][3] 4. [ACI Worldwide Powers Successful Launch of DuitNow — Business Wire][4] 5. [EMV QR Code Specifications — EMVCo][5] 6. [natsu90/duitnowqr-test — GitHub][6] 7. [DuitNow QR — Omise integration docs][7] 8. [How to Integrate DuitNow QR — HitPay][8] 9. [Standard Chartered Malaysia Scan and Pay][9] 10. [mvallim/emv-qrcode — GitHub][10] 11. [QR Data Object — PayNet Developer Docs (MPM tag spec)][11] 12. [mercari/go-emv-code — GitHub][12] 13. [dongri/emv-qrcode — GitHub][13] 14. [MY-malaysia.md][Malaysia report](https://docs.barcoder.ai/docs/payments/MY) ## Deployments Found in the following country reports (grep across `reports/countries/`): - **MY** — [MY-malaysia.md](https://docs.barcoder.ai/docs/payments/MY)