The person in charge of the relevant departments of the People’s Bank of China answered the reporter’s question on the Notice of the People’s Bank of China on Strengthening the Management of Payment A

Cctv newsRecently, the People’s Bank of China issued the Notice of the People’s Bank of China on Strengthening the Management of Payment Acceptance Terminals and Related Services (hereinafter referred to as the Notice). The person in charge of the relevant departments of the People’s Bank of China answered the reporter’s questions on the Notice.
1. What is the background of the Notice?
The payment acceptance terminal involves the reading and collection of payment information and the generation of payment instructions, and its security and compliance are of great significance to ensuring the security of payment information and funds. The People’s Bank of China attaches great importance to the prevention of risks related to payment acceptance terminals, and has successively issued a series of systems such as bank card acquiring business, acceptance terminal security and bar code payment business, which has played a positive role in maintaining the order of acquiring market and protecting the public information and capital security.
At the same time, payment acceptance terminals and related business management are also facing some new problems and challenges. For example, some market participants have been constantly renovating the means of altering transactions, and hiding illegal transactions by arbitrarily changing terminal transaction routes, merchant codes, merchant names, and transaction addresses, which makes it difficult for transaction information to restore the real consumption scene, which not only infringes on consumers’ legitimate rights and interests, but also causes complaints and disputes, and also brings opportunities for criminals to transfer illegal and criminal funds through channels. There are also some criminals who use the receipt bar code to transfer gambling funds and provide payment channels for cross-border gambling activities. In order to effectively improve the risk management level of payment acceptance terminals and related businesses, effectively cut off the "capital chain" of crimes such as cross-border gambling, and protect the interests of the public, the People’s Bank of China has formulated the Notice on the basis of in-depth investigation and extensive consultation with all parties.
II. What are the management requirements of the Notice for bank card acceptance terminals? Why do acquiring institutions and clearing institutions need to manage acceptance terminals?
Focusing on the whole life cycle management of bank card acceptance terminals, the Notice requires the acquiring institution to establish an association relationship between the terminal serial number and five elements, such as the acquiring institution code, the special merchant code, the unified social credit code of the special merchant, the settlement account of the special merchant, and the geographical location of the bank card acceptance terminal, and ensure the consistency and non-tampering of this association relationship in the whole payment process. Around the above requirements, based on the different responsibilities of the main players in the payment market, we will establish a multi-level standardized mechanism and form a management system that performs its duties and is governed by many parties.
On the one hand, adhering to the principle of "whose terminal is responsible", the main responsibility of the acquiring institution on acquiring business is compacted. The acquiring institution shall establish the relationship between the serial number of the terminal and the five elements. If any element is changed during the use of the terminal, the relevant audit procedures shall be re-performed. The acquiring institution shall adopt the bank card acceptance terminal with password identification technology to ensure that the transaction initiated by the terminal can be traced back accurately.
On the other hand, adhering to the principle of "whose network is responsible", we will tighten the responsibility of clearing institutions for maintaining the network order. The clearing institution shall organize member institutions to comprehensively sort out and evaluate the terminals accessing the network, and retire or upgrade the terminals that do not meet the notification requirements within a time limit according to the risk rating. At the same time, we will establish a registration management platform for bank card acceptance terminals, and manage the relationship between terminal serial number and five elements in the whole life cycle together with member acquiring institutions in the terminal network access, change, monitoring and exit. Once the monitoring finds that the relevant elements are inconsistent with the original binding relationship, the clearing institution and the acquiring institution should take risk verification and disposal measures to effectively prevent risks such as "machine shifting" and "code matching". Considering that the same terminal may access multiple clearing institutions, in order to avoid redundant construction, clearing institutions can build their own or entrust other institutions to establish management platforms on their behalf, but their main responsibilities will not be transferred due to the entrustment relationship. The scope of entrusted institutions includes other clearing institutions, industry self-regulatory organizations, third-party professional institutions, etc., and the specific objects and modes are determined by the clearing institutions themselves.
3. What management requirements does the Notice put forward for bar code payment acceptance terminals?
The Notice follows the principle of equal standards for similar businesses, and combines the similarities and differences between bar code payment acceptance terminals and traditional bank card acceptance terminals to implement classified management for bar code payment acceptance terminals of special merchants. For bar code payment acceptance terminals similar to traditional bank card acceptance terminals, which can collect main payment information and participate in initiating payment instructions, such as card code composite intelligent terminals, the same regulatory requirements as bank card acceptance terminals are implemented. For the auxiliary acceptance terminals of barcode payment, which only have the function of barcode reading or displaying, but do not participate in initiating payment instructions, such as scanning guns or boxes, code display equipment, static code cards, etc., considering the universality of barcode payment, it is required to strengthen risk prevention and control by establishing the corresponding relationship between merchants and the core elements of bill receipt, and strengthening monitoring means. In addition, for the bar code payment auxiliary acceptance terminal without positioning function, it is required to monitor the terminal transaction position through the payer’s transaction position or other calculation methods about the actual position of the mobile terminal to prevent the risk of terminal abuse. Considering that the implementation of the above monitoring requires cooperation and convergence between the institutions on the receiving side and the account side, it is required that the clearing institution and the member institutions on the receiving side and the account side establish joint monitoring standards and rules for terminal positions, and jointly determine the verification frequency, standards, modes and other operation paths on the premise of taking necessary security technical measures such as encryption and de-identification to ensure information security.
4. How does the Notice regulate the bar code of personal collection?
In recent years, personal collection bar codes have been widely used, effectively meeting the personalized and diversified payment needs of the public, and improving the efficiency of fund collection and payment in small and micro economy and stall economy. At the same time, however, there are some hidden risks in personal collection bar codes. For example, some institutions use personal receipt bar code transfer business to handle a large number of production, operation and consumption transactions, which not only confuses the nature of transactions, leads to distortion of transaction information, affects the effect of risk monitoring, but also is not conducive to empowering and adding value to business activities by means of payment services. There are also some lawless elements who use the "running sub-platform" to attract a large number of people to use personal static collection barcodes to remotely transfer gambling funds with gamblers online, hiding gambling funds in many normal trading scenarios, disrupting the normal order of barcode payment business and affecting the effectiveness of the traceability mechanism of gambling "capital chain".
In order to give full play to the universality and convenience of the receipt bar code on the premise of preventing risks, the Notice puts forward the following targeted requirements. First, refer to the management of special merchants for individual users with obvious business characteristics, and require such individual users to provide merchant collection barcodes to improve the service quality of individual operators. Second, it is required that personal static collection bar codes should not be used for remote non-face-to-face collection in principle, and it is really necessary to implement white list management to prevent personal static collection bar codes from being sold, rented or lent to build online recharge channels for gambling activities. Third, refer to the relevant requirements of personal static collection bar code for the personal dynamic collection bar code saved by screen capture, download, etc., so as to prevent criminals from evading policy requirements with the help of personal dynamic collection bar code. Fourth, it is required to carefully determine the access conditions and scale of the personal static collection bar code white list, the validity period, the number of uses and the transaction limit of the personal static collection bar code, so as to prevent the risk of white list abuse.
In order to ensure the effective implementation of the relevant requirements of personal collection bar code and the smooth transition of business, the Notice has set a transition period, requiring payment service subjects to comprehensively and fully evaluate the normal payment needs of customers, formulate supporting service solutions, do a good job in customer guidance and service, and ensure that the service cost does not rise and the quality does not drop.
V. What requirements does the Notice put forward for the management of special merchants? Why do acquiring institutions and clearing institutions need to manage special merchants?
Real-name registration system, a special merchant, is the basic system of acquiring business and an important guarantee to ensure the authenticity of transactions, maintain the order of acquiring market and prevent illegal and criminal activities. The Notice adheres to the principle that "whoever owns the business is responsible". As the first responsible entity in the management of special merchants, the acquiring institution should strengthen the substantive review of the legitimacy of the business activities of special merchants and the true willingness to apply for acquiring services, implement the obligation of continuous management of special merchants, and further clarify the way of verifying the identity of merchants: for entity special merchants with fixed business premises, the acquiring institution is required to verify the identity of merchants on the spot; For special merchants on the internet and entities without fixed business premises, considering the difficulty and high cost of on-site verification, the acquiring institution is required to verify the identity of the merchants in principle by manual or intelligent customer service synchronous video.
At the same time, based on the principle of "whose network is responsible", the Notice requires the clearing institution to establish an information platform for special merchants accessing the network, collect the core information of special merchants accessing the network according to the principle of minimum necessity, carefully manage the authenticity, security and legal compliance of special merchants accessing the network by member institutions, and continuously monitor the relationship between member institutions and special merchants accessing the network, payment acceptance terminals and the risk of acquiring transactions. The merchant information collected and used by the clearing institution is limited to the above-mentioned specific purposes and shall not be excessively collected or used.
6. What impact does the Notice have on consumers and small and micro businesses?
The Notice generally helps to better protect the legitimate rights and interests of consumers. On the one hand, the Notice further regulates the management of payment acceptance terminals and special merchants from multiple subjects and dimensions, which is conducive to preventing criminals from stealing consumers’ personal information or even stealing account funds by transforming payment acceptance terminals and applying for false merchants; On the other hand, the Notice requires the clearing institution to improve the payment business message rules, support the member institutions of the institution to meet the necessary and reasonable transaction information inquiry needs of customers, help improve the service quality of bank statements and transaction information inquiry of banks and payment institutions, fully protect consumers’ right to know, and reduce related disputes and complaints.
In the long run, the relevant requirements of the Notice on standardizing personal collection codes will further improve the quality of collection services for individual operators and small and micro businesses. For individual payment code users with obvious characteristics of business activities, the Notice requires the acquiring institution to refer to the management of special merchants. After the individual operators and small and micro merchants cooperate with the acquirer to complete the procedures for merchants to access the network, the acquirer should provide payment services according to the merchant service standards, and establish the corresponding relationship between the merchants and the acquiring settlement account and other elements of information according to the regulations, which will help prevent the outsourcing institutions from misappropriating funds and the big merchants from the source, and help to better protect the financial security and service experience of individual operators and small and micro merchants.