China News Service, June 8th, according to the central bank's website, in order to further regulate the management of payment acceptance terminals, the central bank drafted the "People's Bank of China's Notice on Strengthening the Management of Payment Acceptance Terminals and Related Businesses (Draft for Comment)" (hereinafter referred to as "Draft for Comment"), now open to the public for comments. "Draft for Comment" puts forward management requirements in terms of bank card acceptance terminal, barcode payment acceptance terminal, and innovative payment acceptance terminal.
Data map: People's Bank of China. China News Agency reporter Zhang Xinglong photo
In order to further standardize the management of the business related to payment acceptance terminals, maintain the order of the payment market, protect the legitimate rights and interests of consumers, and prevent cross-border gambling, telecommunications fraud, and other illegal and criminal acts, the People's Bank of China has taken serious care in the management of related businesses such as payment acceptance terminals and acquiring services. The study has sorted out the "Notice of the People's Bank of China on Strengthening the Management of Payment Acceptance Terminals and Related Businesses (Draft for Comment)" (hereinafter referred to as "Draft for Comment").
The payment acceptance terminal involves the reading and collection of payment information and the generation of payment instructions. Its security and compliance are of great significance for protecting the legitimate rights and interests of consumers and maintaining the order of the acquiring market. In recent years, the Central Bank has successively issued the "Administrative Measures for Bank Card Acquiring Business" (People's Bank Announcement [2013] No. 9), and "People's Bank of China Notice on Strengthening the Security Management of Bank Card Acceptance Terminals" (Yinfa [2017] No. 21 ), “Barcode Payment Business Specification (Trial)” (Yinfa [2017] No. 296) and other systems, which clarify the business management requirements of payment acceptance terminals, and have played a positive role in promoting the improvement of safety and compliance management of acquirers.
At the same time, with the development of payment services and changes in the market environment, hidden risks of payment acceptance terminals and related businesses are gradually being exposed, especially mobile acceptance terminals and payment barcodes are being used by criminals from black and gray industries such as cross-border gambling The transfer of funds reflects the following problems in related businesses:
First, the acquirer has not fully managed the life cycle of bank card acceptance terminal purchase, registration, function opening, information change, exit, etc., resulting in trading terminal, transfer, "one machine with multiple codes", "one machine with multiple households", etc. The phenomenon has been repeatedly prohibited, which brings convenience to the criminals to use the receiving terminal to transfer funds; the second is that the access of special merchants is not strict, and some acquirers verify the flow of the merchant’s relevant certification documents and their true wishes, business premises, terminal deployment location, etc. Due to the form, the problem of false merchants is still outstanding; third, some acquirers and clearing institutions do not combine the characteristics of bar code payment business to improve the bar code payment acceptance terminal and the collection bar code management mechanism, resulting in an increased risk of bar code payment business involving black and gray industries.
In order to standardize business management such as acquiring, crack down on cross-border gambling, telecommunications fraud and other illegal and criminal activities, cut off the black and gray industrial capital chain, and protect the public interest, the People's Bank of China has organized the People's Bank branches, banks, Non-bank payment institutions (hereinafter referred to as payment institutions), clearing institutions and other units conducted discussion and research, comprehensively sorted out related business processes and risk issues, and planned to write a "draft for soliciting opinions".
The main contents include:
One is the management of payment acceptance terminals. Management requirements are put forward in terms of bank card acceptance terminal, barcode payment acceptance terminal, and innovative payment acceptance terminal.
The second is the management of special merchants. Refine and emphasize the real-name system management requirements of special merchants, and clarify the verification methods of merchant information such as face-to-face and synchronized video and the inspection requirements of special merchants
The third is the monitoring of acquiring business. Management requirements are raised in terms of the authenticity and completeness of transaction information, terminal location monitoring, transaction monitoring responsibilities of acquirers and clearing agencies, and settlement monitoring of special merchant funds.
The fourth is related to supervision and management. Relevant market entities are required to submit the implementation status and work plan for the "Exposure Draft". The relevant penalties shall be clarified for the behaviors of banks, payment institutions, and clearing institutions that violate the "Exposure Draft".
In terms of bank card acceptance terminal management, the current bank card acceptance terminal related management system has already clarified the basic management responsibility of the acquiring institution, but the transfer, alteration of transaction information, "one machine with multiple codes", "one machine with multiple households", trading The terminal and other issues remain severe, reflecting that some acquirers still have weak links in implementing the supervision system and regulating bank card terminal management. In this regard, the "Draft for Comments" uses bank card acceptance terminal serial number and acquirer code, special merchant code, special merchant unified social credit code (small and micro merchants are responsible person ID number, the same below), special merchants acquire The five information of the settlement account and bank card acceptance terminal deployment address are uniquely bound, and the principle of ensuring that the binding relationship is consistent and non-tamperable throughout the payment process, and the following requirements are clarified:
One is the production link, which requires the clearing agency to establish a terminal manufacturer evaluation management mechanism, urge the manufacturer to register the factory bank card to accept the terminal serial number, and use password recognition technology to ensure that the serial number is not tampered with throughout the transaction process to ensure that the terminal initiates a transaction It can be accurately traced to prevent the transaction information initiated by the terminal from being "systematized".
The second is the link to the network, which requires the acquiring institution to establish a unique binding relationship between the serial number of the bank card acceptance terminal and the above five items of information and submit it to the clearing institution. The clearing institution is required to verify the information submitted by the acquiring institution and the manufacturer, and the verification is inconsistent. Access the network.
The third is the exit link. The acquiring institution should promptly close the terminal use function and submit it to the clearing institution. The clearing institution should conduct follow-up monitoring of the terminal.
The fourth is to require acquirers to upgrade or replace terminals whose inventory does not meet relevant business and technical requirements.
In terms of bar code payment terminal management, according to statistics, among the complaint reports received by the payment settlement violation reporting mechanism from January to April 2020, bar code payments accounted for 42%, up 27% year-on-year, reflecting existing bar code payments Business needs to be strengthened and standardized. Compared with the bank card business, there are certain differences in the terminals and channels of the barcode payment business, and the focus of risk prevention and control is also different. Based on the principle of applying the same standard of supervision to similar businesses and fully considering the characteristics of the barcode payment business, the "Draft for Comment" clarifies the requirements for classification management of barcode payment acceptance terminals.
For barcode payment acceptance terminals that have the ability to collect payer barcodes, transaction amounts, and other payment information, and can participate in initiating payment instructions, acquirers and clearing institutions should establish and improve relevant management rules by referring to the relevant regulations of bank card acceptance terminals. In particular, anti-tampering technologies such as password identification are used, and a unique binding relationship between the terminal number accepted and the five items of information is established.
For barcode payment auxiliary receiving terminals such as barcode payment scanning devices, barcode display devices, and static barcode display media, which only have the function of barcode reading or display, and do not participate in initiating payment instructions, in view of the fact that they do not collect payment instruction elements, it is not mandatory to use a password Anti-tampering technology such as identification of terminal serial numbers. If the acquiring institution distributes the above-mentioned auxiliary acceptance terminal for the special merchant, the unique correspondence between the special merchant code and the acquiring institution code, unified social credit code, acquiring settlement account, and the business address of the special merchant shall be established and adopted. Effective monitoring technology ensures the consistency of the above correspondence throughout the transaction process.
Regarding the management of collection barcodes, judging from the information disclosed by the public security department, collection barcodes were used by criminals to carry out rapid fund transfer through gambling “running platforms”, transfer collection groups, etc., and have become illegal crimes such as cross-border gambling and telecommunications fraud. An important part of the capital chain. In order to curb this risk situation, the following measures are proposed: First, by identifying the actual transaction position and other measures to identify the risks associated with the payment barcodes of the special merchants; second, the Payment and Clearing Association is required to distinguish between individual users, merchants and other different types of users to formulate rules to clarify the individual or Merchants can apply for restrictions on the number of collection barcodes, the validity period of the barcode, the number of collections and the amount of payment, and include individuals with obvious operating characteristics into the management of special merchants. The above measures are aimed at guiding personal collection barcodes to return to the origin of personal small-value, non-real goods or service transaction background related transfer business, not only to prevent personal collection barcodes from being used for illegal and illegal purposes, but also by incorporating individual operators into special merchant management To improve the level of payment services for individual business activities.
With regard to the identification and management of special merchants, implementing the identification requirements of special merchants is the basis for preventing the risk of acquiring business. Some acquiring institutions have a formality for the identification of special merchants, and give criminals false applications for special merchants for capital transfer opportunities. In this regard, the following requirements are put forward: First, the identification method requirements of the identity information and true wishes of the special merchants should be clarified. The entity special merchants with fixed business premises should be verified by face-to-face, through face-to-face or synchronized video (including interactive based on artificial intelligence) Video method) Verify the special network merchants and the entity special merchants without fixed business premises.
At the same time, combined with the operating characteristics of the e-commerce platform, the acquirer is allowed to verify the identity of the special merchant through the platform on the premise of ensuring the fulfillment of the responsibility of the customer's identity; the second is the special merchant's application to change the acquisition settlement account or acceptance terminal registered when the terminal accesses the network Where information such as address is placed, the acquirer should re-identify the identity of the special merchant before handling the change; third, in response to the fact that the inspection of some merchants of the acquirer is not in place, the China Payment and Clearing Association is required to refine the inspection rules.
In terms of acquiring business monitoring, transaction monitoring is an important way to prevent and control dynamic risks in acquiring business. In order to improve the effectiveness of the risk monitoring of the acquiring business, the following requirements are put forward in terms of transaction information, monitoring entities, and joint risk prevention:
One is to accept terminal location monitoring. The acquiring institution is required to verify the terminal position using positioning technology. For barcode payment auxiliary acceptance terminals such as scanning equipment, display equipment or static barcode display media that do not have the positioning technical requirements, the acquiring institution, barcode payment and payment service institution (the bank or payment institution that provides barcode payment and payment services for the payer) Etc.) Establish a joint verification mechanism to check the actual location of the receiving terminal through the location of the payer’s mobile terminal.
In order to enhance the effect of joint defense and joint control, the clearing agency, in conjunction with the acquirer and barcode payment service agency, establish verification rules to clarify the rights, responsibilities and interests of all parties. On the basis of ensuring the risk prevention and control effect, the frequency and method of verification of the location of the receiving terminal, the number of samples for collecting the location information of the payer’s mobile terminal, and the specific content of the transmission of relevant location information (the location information of the payer’s mobile terminal, or a combination of the aforementioned information) The estimated actual location area of the receiving terminal) and other operational links give the market subject a flexible space. At the same time, emphasizing customer information protection requirements, bar code payment service agencies transmitting payer's mobile terminal location information, the relevant information should be desensitized.
The second is to play the role of the platform of the clearing institution, and conduct dual monitoring from the information flow and capital flow. That is, to verify the network access information and transaction information of merchants and terminals; combined with the payment institution's reserve monitoring mechanism, the consistency of the information of the actual acquiring settlement account of the special merchant and the network registration account, the matching of the fund settlement and transaction status Verification, etc.
The deadline for feedback of the "Solicitation of Comments" is July 8, 2020.