The Covid-19 pandemic and the resultant lockdown triggered significant changes in the payment industry. Specifically, it amplified the need for contactless payment and ushered in a wave of unprecedented innovation and product development in the payment industry globally.
Given the record traction in the Nigerian payment market; the Central Bank of Nigeria (CBN), recognizing the need for a tailored regulatory framework to support the burgeoning sector growth, in January 2021, issued the Framework for Quick Response (QR) Code Payment; and more recently, in October 2022, released the Exposure Draft of the CBN Guidelines for Contactless Payment in Nigeria.
The Guideline defines contactless payment as: “the consummation of financial transaction without physical contact between payer and the acquiring device(s)”. This means that secure payments can be made with tags, debit/credit cards, smart cards, mobile and other devices that use Near-Field Communication (NFC), Radio Frequency or QR Codes.
In a bid to preserve the integrity, safety and stability of the Nigerian financial system and to facilitate the safe and secure use of Contactless payment, the Guideline amongst other things provides for:
i. the roles and responsibilities of various stakeholders within the contactless payment eco- system;
ii. the minimum standard/specification for all contactless payment terminals, applications, and processing systems;
iii. guidelines for the provision of Value-Added Services; and
iv. the power of the CBN to prescribe and enforce sanctions and penalties for breach of the Guideline.
KEY STAKEHOLDERS IN THE CONTACTLESS PAYMENT ECOSYSTEM
The Guideline clearly articulates the role and responsibilities of the various stakeholders in the contactless payment eco-system, prescribing standards and specification for all forms of market technology and systems whilst also prescribing processes and principles that will govern their relationship with each other.
An Acquirer is a CBN-licensed institution that facilitates the acceptance of payments from customers to merchants through contactless payment devices such as Point of Sale Terminals (POS), Mobile Applications, and QR Codes amongst others. An Acquirer will typically be the account bank of a merchant who is utilizing the contactless payment system for fee collection from its customers.
The guideline requires all Acquirers to:
i. ensure that all deployed contactless payment devices deployed are certified by CBN and meet prescribed specifications/standards.
ii. operate an agnostic acceptance policy such that all cards, capable of contactless payment, issued in Nigeria shall be accepted irrespective of the issuer.
iii. conduct customer KYC (Know Your Customer) and train Customers compliance with applicable Regulations.
iv. take measures to prevent the use of their networks and devices in violation of Anti-Money Laundering Laws.
v. execute a Contactless Payment Agreement with all Customers prior to granting access to the Acquirer’s contactless payment platform.
In a bid to protect unwary or naive customers from the perpetuation of fraud, the guideline restricts Acquirers from admitting or profiling agent banking terminals operators to its Platform or facilitating contactless transactions on their behalf.
Like the Acquirers, only CBN-licensed institutions are permitted to act as Issuers for contactless payments. An Issuer is responsible for issuing contactless payment enabled cards, tags, or mobile applications to consumers (consumers being people who procure cards, tags, tokens or contactless payment enabled mobile apps to facilitate payments to merchants or other service providers. Examples of CBN-licenced institutions in Nigeria that already issue contactless payment enabled cards and devices include the First Bank of Nigeria, United Bank for Africa, and Providus bank. These cards have embedded Radio Frequency Identification (RFID) technology which communicates with card readers to enable payment transfers. Issuers are required to ensure, that all tokens and devices issued by them for payment by Customers meet prescribed standards and specifications. Furthermore, Issuers are required to obtain and properly document Customer’s consent prior to enabling Customer’s device for contactless payment. Specifically, the guideline prohibits unsolicited activation of contactless payment service on any payment enabled device owned by any Customer. Relatedly, prior to activating contactless payment service for any Customer, an Issuer is required to verify and identify such Customers by his/her Bank Verification Number (BVN).
C. Payment System and Card System Administrators
Payment/Card System Administrators are operators of card and payment systems (such as Mastercard, Visa, Remita, and Flutterwave). Whilst Issuers are responsible for issuing cards and other enabled devices to Customers, the Payment/Card System Administrators oversees the administration and use of issued cards for payment. Payment System and Card System Administrators are required to comply with the Guideline generally and act in accordance with prescribed processing specifications whilst ensuring that their systems and schemes are interoperable.
D. Switching Companies
Switching Companies are CBN-licensed institutions that oversee the routing of transaction data, interbank payment clearing and settlement, payment authentication and authorisation and risk management. The Nigeria Interbank Settlement System (NIBSS) is the Central Switch for the Nigerian Financial Market. Other than the NIBSS; Interswitch, eTranzact, and Flutterwave are some of the other licensed Switching Companies. The Guideline mandates Switching Companies to ensure that contactless transactions via approved payment instruments issued in Nigeria are successfully switched and to undertake periodic risk assessment to mitigate against money laundering and financing terrorism within the system.
E. Payment Terminal Services Providers
Payment Terminal Service Providers are CBN-licenced institutions that deploy contactless payment enabled Payment Terminals (Point of Sale Terminals) for use within the financial ecosystem. Payment Terminal Services Providers are by the Guideline, required to assure the quality and functionality of all contactless payment enabled terminals issued by them through optimal maintenance, availability of a 24/7 support infrastructure. It is recommended that response time for repair or replacement should not exceed 48 hours from the time of escalation.
F. Payment Terminal Service Aggregator
A Payment Terminal Service Aggregator (“PTSA”) oversees the interconnectivity of all payment terminals deployed with the Nigerian Payment Ecosystem. The Nigeria Interbank Settlement Scheme is the sole PTSA in Nigeria. It ensures that all terminals used in the e-payment ecosystem and all devices deployed in Nigeria are brand-agnostic and would accept all cards issued by any bank or other licensed card schemes without discrimination. NIBSS ensures the standardization of technical and operational specifications of all devices deployed within the Nigerian financial system. The Guideline requires the PTSA to certify that all Point-of-Sale terminals used for contactless payment meet required standard for the payment industry. It is also required to implement a documented risk management process to identify threats before, during and after all payment transactions.
These include businesses (large institutions or SMEs), that employ contactless payment devices as a means of receiving payment from customers. Merchants are by the Guideline, required to ensure that devices deployed for contactless payments are of the required specification, they are also required to exercise due diligence in effecting all payment transactions as they remain liable for any fraud resulting from negligence or connivance during a contactless payment transaction.
The Guideline further, requires all merchants who accept contactless payments to display the contactless payment symbol visibly in their location. They are also required to undertake second level authentication for transactions of a value which is higher than the stipulated limit per day via the customer’s Personal Identification Number (PIN) OR token code.
A customer is anyone making payment through a Contactless payment method. The Guideline requires Customers to exercise due diligence during contactless payment transactions whilst leaving them in full control to opt-in or out of any contactless payment service.
BENEFITS AND CHALLENGES
Prior to the release of the Draft Guideline, the only existing regulation in the contactless payment ecosystem was the Framework for Quick Response (QR) Code Payment in Nigeria, January 2021 (“Framework”). The Exposure Guideline is therefore a solid improvement on the hitherto QR Code Framework as it specifically sets out market requirements for the use and operation of all forms of contactless payment technology.
Apart from the wider scope of the Guideline, the general adoption of contactless payment will have an overall far-reaching effect on the economy as it will create a smarter, faster, more efficient and easy-to-use mode of payment which requires less manpower. It will also promote health and safety and reduce potential disease transmission at points of sale.
It is also necessary to mention that the posture of the Guideline is generally User-Centric, as the CBN mandates that use of contactless payment service must be elective whilst holding all participants within the value chain to regulatory service levels.
Without doubt, the benefit of the Guideline is enormous, yet a big impediment remains the introduction of transaction limit for contactless transactions, the Exposure Draft specifically provides for a NGN5000 (five thousand naira) transaction limit for a single transaction and a cumulative daily transaction limit of NGN30,000 (thirty thousand naira) per User. Transactions that fall outside this limit require an additional layer of authentication. Whilst the intention of the limit is noble and driven by the need to protect Users from significant impact should fraud, theft, impersonation, funds misappropriation occur; the threshold seems too low considering commercial realities in present day Nigeria. To guarantee that the contactless payment system remains a viable alternative for users therefore, it is imperative for the CBN to consider an upward review of the prescribed limit.
Finally, the Guideline envisages growth and innovation in the contactless payment ecosystem and therefore provides a protocol for innovative use cases. Where any stakeholder intends to offer novel or value-added service falling within the contactless payment niche, it is required to procure and obtain the prior approval of the CBN.
Contactless payment is fast becoming a preferred mode of payment across the Globe. UK Finance magazine reports that contactless payments accounted for over a quarter of all payment transactions in the United Kingdom in 2021. It is therefore expected that the introduction and implementation of the Guideline, shall in days to come foster public trust, deepen the contactless payment eco-system and consequently accelerate the speed of its adoption in Nigeria.