Statutory Basic Requirement:
The operation is based on the provision defined in Section 2 (1) point 6a and Annex 6 of HNB (Hungarian National Bank) Decree 35/2017 (XII. 14.) on the execution of payment transactions, effective from September 1, 2024, which allows for the transmission of data or part of the data necessary for submitting an instant transfer order in a form suitable for machine reading with a cash-substitute payment instrument.
The standardized data entry solutions can be as follows:
- QR code-based data entry solution,
- NFC-based data entry solution,
- Deep link-based data entry solution implemented using a Uniform Resource Locator (URL).
Additional recommendations to be considered in connection with the operation:
The provision of uniform principles for settlement, as well as the requirements related to the development of mobile banking applications and the information related to brand usage, are issued separately by the HNB.
General business expectations regarding the operation of the scheme:
The goal of the introduced solution is to create a payment solution that is equivalent to or exceeds the quality of card services, while relying on domestic infrastructure solutions (Instant Payment System).
Qvik payments (QR, Deeplink, NFC) enable the mass application of bank transfers in payment transactions, as they facilitate the direct entry of payment order data into mobile banking applications via camera, NFC port, or deep link.
In the case of qvik payments, the generated message is not simply a QR code but also a URL, thus it can "point to," activate, and then initiate the payment process with the selected programs. Due to the above, the same standard can be applied for payments in the form of QR codes, NFC, and deeplinks, allowing the most appropriate qvik payment to be used in different payment situations.
The detailed contractual terms related to Sub-aggregators are included in the joint business regulations of Aggregator-GIRO.
The SLAs to be fulfilled in connection with the execution are detailed in the GIRO Rulebook and the Aggregator Technical Manual, in addition to the decree.
The mandatory report elements related to the execution are determined by GIRO Plc. based on the guidance of the HNB.
The requirements related to technical connection and operation are included in the Technical Manual issued by the Aggregator.
The operational model, definitions, and expectations regarding the various stakeholders:
Aggregator: Innopay Zrt. is a technical service provider performing outsourced activities based on the Outsourcing Agreement concluded with GIRO, and also providing other services on its own behalf.
Paying Party: The legal entity that, as the owner of the payment account managed by the Paying Party's Payment Service Provider, approves a payment order through a mobile application installed on a portable multifunctional device considered a cash-substitute payment instrument, or during a computer-based web purchase.
Paying Party's Payment Service Provider: The payment service provider that enables the initiation of an instant transfer order for the Paying Party through a mobile application installed on a portable multifunctional device considered a cash-substitute payment instrument.
Sub-Aggregator: The service provider that produces the Unified Data Entry Solution and provides proof of the execution of the payment transaction for the Beneficiary.
Technical Aggregator: The technical service provider performing the technical tasks of the Sub-Aggregator.
Technical Manual: Contains the technical details related to message exchanges, error handling, service levels, and data provision rules.
Technical Compliance Certificate: A document issued by the Aggregator for a fixed period, authorizing the Sub-Aggregator to participate in qvik payments. The Technical Compliance Certificate is based on a self-assessment questionnaire and successful tests.
Expectations established in connection with the status of the Sub-Aggregator:
Only payment service providers with a registered office and license in an EEA state and foreign payment service providers with a branch in Hungary are eligible, excluding those payment service providers that are licensed solely for account information services as specified in Section 36 (1) point 87 h) of the Act CCXXXVII of 2013 on Credit Institutions and Financial Enterprises.
If the Sub-Aggregator designates an account in the qvik code as the beneficiary that is not the actual beneficiary and its payment account, but an account from which it settles separately with the actual beneficiary, then it must also have a license for the acceptance of payment transactions as specified in Section 6 (1) point 87 e) of the Act CCXXXVII of 2013 on Credit Institutions and Financial Enterprises.
Contractual relationships:
Before concluding the Tripartite Agreement, the Sub-Aggregator must complete the following tasks:
a. Successful execution of the tests prescribed in the Technical Manual and Testing Scenario;
b. Compliance with the security requirements specified in the Business Regulations, particularly but not exclusively those in the Technical Manual, and submission of a declaration to the Aggregator regarding this compliance;
c. Establishment of the network connection as specified in the Technical Manual to connect to the Aggregator;
d. Compliance with the two-factor authentication requirements prescribed by the Aggregator in the Technical Manual;
e. Provision of dedicated, secure communication hardware for the Aggregator that is not accessible from the outside and is sealed with a tamper-evident screw;
f. Ensuring communication bandwidth (providing expected response times) for transactions as prescribed by the Aggregator in the Technical Manual for other participants;
g. Physical receipt of the identification key generated by the Aggregator's PKI infrastructure.
The Aggregator issues a Technical Compliance Certificate valid for one year to confirm compliance with the technical conditions for contract conclusion. The Aggregator also specifies the mandatory change elements and the associated testing period, which the Sub-Aggregator must implement in their systems and provide evidence of successful testing. These change elements are announced by the Aggregator 3-6 months before they go live. The holder of the Technical Compliance Certificate is required to renew it annually on the anniversary of its issuance.
Settlement models:
The settlement model depends on the type of contract the merchant enters into with the provider that accepts qvik payments.
Single-step (direct) payment settlement model:
The Sub-Aggregator facilitates the payment (transfer) and is not the beneficiary. The beneficiary on the order is the merchant's payment account. The settlement occurs within 10 seconds using the Instant Payment System.
Two-step payment settlement model:
The Sub-Aggregator is the designated beneficiary on the transfer, which settles with the final beneficiary either itemized or aggregated. The settlement date is determined according to the contract between the merchant and the Sub-Aggregator.