BCTL INSTRUCTION NO. 34/2026

ON THE NATIONAL "TuQR" STANDARD FOR QR CODE-BASED PAYMENTS

The Central Bank of Timor-Leste, hereinafter referred to as BCTL, in the exercise of the powers conferred by its Organic Law and Decree-Law No. 17/2015, of June 24, on the National Payments System, while being the authority responsible for the establishment, regulation, and supervision of the National Payments System, recognizes the importance of technological innovation for the development of secure, efficient, interoperable, and inclusive payment services.

The expansion of electronic payments and the use of quick response codes require a common national standard that reduces market fragmentation, allows acceptance among different providers, ensures user confidence, and promotes responsible competition.

TuQR constitutes the unified national standard for the initiation and acceptance of payments based on quick response codes (QR Code) in Timor-Leste, complementing the national infrastructure of instant payments Ti-Fast and other infrastructures and rules applicable to the National Payments System.

This Instruction establishes the principles and legal, institutional, technical, operational, security, user protection, risk management, supervision, and transition requirements applicable to the TuQR standard.

Thus, under the powers conferred by Law No. 5/2011, of June 15, which approves the Organic Law of the Central Bank of Timor-Leste, by Decree-Law No. 17/2015, of June 24, on the National Payments System, and by the other applicable legislation, the Board of Directors of the Central Bank of Timor-Leste approves the following Instruction:

CHAPTER I

GENERAL PROVISIONS

Article 1.

Object

1. This Instruction establishes the regime applicable to the issuance, availability, acceptance, initiation, and processing of payments through the national TuQR standard in the Democratic Republic of Timor-Leste.

2. This Instruction establishes, in particular:
   a) TuQR as the mandatory national standard for QR code-based payments; b) the conditions for eligibility, adherence, certification, and participation; c) interoperability requirements and minimum operational rules; d) the duties of participants, technology providers, and merchants; e) security, risk management, data protection, and business continuity requirements.

Article 2.

Definitions

1. For the purposes of this Instruction, the following are understood:
   a) "beneficiary", the individual or legal person receiving the funds; b) "merchant", the individual or legal person accepting TuQR payments for the sale of goods or provision of services; c) "QR Code" (Quick Response Code), the two-dimensional code readable by electronic devices, used to store and transmit information intended for the initiation, execution, authentication, or receipt of electronic fund transfers; d) "relevant incident", the operational, technological, security, fraud, or data event that affects or may materially affect the availability, integrity, confidentiality, or regularity of services; e) "TuQR Technical Manual", the document issued or approved by BCTL containing the detailed specifications of the TuQR standard; f) "payer", the individual or legal person authorizing the execution of the payment; g) "payment", an electronic transfer of funds; h) "participant", the payment service provider that has been approved and certified to perform functions in the TuQR ecosystem; i) "acquiring provider", the participant that integrates the merchant, issues or manages the respective TuQR, and receives the payment instruction for its benefit; j) "issuing provider", the participant that makes available to the payer the payment instrument, payment account, or application used to initiate the payment; k) "static QR", the type of QR code that contains permanent beneficiary data and requires, where applicable, the entry of the amount by the payer; l) "dynamic QR", the type of QR code generated for a specific transaction, containing the amount or other elements specific to the operation and may have a validity period; m) "Ti-Fast", the national retail instant payments infrastructure established by BCTL; n) "TuQR", the unified national standard of Timor-Leste for the initiation and acceptance of payments through QR Code; o) "TuQR Standard", the set of technical, operational, security, and visual identity specifications approved by BCTL; p) "user", the individual or legal person using a QR code in accordance with TuQR to initiate or receive a payment, without prejudice to provisions specifically applicable to merchants.

2. Without prejudice to the provisions of this Instruction, the definitions contained in Decree-Law No. 17/2015, of June 24, 2015, are applicable.

Article 3.

Objectives

This Instruction has the following objectives:
a) to ensure a secure, efficient, resilient, accessible, and inclusive QR code payment ecosystem; b) to promote interoperability between payment service providers, merchants, and users, promoting the use of a common QR code standard for payment acceptance; c) to prevent market fragmentation, promote greater efficiency in payment acceptance, and avoid unjustified restrictions on competition; d) to protect users and strengthen confidence in digital payments; e) to promote responsible innovation and the adoption of open technological standards; f) to preserve the integrity, stability, and efficiency of the National Payments System.

Article 4.

Scope of Application

1. This Instruction applies, to the extent that its provisions are applicable to:
   a) payment service providers authorized or licensed under Decree-Law No. 17/2015, of June 24, and the complementary regulation issued by BCTL for the provision of payment services; b) system operators and payment infrastructures; c) technology providers and third parties contracted for functions related to TuQR; d) merchants accepting TuQR payments; e) other entities determined by BCTL, in accordance with applicable legislation.

2. Merchants are subject only to the provisions expressly applicable to them or to the obligations transmitted to them by their respective acquiring provider under this Instruction.

CHAPTER II

ESTABLISHMENT AND GOVERNANCE OF TUQR

Article 5.

Establishment of the National Standard

1. BCTL establishes TuQR as the mandatory national standard for the issuance and acceptance of QR code-based payments in Timor-Leste.

2. No payment service provider may issue, make available, present, or promote as a national standard a QR Code for payments that does not comply with the TuQR Standard.

3. Without prejudice to the transitional regime provided for in this Instruction, BCTL is responsible for the governance, approval, updating, and supervision of the TuQR Standard.

4. Payment service providers that, on the date of entry into force of this Instruction, use their own QR code solutions, must proceed with the migration, replacement, or discontinuation of those solutions within the timeframes determined by BCTL.

Article 6.

Relationship with Ti-Fast

1. TuQR constitutes a payment initiation and acceptance arrangement and not, by itself, a payment, clearing, or settlement system.

2. TuQR transactions must be routed, processed, and settled through Ti-Fast or another infrastructure authorized by BCTL.

3. The participation, clearing, settlement, irrevocability, and finality of operations comply with applicable legislation, Ti-Fast rules, and complementary standards issued by BCTL.

Article 7.

Interoperability and Non-Discriminatory Access

1. A TuQR issued in conformity with the national standard must be usable by clients of different authorized participants, without prejudice to legitimate limitations provided by law or determined by BCTL.

2. The implementation of technical, contractual, or commercial mechanisms that unjustifiably restrict interoperability, create undue exclusivity, or discriminate participants under equivalent conditions is prohibited.

3. Participants must apply transparent, objective, proportional, and non-discriminatory conditions for access to and use of TuQR payments.

Article 8.

TuQR Technical Manual

1. BCTL approves and publishes or communicates to participants the TuQR Technical Manual, which integrates, for compliance purposes, the rules applicable to the TuQR standard.

2. The TuQR Technical Manual must establish, among other matters:
   a) the structure, format, and mandatory and optional data fields; b) the rules applicable to static QR and dynamic QR; c) the requirements for participant, merchant, amount, and currency identification; d) validation, integrity, authentication, and expiration mechanisms; e) messages, states, response codes, and error handling; f) testing, certification, version control, and change management; g) visual identity requirements and use of the TuQR brand.

3. BCTL may update the TuQR Technical Manual, after consulting participants when the nature or impact of the change justifies it and granting a reasonable implementation period.

Article 9.

Brand and Visual Identity

1. The name, logo, and other TuQR identity elements are the property of BCTL and administered by it.

2. Participants and merchants may only use the TuQR brand in accordance with the rules issued by BCTL.

3. Any use likely to mislead the public regarding the authorization, guarantee, sponsorship, or responsibility of BCTL is prohibited.

CHAPTER III

ELIGIBILITY, ADHERENCE, AND CERTIFICATION

Article 10.

Eligibility and Approval

1. Only payment service providers may provide payment services with TuQR.

2. The license or authorization as a payment service provider does not automatically confer the right to participate in the TuQR arrangement.

3. Participation depends on the satisfactory completion of adherence, integration, testing, technical certification, and operational approval requirements defined by BCTL.

4. The participant must obtain prior approval from BCTL for material changes to the operational or technological model of the TuQR arrangement.

Article 11.

Application and Participation Requirements

1. The application for participation or approval must include, as determined by BCTL:
   a) business model and description of operational and financial flows; b) technological architecture and interfaces; c) governance, internal controls, and risk management; d) cybersecurity, fraud prevention, and data protection measures; e) complaint, refund, and dispute resolution procedures; f) business recovery and continuity plan; g) third-party contracting and supervision model; h) integration plan and support for merchants and users.

2. BCTL may dispense with the presentation of one or more of the elements referred to in paragraph 1 when it already possesses that information and such elements are not specific to participation in the TuQR arrangement.

Article 12.

Testing and Certification

1. Before the start of service provision, the participant must complete the compliance, interoperability, security, performance, continuity, and user experience testing required by BCTL.

2. BCTL may require new certification whenever material changes occur, relevant updates to the TuQR standard, or incidents that raise doubts regarding the participant's compliance.

3. The participant must retain evidence of the tests performed and make it available to BCTL when requested.

Article 13.

Suspension and Cessation of Participation

1. BCTL may determine the total or partial suspension of participation when there is significant risk to users, participants, or the National Payments System.

2. Voluntary cessation must be previously communicated to BCTL and executed according to a plan, approved by BCTL, that ensures the protection of users, merchants, and pending operations.

3. The suspension or cessation of participation does not prejudice the fulfillment of obligations established before that moment or in progress, including settlement, reconciliation, refund, record retention, and complaint resolution.

CHAPTER IV

OPERATIONAL RULES

Article 14.

Static QR and Dynamic QR

1. Participants may make available static or dynamic QR, provided they comply with the TuQR Standard.

2. When a static QR is used, the application must present to the payer, before authorization, the beneficiary's name and the amount entered.

3. The dynamic QR must identify the transaction, include the amount where applicable, and respect the established validity period.

4. The limits applicable to TuQR payment operations are the limits established for the underlying account, source of funds, or payment instrument used in the operation.

5. Participants may, in accordance with applicable rules and market practices, apply additional risk-based controls, provided they are proportional, transparent, and do not compromise interoperability or the proper functioning of the TuQR arrangement.

Article 15.

Prior Information and Authorization of Payment Operation

1. Payments made under this Instruction are subject to the information duties provided for in Decree-Law No. 17/2015, of June 24, 2015.

2. Without prejudice to the provisions of the preceding paragraph, before the authorization of a payment operation, the issuing provider must make available to the payer, in a clear, precise, and easily understandable manner, at least the following information:
   a) the name or denomination of the beneficiary; b) the amount and currency of the payment operation; c) the commissions, fees, or other charges applicable;

3. The payment operation may only be executed after adequate authentication and authorization by the payer, in accordance with applicable legislation and regulation.

Article 16.

Processing and Operation Status

1. Participants must process payment operations correctly, securely, and timely, and assign them a unique identifier.

2. The systems and procedures used must distinguish, at least, the operation states of initiated, pending, completed, rejected, expired, cancelled, or reversed.

3. Participants must prevent and handle duplicate operations, inconsistent messages, communication failures, and timeouts, in accordance with Ti-Fast rules and the TuQR Technical Manual.

Article 17.

Confirmation and Proof of Payment

1. After the completion of the payment operation, the payer and the beneficiary must receive electronic confirmation through their respective channels.

2. The confirmation must include, at least, the operation status, amount, date and time, beneficiary identification, and unique operation reference.

3. A photograph, image, or screenshot presented by the payer does not constitute, by itself, valid confirmation of payment.

4. When the beneficiary is a merchant, it must confirm the completion of the operation in its own system or in the channel made available by the acquiring provider before considering the payment made.

Article 18.

Irrevocability, Reversal, and Reconciliation

1. The irrevocability and finality of the settlement of payment operations are governed by applicable legislation and the rules of the respective system.

2. Pending, rejected, duplicate, or incomplete operations must be subject to automatic reversal or regularization whenever technically possible.

3. Participants must execute daily reconciliation and adopt procedures to identify and resolve discrepancies within the timeframes established by BCTL.

Article 19.

Availability and Continuity

1. Participants must ensure adequate levels of capacity, availability, monitoring, and operational support, taking into account the nature and volume of services provided.

2. Participants must maintain business recovery and continuity plans, which must be tested periodically.

3. Planned interruptions of a participant's services must be communicated in advance by that participant to affected users and merchants, unless security reasons prevent such communication.

4. When a planned interruption affects Ti-FAST or any other national infrastructure used for processing TuQR operations, BCTL or the designated operator must communicate this interruption to affected participants.

5. Upon receiving the communication referred to in the preceding paragraph, participants must, where applicable, inform their respective users and merchants.

CHAPTER V

OBLIGATIONS OF PARTICIPANTS, THIRD PARTIES, AND MERCHANTS

Article 20.

General Obligations of Participants

Without prejudice to other obligations applicable to payment service providers under current legislation and regulation, participants must, in particular:
a) comply with this Instruction, the TuQR Standard, and any complementary standards; b) ensure the security, availability, quality, and integrity of services provided under this Instruction; c) provide adequate information and support to users and merchants; d) cooperate with BCTL and other participants in the resolution of incidents.

Article 21.

Outsourcing

1. The outsourcing of functions related to any services or activities covered by this Instruction is governed by the provisions of Decree-Law No. 17/2015, of June 24, 2015. Outsourcing does not reduce, exclude, or transfer the participant's responsibility for compliance with this Instruction, applicable legislation, or obligations towards users, merchants, and BCTL.

2. The hiring of a merchant aggregator or another provider with an equivalent function, which acts as an intermediary between merchants and acquiring participants and is not itself a participant in the TuQR arrangement, is subject to the prior realization of a risk assessment, the conclusion of a written contract, the implementation of adequate control mechanisms, and continuous supervision by the participants hiring it, and, when determined by BCTL, prior approval.

3. The participant must ensure that the merchant aggregator complies with applicable requirements regarding merchant integration, security, data protection, fraud prevention, fund routing, record retention, and cooperation with BCTL.

Article 22.

Obligations Applicable to Merchants

1. The merchant wishing to accept payments through TuQR must:
   a) use only a QR Code issued or approved by its respective acquiring provider; b) display the code and TuQR identity correctly and without deception; c) regularly verify that the QR Code has not been altered, hidden, or replaced; d) immediately remove any invalid, suspended, outdated, or suspicious QR Code; e) not alter the data or elements of the QR Code; f) confirm the completion of the payment in its own channel; g) not use exclusively images or screenshots as proof of payment; h) immediately inform the acquiring provider of suspected fraud or tampering; i) cooperate in the investigation and resolution of complaints, refunds, and fraud.

2. The acquiring provider must inform the merchant about the obligations provided for in the preceding paragraph and provide adequate guidance and support.

Article 23.

Tariffs and Commercial Practices

1. Tariffs and charges related to TuQR must be transparent, proportional, and communicated before the contracting of the good or service and the authorization of the payment operation.

2. Hidden or different charging than that disclosed to the user is prohibited.

3. The merchant may not charge the user any additional value for the use of TuQR, unless permitted by legislation or expressly authorized by BCTL and previously disclosed under paragraph 1.

4. With a view to promoting the adoption and use of TuQR, BCTL may determine, for an initial period or other periods it deems appropriate, the total or partial exemption of tariffs or charges applicable to TuQR operations.

5. BCTL may establish, approve, or review the tariff regime applicable to TuQR operations, including commissions between participants, tariffs applicable to merchants, and other price components, taking into consideration efficiency, financial inclusion, competition, and service sustainability.

6. For the purposes of the preceding paragraph, BCTL must consult participants, including commercial banks and other payment service providers, before establishing or reviewing the applicable tariff regime.

CHAPTER VI

USER PROTECTION AND LIABILITY

Article 24.

Duties of Information, Complaints, and Dispute Resolution

Matters relating to duties of information, complaints, dispute resolution, liability, and other matters related to user protection are governed by the provisions of Decree-Law No. 17/2015, of June 24, 2015.

Article 25.

Unauthorized Operations and Burden of Proof

1. Without prejudice to the provisions of applicable legislation and regulation, the participant must have mechanisms intended to prevent, detect, block, investigate, and resolve unauthorized operations.

2. When the user contests a payment operation, it is incumbent upon its respective participant to demonstrate that the operation was authenticated, correctly recorded, and processed, and that it was not affected by any technical failure or other deficiency of the service.

3. The mere recording of the use of the payment instrument or security credentials does not constitute, by itself, sufficient proof of operation authorization, fraud, or gross negligence by the user.

4. The apportionment of losses and any eventual refund are governed by applicable legislation and standards issued by BCTL, considering the conduct of each of the parties and the effectiveness of the control mechanisms implemented.

Article 26
Refunds, Errors, and Regularization

1. Participants must provide clear procedures for the refund, reversal, and regularization of payment operations that were erroneously executed, duplicated, incomplete, or disputed.
2. Commercial refunds authorized by the merchant must be processed to the original account or instrument, unless impossibility is duly justified.
3. No participant may unjustifiably hinder the submission or investigation of a regularization request.

CHAPTER VII
SECURITY, DATA, FRAUD, AND RESILIENCE

Article 27
Risk Management

1. Participants must maintain a risk management framework proportional to the nature, size, and complexity of their TuQR services.
2. The risk management framework referred to in the preceding paragraph must cover, at least, operational, technological, cyber, fraud, liquidity, third-party, data, compliance, reputation, and continuity risks.
3. Controls and limits must be reviewed periodically and whenever a material change or relevant incident occurs.

Article 28
Cybersecurity and Authentication
Participants must implement, in accordance with applicable legislation and regulation, adequate measures for:
a) identity, access, and authentication management; b) cryptographic protection of data in transit and at rest; c) secure development, alteration, and configuration of systems and applications used; d) vulnerability management and security testing; e) logging, monitoring, and threat detection; f) segregation of duties and control of privileged access; g) response, recovery, and adoption of measures following incidents.

Article 29
Fraud Prevention and Control

1. Participants must monitor transactions and abnormal behaviors, apply risk-based controls, and enable the rapid blocking or suspension of suspicious operations.
2. Participants must cooperate in the prevention of QR Code substitution, fake merchants, social engineering, account takeover, duplicate operations, and other forms of fraud.
3. Preventive suspension must be proportional, documented, and accompanied by a review procedure.

Article 30
Governance and Data Protection

1. Merchant and user data obtained in the exercise of activities regulated by this Instruction must be processed lawfully, securely, transparently, and limited to what is strictly necessary for the provision of services, fulfillment of legal obligations, fraud prevention, risk management, audit, and exercise of rights, in accordance with applicable legislation.
2. Participants must ensure the confidentiality, integrity, availability, accuracy, minimization, traceability, and proper retention of data.
3. Use for marketing, advertising, or other secondary purposes depends on an adequate legal basis and cannot constitute an undue condition for access to or use of data or as a condition for accessing services.
4. Sharing, international transfer, external storage, and processing by third parties must comply with applicable legislation and requirements issued by the BCTL.

Article 31
Incident Reporting

1. Participants must report to the BCTL, without unjustified delay, any relevant incident, including:
   a) unavailability or significant degradation of services; b) cybersecurity incident or data breach; c) relevant fraud or coordinated pattern of fraud; d) settlement, reconciliation, or processing failure; e) event likely to affect other participants or confidence in the arrangement.
2. The initial report must be followed by updates and a final report containing, at least, a description of the incident's impact, an analysis of its causes, the measures adopted, and the plan intended to prevent recurrence.
3. The BCTL defines the criteria for materiality, deadlines, content, and communication channels under the preceding number.

CHAPTER VIII
PREVENTION OF MONEY LAUNDERING AND FINANCING OF TERRORISM

Article 32
Compliance with Obligations for the Prevention of Money Laundering and Financing of Terrorism

1. Participants must comply with the legislation and BCTL instructions applicable to the prevention and combating of money laundering and financing of terrorism.
2. Compliance includes, where applicable, identification and due diligence on clients and merchants, transaction monitoring, reporting of suspicious operations, record retention, and application of specific financial sanctions.
3. Controls must be proportional to the risk and cannot compromise interoperability beyond what is necessary for legal compliance.

CHAPTER IX
SUPERVISION AND REPORTING

Article 33
Powers and Competences of the BCTL
In the exercise of competences legally attributed, the BCTL may, among others:
a) monitor TuQR services and operations; b) request information, documents, data, and reports from participants; c) carry out inspections, assessments, and audits; d) determine tests, independent reviews, or recertification; e) issue technical instructions and guidelines; f) determine corrective measures or operational limitations; g) suspend services when there is significant risk, in accordance with applicable legislation.

Article 34
Reports and Communications to the BCTL

1. Participants must submit to the BCTL, in the form and periodicity determined by it:
   a) statistics on transactions, users, and merchants; b) indicators of availability, performance, and quality; c) data on frauds, complaints, refunds, and disputes; d) incident, continuity, and test reports; e) information on risks, third parties, and material changes; f) other elements as determined by the BCTL.
2. The information provided must be complete, accurate, consistent, traceable, and presented within the established deadlines.

Article 35
Record Retention

1. Participants must retain records of payment operations, authorizations, confirmations, complaints, incidents, and investigations for the period established in applicable legislation and regulation.
2. Records must allow for the reconstruction of operations and be made available to the BCTL and competent authorities in accordance with the law.

CHAPTER X
NON-COMPLIANCE AND CORRECTIVE MEASURES

Article 36
Non-Compliance

1. Without prejudice to the provisions of applicable legislation and regulation, non-compliance with this Instruction constitutes:
   a) issuing or accepting QR Codes incompatible with the TuQR Standard; b) providing services without the required approval or certification; c) unjustifiably restricting interoperability within the arrangement; d) violating security, user protection, data, or communication requirements to the BCTL; e) failing to execute orders, instructions, or determinations of the BCTL.
2. Non-compliance is subject to measures and sanctions provided for in applicable legislation and regulation.

Article 37
Corrective Measures
Without prejudice to other legally applicable measures and sanctions, the BCTL may determine, proportionally to the risk and severity of the non-compliance:
a) presentation and execution of a corrective measures plan; b) reinforcement of controls, tests, or independent audit; c) temporary limitation of products, functionalities, or volumes; d) suspension of issuance, acceptance, or participation in the TuQR arrangement; e) compensation or reparation of affected users, when legally admissible.

CHAPTER XI
FINAL AND TRANSITIONAL PROVISIONS

Article 38
Cross-Border Payments

1. The use of TuQR in cross-border payments depends on specific approval by the BCTL and the existence of applicable agreements, technical rules, exchange, settlement, supervision, and user protection rules.
2. This Instruction does not, by itself, authorize the processing or offering of cross-border payments.

Article 39
Complementary Standards

1. The BCTL may issue manuals, technical standards, circulars, guidelines, and forms necessary for the execution of this Instruction.
2. In case of conflict, legislation and this Instruction prevail over complementary technical and operational documents.

Article 40
Review of the TuQR

1. The BCTL carries out periodic review of the TuQR Standard, taking into account technological evolution, risks, user experience, competition conditions, and market evolution.
2. Whenever deemed appropriate, the BCTL may consult participants, representative associations, merchants, consumers, and other stakeholders.

Article 41
Transitional Regime

1. Payment service providers who, on the date of entry into force of this Instruction, provide payments via QR Code must submit to the BCTL, within the deadline determined by it, a migration plan to TuQR.
2. The issuance of new QR Codes incompatible with the TuQR Standard is prohibited from the date determined by the BCTL.
3. Existing QR Codes incompatible with the TuQR Standard must be replaced, adapted, or discontinued within a maximum period of 30 days from the date referred to in the preceding number, unless a different deadline is fixed by the BCTL.
4. The BCTL may grant, upon reasoned request, a limited extension of the deadline when security, interoperability, or user protection are not compromised.

Article 42
Publication and Entry into Force

1. This Instruction is published in the Official Gazette, in accordance with the Organic Law of the Central Bank of Timor-Leste.
2. This Instruction enters into force the day following its publication.
3. Technical and migration obligations become enforceable within the deadlines established in Article 41 and in complementary norms issued by the BCTL.

Approved by the Board of Directors of the Central Bank of Timor-Leste on September 9, 2026.
The Governor,
Hélder Lopes