Instruction for the Implementation of the Interoperable QR

Code:
INS - MP01 - GEFPP - 001

Version:
0.0

Validity:
March 18, 2026

Financial Stability and Public Policy Management

Information Classification: Internal Access ☐ Official ☒ Public non-official ☐ Reserved ☐ Confidential ☒ All employees ☐ Restricted

Financial Stability and Public Policy Management Code: INS - MP01 - GEFPP - 001

Instruction for the Implementation of the QR

REVIEWED:
APPROVED BY:
President Vice President

Session No. CD-06/2026 of March 18, 2026

INDEX

Generalities .......................................................................................................3
Objective ..................................................................................................................5
Definitions ...........................................................................................................5
General Rules ........................................................................................................8
Specific Rules ......................................................................................................9
Obligations of Participants ...........................................................................12
Prohibitions for Participants ..........................................................................13
Supervision Functions .....................................................................................14
Non-compliance, Sanctions and Procedure .............................................14
Exceptions ........................................................................................................17
Special Provisions .........................................................................................18
Validity, Distribution and Dissemination ......................................................18
Transitional Provisions ................................................................................19
Version Control .............................................................................................19

Financial Stability and Public Policy Management Code: INS - MP01 - GEFPP - 001

Instruction for the Implementation of the QR

REVIEWED:
APPROVED BY:
President Vice President

Session No. CD-06/2026 of March 18, 2026

1. Generalities

1.1. Background

Within the framework of the digital transformation process of the payment system in El Salvador, technological advances, international trends, and the regional push for interoperability of payment instruments, the Central Bank of El Salvador (BCR), exercising the powers conferred by Article 67 of its Organic Law, issues this Instruction for the implementation of the interoperable QR code as a payment initiation mechanism.

This regulatory body is part of institutional efforts to strengthen digital payment infrastructure, through the adoption of modern, standardized, and secure mechanisms that respond to the needs of the national financial ecosystem. The implementation of interoperable QR codes as a payment initiation tool contributes to this purpose and allows progress toward a more accessible, competitive, and inclusive environment, in line with international best practices and current public policies on digitalization and financial inclusion.

Likewise, it is aligned with national strategic instruments, such as the Digital Agenda of El Salvador 2020–2030, which promotes the modernization of public services through interoperable digital platforms, the National Financial Inclusion Policy, and the National Fintech Strategy, which promote equitable access to financial services through innovative technological solutions.

International experiences have demonstrated the benefits of integrating interoperable QR codes into national payment systems, facilitating more agile, secure, and accessible transactions between financial institutions, businesses, users, and various platforms. These models have contributed to reducing fragmentation of the payment ecosystem and improving operational efficiency.

The standardization of QR code specifications will foster broader adoption of mobile payments in El Salvador's retail trade, while guaranteeing a homogeneous user experience for merchants and consumers. This measure will promote interoperability among different payment service providers, by enabling a single QR code to be used to receive payments from any compatible mobile or web application.

The Central Bank of Reserve will provide the unique interoperable QR code standard, which may be adopted by all entities that collect funds from the public and are Participants of the Payment Systems administered by the BCR or entities that have been authorized by the BCR Board of Directors to be Participants of the Payment Systems.

1.2. Legal Basis

1.2.1. Constitution of the Republic of El Salvador, Article 101.
1.2.2. Treaty on Payment Systems and Securities Settlement in Central America and the Dominican Republic.
1.2.3. Organic Law of the Central Bank of El Salvador, Article 3 letters g) and h), Article 67.
1.2.4. Special Law for the Prevention, Control, and Sanction of Money Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction.
1.2.5. Instruction for the Prevention, Detection, and Control of Money Laundering and Asset Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction.
1.2.6. Regulation of the Law Against Money Laundering and Asset Laundering.
1.2.7. Financial Investigation Unit Instruction for the Prevention of Money Laundering and Asset Laundering.
1.2.8. Law for the Protection of Personal Data.

1.3. Scope of Application

The provisions contained in this Instruction shall be mandatory for Participants of the Payment Systems administered by the BCR and who have the technology to read QR codes within their electronic channels.

2. Objective

Establish technical and operational standards that guarantee the interoperability of the QR code as a unique, standardized, and accessible payment method in El Salvador; allowing any user to make payments from any interoperable mobile or web application to any affiliated merchant or payment receiver, regardless of the financial institution involved.

In this way, it seeks to expedite interbank payments in a secure and transparent manner, promote the efficiency of the payment system, and actively contribute to strengthening financial inclusion.

3. Definitions

3.1. Payment Aggregators:

Service that links, on behalf of an acquiring entity, entities or persons of commerce and/or service established through its service and technological infrastructure to accept electronic payment methods, collecting on behalf of such merchants the product of the settlement of authorized payments, to settle them through a credit in favor of the commerce or service with which it has agreed through a contract the financial payment service.

3.2. Application or App:

Software program designed to be used on mobile devices, such as but not limited to: smartphones or tablets, through an internet connection. Which are obtained from application stores such as App Store for iOS, Play Store for Android, or Huawei AppGallery.

3.3. Central Bank or BCR:

Central Bank of El Salvador.

3.4. Digital or Electronic Channels:

Online platform, such as an application or website, that allows users to perform financial transactions quickly and conveniently, including, but not limited to: personal banking, corporate banking, and mobile banking.

3.5. QR Code:

Two-dimensional graphic representation, encoded through a pattern of square modules, which allows storing structured information efficiently. In the context of interoperable payments, the QR code contains the necessary data to initiate an electronic transaction, such as the merchant or person identifier, currency, issuer or acquirer, and other technical elements defined by the national standard.

3.6. Merchant:

Natural or legal person who offers goods or services to third parties in exchange for payment, and who has been affiliated by an authorized participant of the payment systems to accept electronic payments through the use of the Interoperable QR Code.

3.7. Payment Ecosystem:

Set of entities, infrastructures, mechanisms, rules, products, and users that interact with each other to allow the execution of electronic payments within an interoperable system. It includes financial institutions, issuers, acquirers, payment aggregators, merchants, end users, technological platforms, mobile applications, payment channels, settlement networks, and the system administrator (Central Bank), among other participants.

3.8. EMVCo (Europay, Mastercard, and Visa Company):

It is a global organization that establishes interoperability and security standards for electronic payments, including chip cards, contactless payments, and QR codes. In the case of the Central Bank of El Salvador, it is used to have a standard format for QR code payments in our payment system.

3.9. National Standard:

Technical specification that establishes the characteristics, structure, security requirements, and interoperability of the QR code used in El Salvador, with the objective of ensuring its uniform functioning among participants.

3.10. AML/CFT/CPF:

Money Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction.

3.11. OVSP:

Payment Systems Surveillance Office of the Central Bank of El Salvador.

3.12. Participant or Obligated Entity:

Financial and payment services entity authorized by the Central Bank of Reserve as a participant of the payment systems in accordance with the requirements established in related regulations and that are obliged to comply with what is established in this Instruction.

3.13. Issuing Entity:

Participant entity that administers the payment register, account, or payment instrument of the orderer and that authorizes or rejects the transaction initiated through the interoperable QR code.

3.14. Acquiring Entity:

Participant entity that affiliates the merchant or fund receiver and that receives and manages the transaction initiated through the interoperable QR code for its processing and settlement.

3.15. Digital Platform or Platform:

Set of hardware and/or software through which operations will be carried out between the different agents interacting in the payment systems.

3.16. Payment Systems:

Set of rules, agreements, procedures, and systems, whose main objective is the execution of fund transfer instructions between its participants.

3.17. Robust Cybersecurity System:

Set of policies, processes, controls, technological mechanisms, and governance structures implemented by the Central Bank to guarantee the availability, integrity, confidentiality, and traceability of information and operations carried out through the Interoperable QR, as well as to protect data against unauthorized access, cyberattacks, fraud, or security incidents, ensuring continuous and secure operation in accordance with the regulatory framework.

4. General Rules

4.1.

The BCR shall be responsible for establishing and administering a unique standard for interoperable QR codes, and in its capacity as administrator, is responsible for ensuring its correct functioning, regulating, and disseminating the regulations governing it.

4.2.

The QR standard shall be mandatory for all participating institutions of the payment systems that have the technology to read QR codes within their electronic channels, in order to guarantee compatibility among all institutions.

4.3.

The BCR as an obligated subject shall establish measures to prevent the risk of Money Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction (AML/CFT/CPF), in order to comply with the responsibilities established in the Special Law for the Prevention, Control, and Sanction of Money Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction, as well as the Instruction for the Prevention, Detection, and Control of Money Laundering and Asset Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction and other related international regulations and standards.

4.4.

All payment transactions with QR codes shall be subject to monitoring by the Payment Systems Surveillance Office and the BCR Compliance Office, according to the criteria they have established.

4.5.

All payments made through the generation of the QR shall be made in full according to the record that originates the transaction, and shall execute the verification of the integrity of the information chain.

4.6.

The Central Bank, in the execution of the supervision function of the Payment Systems, shall ensure the proper functioning of the platform and the interaction with other participants in the payment ecosystem. For this purpose, the Central Bank is authorized to request periodic information regarding operations and functioning on the platform and to carry out on-site inspections of participating legal entities, including access to other sources of information deemed necessary for the exercise of its function.

5. Specific Rules

5.1. Administrator Responsibilities

5.1.1.

Establish technical homologation and certification procedures for payment system participants, ensuring they meet minimum interoperability, security, and performance requirements before integrating into the QR payment ecosystem.

5.1.2.

Ensure the correct implementation and compliance with the adopted technical standard, as well as ensure interoperability among participants in the ecosystem.

5.1.3.

Issue operational and technical guidelines, and periodic updates of technical specifications through the interoperable QR technical document.

5.1.4.

The Central Bank shall be responsible for maintaining a robust Cybersecurity system that guarantees the availability and security of operation information.

5.1.5.

The Central Bank shall implement technical and procedural mechanisms and controls that ensure compliance with the national and international regulatory framework in matters of prevention of Money Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction, including due diligence processes, transactional monitoring, and reporting of suspicious operations to the competent authority.

The Compliance Office to execute the functions and responsibilities of the BCR as an Obligated Subject in accordance with laws governing AML/CFT/CPF may require, within the timeframe it deems appropriate, information on clients, users, participants, transactions, or any type of information necessary to execute said function.

5.2. General Conditions for QR Implementation

5.2.1. Unified QR Standard

5.2.1.1.

A single national QR code format complying with the EMVCo standard shall be defined.

5.2.1.2.

All participants of the payment systems that have the technology to read QR codes within their electronic channels shall adopt the unique QR code format for interoperability.

5.2.1.3.

The technical requirements of the QR code format will imply: mandatory minimum data encoding (merchant identifier, currency, amount, etc.), field structure, size, reserved margin, error correction levels, etc.

5.2.2. Interoperability

5.2.2.1.

All reading devices and payment applications compatible with the established standard must be able to read the QR information chain.

5.2.2.2.

Mobile or web applications of Participants that have the technology to read QR codes must be able to read any QR code and structure the operation message under the national standard.

5.2.3. Security and Data Protection

5.2.3.1.

Robust authentication mechanisms shall be required for merchants and issuing or acquiring entities participating in the payment systems. This includes formal verification of the merchant's identity, compliance with commercial registration processes, and application of due diligence controls in accordance with Money Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction prevention policies.

5.2.3.2.

Participants shall maintain complete and traceable records of all transactions processed through the QR system. This includes the generation of audit logs, mechanisms for detecting unusual or fraudulent operations, and procedures for the management, analysis, and resolution of user claims.

5.2.3.3.

Compliance with current regulations in El Salvador in matters of personal data protection shall be mandatory. Participants shall adopt policies and controls that ensure the lawful, secure, and transparent treatment of user data, avoiding misuse, unauthorized access, or loss.

5.2.3.4.

Additionally, participants shall implement access controls, continuous security monitoring, and periodic review of their technological infrastructures to guarantee the integrity and resilience of payment systems against internal and external threats.

5.2.4. Costs and Fees

5.2.4.1.

Transactions carried out through the Interoperable QR Code shall not generate charges or commissions for users or merchants.

5.2.4.2.

Participants of the payment systems shall not pass on costs associated with the use of the interoperable QR to end users or merchants.

5.2.5. Administration and Issuance of the QR Code

5.2.5.1.

Each QR Code under the assigned national standard to a merchant shall be previously registered in the participant responsible for its issuance and administration.

5.2.5.2.

Participants who already have QR codes outside the national standard may maintain them and process them based on their current technologies.

5.2.5.3.

Participants responsible for issuing the QR for merchants shall implement mechanisms to:

a) Know the geolocation coordinates of the merchant, b) Update information of existing merchants, c) Consult the validity of a QR code in real time, d) Revoke or suspend codes in case of irregularities.

5.2.5.4.

Participating payment applications shall be able to consult the information and validate the authenticity and status of the scanned QR code before processing a transaction and creating the operation in accordance with the technical specifications provided.

5.2.5.5.

The BCR may suspend or annul QR codes issued under the national standard that do not comply with the established technical, security, or legal requirements.

6. Obligations of Participants

Participating entities that have the technology to read QR codes within their electronic channels shall permanently comply with the following obligations:

6.1.

Comply with the technical and operational requirements established by the Central Bank for the issuance and reading of interoperable QR, including homologation, certification, and conformity testing processes.

6.2.

Implement in their mobile or web applications that have the technology to read QR codes the necessary technological solutions to be able to read any standard format QR code and structure the operation message under the national standard.

6.3.

Implement the technical specifications of the interoperable QR code in accordance with the guidelines and brand manual issued by the Central Bank, ensuring its correct functioning at all points of acceptance.

6.4.

Ensure the interoperability of their platforms, applications, and devices with the national QR standard, allowing the sending and receiving of payments between participants of the payment systems.

Gerencia e Estabilidad Financiera y Políticas Públicas Código:
INS - MP01 - GEFPP - 001
Instructivo para la implementación del QR
REVISADO: APROBADO POR:
Presidente Vicepresidente
Sesión No. CD -06 /202 6 del 18 de marzo de 202 6

6.5. Maintain the availability, stability and security of systems related to QR payment processing, complying with the service levels defined by the Central Bank.
6.6. Apply cybersecurity, operational continuity and personal data protection controls, in accordance with the current regulatory framework and guidelines issued by the Administrator.
6.7. Ensure that affiliated merchants and/or clients to whom they provide QR payment acceptance services receive clear information on the applicable terms of use and service operation.
6.8. Continuously monitor operations processed through the QR code, implementing mechanisms for the detection and reporting of suspicious transactions, in accordance with the obligations established in the AML/CFT/FPADM regulations.
6.9. Attend to and respond to information, documentation or clarification requests issued by the Compliance Office of the Central Bank, within the timeframes established in each request.
6.10. Report to the Central Bank any operational incident, interruption, service degradation, vulnerability or security failure that could affect the integrity or availability of systems related to QR payment processing, in the timeframes and formats established, at the latest within 30 minutes following the generation of the event.

Prohibitions of Participants
Participating entities shall not carry out the following actions in relation to the issuance, reading and processing of interoperable QR codes:
7.1. Modify or alter the national QR code standard issued by the Central Bank on their platforms, applications or devices.
7.2. Implement technological solutions that limit the acceptance of QR payments or that prevent interoperability with other participants.
7.3. Omit, delay or falsify notification to the Central Bank regarding operational incidents, interruptions, service degradation, vulnerabilities or security failures that affect the integrity or availability of QR codes.

7.4. Share confidential information of clients, merchants or transactions without due authorization or in contravention of the current regulatory framework.
7.5. Implement measures that compromise the security, operational continuity or personal data protection of users and affiliated merchants.
7.6. Generate false or incomplete information regarding the operation, terms of use or benefits of the QR payment service to clients or affiliated merchants.

Surveillance Functions
8.1. The Central Bank shall exercise the function of surveillance over participants in payment systems.
8.2. For the fulfillment of these functions, participants in payment systems must allow the Central Bank to conduct on-site visits at their facilities, including access to other sources of information deemed necessary.
Non-compliance, Sanctions and Procedure
9.1. Non-compliance
9.1.1. For the purposes of Article 67 and 94 of the Organic Law of the Central Bank of Reserve of El Salvador, Article 11 paragraphs 3 and 4 of the Treaty on Payment Systems and Securities Settlement in Central America and the Dominican Republic, non-compliance with the specific norms established in paragraph 6 of this Instruction for obligated institutions, will result in the imposition of sanctions of fine, suspension or exclusion, depending on their impact on the normal functioning of the Payment System, prior to the due legal procedure.
9.2. Internal procedure in case of non-compliance
In case of non-compliance described in this Instruction, the following procedure shall be followed:
9.2.1. Notification of non-compliance: The head of the OVSP shall notify the identified non-compliances to the Manager of Financial Stability and Public Policies and to the Legal Representative or Attorney-in-fact of the Authorized Entity, at the latest within ten (10) business days following, in order to be resolved as soon as possible or through the establishment of an Mandatory Adjustment Plan.
9.2.2. Establishment of Mandatory Adjustment Plan: Prior to issuing the technical report for the start of the sanctioning procedure, or without prejudice to this; the OVSP may establish mandatory adjustment plans for the obligated Entity, aimed at compliance with provisions of this Instruction, to correct irregularities and/or prevent actions that put at risk the normal functioning and operations of the payment systems in which it participates or of other payment systems, whose surveillance corresponds to the Central Bank.
9.2.3. Technical Report: The OVSP, within a period not exceeding 10 business days after notifying the non-compliance to the Legal Representative or Attorney-in-fact of the obligated Entity, or of the expiration of the period indicated in the Mandatory Adjustment Plan, as applicable, will issue a technical opinion on the causes that justify the start of a sanctioning procedure. The aforementioned period may be extended by another 5 additional business days when the complexity of the case so requires.
9.2.4. Submission of the file: With the OVSP report, the Manager of Financial Stability and Public Policies will send the administrative case file to the Legal Department of the Central Bank.
9.2.5. Delegation of Competence: Competence is expressly delegated through this Instruction to the Legal Department to initiate and process the respective sanctioning procedure, in accordance with what is indicated in Articles 94 and 95 of the Organic Law of the Central Bank of Reserve of El Salvador and applying where appropriate the Administrative Procedures Law.
9.3. Payment of fine
9.3.1. The obligated financial Entity that has been sanctioned with a fine related to this Instruction or to payment systems, must pay the value of the fine through the Gross Real-Time Settlement System (LBTR), within ninety (90) business days following the respective notification from the Central Bank, for which no payment order will be required.

9.3.2. When the obligated Entity does not pay the fine within the specified term, it shall be enforced through the executive route and may be suspended as a Participant in the payment systems Administered by the Central Bank in which it has been authorized to participate, as a result of a sanctioning process, unless there is a legal cause or judicial action.
9.4. Precautionary measures for technical failures
9.4.1. The Central Bank may temporarily suspend an obligated Entity for a period of up to 60 calendar days, when it presents repeated technical failures that could affect the normal functioning of the Payment Systems in which it is authorized to participate.
9.4.2. During the suspension of an obligated Entity, the affected party may participate in the payment systems in which it is authorized only in the manner that the Central Bank determines.
9.5. Provisional measures
9.5.1. Once a sanctioning administrative procedure has been initiated, the Board of Directors may adopt at any time, through a reasoned resolution, the provisional measures deemed necessary to ensure the effectiveness of the resolution, the adequate development of the procedure, the cessation of the effects of the infringement and the requirements of general interests.
9.5.2. Among the measures that may be adopted is the suspension of an obligated Financial Entity from participating in the system or systems of Payments administered by the Central Bank, either totally or for a specific service provided within the payment systems in which it is authorized to participate, when the alleged non-compliance could affect the normal functioning of the payment systems. In case of suspension, the affected party may participate in the payment systems in which it is authorized only in the manner that the Central Bank determines.

9.6. Suspension Communication
9.6.1. The suspension shall be notified in writing by the Presidency of the Central Bank to the obligated Entity, which shall indicate the reasons for the decision and the suspension period. Additionally, it shall be communicated to the rest of Participants in the Payment Systems in which it is authorized to participate. The Central Bank will have the necessary mechanisms to allow the continuity of the operations of the system in question.
9.7. Suspension or Exclusion of participation
9.7.1. In the case of losing the authorization to participate in the payment systems administered by the Central Bank due to exclusion, or being suspended due to the application of a provisional measure, its participation in the System or Systems it participates in shall be withdrawn starting from the same day that the Central Bank receives the notification of such cases, which shall be communicated by the Manager of Financial Stability and Public Policies, with a copy to the Financial Operations Management, leaving the Entity disabled in the System or systems of payments so that it can no longer carry out operations indefinitely or during the period indicated by the resolution, as applicable.

Exceptions
10.1. Exceptions
10.1.1. In the event that a Participant by its nature, segment and business strategy, option, product or functionality in its Digital or Electronic Channels cannot implement the interoperable QR under the national standard, the President of the BCR may authorize the corresponding exception or extension, prior to the valuation of the OVSP. In these cases, the interested participant must submit to the Presidency of the BCR, a duly justified and signed request by the Legal Representative or Attorney-in-fact of the entity.

Special Provisions
11.1. The operational aspects that arise in the execution of this Instruction will be resolved by authorization of the Presidency of the BCR prior to the valuation of the Payment Systems Committee.
11.2. The Terms and Conditions, as well as the Privacy Policies applicable to issuing participants of interoperable QR payments, including operational agreements, technical and commercial guidelines, must align with the regulatory framework issued by the Central Bank of Reserve of El Salvador. The approval of such documents may be granted by the President of the BCR. These elements will regulate the relationships, responsibilities and operational flows derived from the use of the interoperable scheme, in accordance with international standards such as those adopted in the QR model established by the Central Bank.
11.3. Cases not contemplated in this Instruction and that are not related to operational aspects will be resolved by the Board of Directors of the Central Bank.
Validity, Distribution and Dissemination
12.1. This Instruction will enter into force on March 18, 2026.
12.2. The Board of Directors will keep a copy of this Instruction as backup to the Approval Minutes and will send the original to the Risk and Strategic Management Department, for custody; it will deliver an electronic copy to the Financial Stability and Public Policies Department and authorize it to deliver electronic copies to the following units:
12.2.1. Legal Department
12.2.2. Financial Operations Department
12.2.3. Payments and Securities Department
12.2.4. Payment Systems Surveillance Office
12.2.5. Compliance Office
12.2.6. Innovation and Information Technology Department
12.3. The Financial Stability and Public Policies Department, through the Payment Systems Surveillance Office, will disseminate this Instruction to the corresponding Administrative Units of the Central Bank.

12.4. The Risk and Strategic Management Department is authorized to publish this Instruction in the Administrative Instruments System, for general consultation.
12.5. This Instruction will be disseminated under the responsibility of the Financial Stability and Public Policies Department through the Payment Systems Surveillance Office to the corresponding Institutions, by notification and following the already established distribution and sending control mechanisms.
12.6. This Instruction will be published in its entirety on the Central Bank's Website, for the knowledge of the general public.

Transitional Provisions
13.1. The Central Bank will send the brand manual and technical specifications of the standardized QR code to payment system participants, within a maximum period of fifteen (15) calendar days following the approval date of this Instruction.
13.2. Payment system participants that have the technology to read QR codes within their electronic channels will have a period of 60 calendar days to implement in their mobile or web applications the necessary technological solutions to be able to read any QR code in standard format and structure the operation message under the national standard.
Version Control
Version Effective Date Modification
0.0 March 18, 2026 Document Creation