Contactless payments, finance, central bank, CBN, payments, technology.
Managing Partner at Nubia Capital.
The Contactless Payments ("CPs")industry experienced a lot of growth over the last few years and with a global valuation of $US39.23 billion in 2022, it is projected to reach $US166.46 billion by 2030, growing at a compound annual growth rate (CAGR) of 19.8% during the forecast period of 2023-2030[1].
Simply put, CP are a convenient and secure method of making transactions using a debit or credit card, smartphone, or wearable device without the need for physical contact with a payment terminal.
It uses near field communication (NFC) technology to enable quick and seamless payments by simply tapping or waving the payment device near the terminal. NFC is a short-range wireless technology that enables communication between devices when they are in proximity (typically within a few centimeters). The wireless technology, known as radio frequency identification (called RFID), is commonly utilized for scanning products in retail stores and tracking luggage at airports. In recent times, it has gained prominence in facilitating contactless mobile payments, as well as finding applications in video game technology.
First introduced in the 1990s[2], CPs experienced a notable surge in usage, particularly accelerated by the Covid-19 pandemic in 2020[3]. Presently, CPs have become the favored payment method in numerous countries, although its use has come with inherent risks and security concerns. These include the potential for CPs fraud, the possibility of CPs networks being hacked, customer data privacy concerns, and the implications of unauthorized transactions.
It is also pertinent to state that because CPs are authenticated payments, they are quite difficult to hack. In a CP arrangement, the data associated with the card scheme on file is encrypted and constantly changing. So even if fraudsters were to hack a system, the data they found there would be useless.
For instance, in the UK, CPs fraud resulted in a loss of £16 million in 2020. However, it is important to note that this amount accounted for only 2.9% of overall card fraud losses, despite CPs transactions making up 55% of all card transactions[4]. This indicates that when proper standards and best practices are followed, CPs can not only provide a smoother experience for users but also offer significant safety advantages.
MARKET OPPORTUNITIES
It is projected that the growth of the market will be driven by the increasing adoption of digital payment solutions. As the payment industry moves towards Europay, Mastercard and Visa (EMV) chip cards, it aims to enhance security and provide more control for offline transactions. CP cards offer improved security compared to cash, leading many consumers to embrace contactless options such as Google Pay and Samsung Pay.
To safeguard consumers against fraud and identity theft, payment industries are embracing contactless payment technologies. The market's growth is expected to be fueled by features like EMV chip cards, loyalty programs tied to payment methods, cardholder verification methods, and spending reports[5].
Companies like Apple are taking full advantage of this and recently announced the official launch of Apple Pay in South Korea, introducing its widely used digital wallet and mobile payment system to iPhone and Apple Watch users in the country[6]. By adding their credit and debit cards to Apple Pay, users can now conveniently and securely make CPs at numerous physical stores and online retailers throughout South Korea.
DEVELOPMENTS IN NIGERIA
With the growth of CPs globally, Nigeria has seen developments in the sector. In September 2022, Interswitch, in partnership with ProvidusBank, Mastercard and Thales Group, announced the introduction of a new Tap-to-Pay service in Nigeria. This CP service allows cardholders to make fast, secure, and convenient in-store payments by tapping their NFC-enabled smart device at any contactless-enabled payment terminal[7]. In addition, Now-Now, another Nigerian Company that offers Tap-and-Pay services, recently raised USD 13 Million seed and is expected to increase the adoption of CPs in Nigeria[8]. Similarly, Squad[9] and Kuda[10] have introduced softPOS solutions, which are expected to drive the adoption of CPs further. In summary, the private sector has been gearing up to participate in the CPs space.
Consequently, on 27th June 2023, the Central Bank of Nigeria ("CBN"), introduced the Guidelines for contactless payments in Nigeria[11] (Guidelines). The CBN also issued a circular dated 27th June 2023 (the Circular), where it set out the daily cumulative transaction limit using CPs at ₦50,000 ($65.08), with a single transaction limit of ₦15,000 ($19.56). Transactions surpassing these limits are classified as higher-value transactions and will require verification and authorisation. Furthermore, existing know-your-customer (KYC) requirements and limits on electronic payment channels will be applicable for such transactions.
In this article, we review the Guidelines and consider how it impacts the financial services market in Nigeria.
1. STAKEHOLDERS IN CP TRANSACTIONS
The Guidelines identified 11 Stakeholders in CPs transactions[12]. The Stakeholders and a brief description of their respective roles are set out below:
a) Acquirer
The Acquirer is the Merchant's financial institution. The Acquirer accepts deposits from the merchant's sales. Note that only CBN licensed institutions can serve as acquirers for contactless payments.
b) Issuer
The Issuer is the customer's financial institution. Issuer's issue cards to their customers on behalf of card schemes. Only CBN licensed institutions can serve as issuers for contactless payments.
c) Payment schemes
A payment scheme is a set of rules defining how payment transactions are processed with the use of payment instruments.
d) Card schemes
A card scheme is a central payment network that uses credit and debit cards to process payments. Card schemes include entities like Mastercard, Verve etc.
e) Switching companies
Switching companies facilitate the exchange of value between financial service providers, merchants, customers and other stakeholders. They essentially facilitate communication between different payment service providers.
f) Payment terminal service provider (PTSP)
A PTSP is a payment service provider that enables merchants accept credit and debit card payments. It allows a merchant to capture required credit and debit card information and to transmit this data to the merchant services provider or bank. An example is a point of sale (PoS) machine.
g) Payment Terminal Service Aggregator (PTSA)
A PTSA integrates different payment modes and offers its platform for a merchant to use. In Nigeria, the Nigeria Inter-Bank Settlement System Plc (NIBSS) acts as the Payments Terminal Service Aggregator for the financial system and is the only entity permitted to operate a Terminal Management System (TMS). Thus, all payment terminals operating in Nigeria are required to be connect to NIBSS and have its terminal certified.
h) Merchants
Merchants are businesses that accept credit card payments from their clients such as e-commerce platforms, retailers, wholesalers, etc.
i) Terminal owners
Issuers, acquirers, merchants and Payment Terminal Service Providers ("PTSPs") can be terminal/device owners.
j) Customers – Persons who use the CPs.
The Guidelines also provide that CBN can extend the stakeholder/participant that can participate in CPs and designate them accordingly.
2. HIGHLIGHT OF THE GUIDELINES
The Guidelines set out the framework for CPs transactions in Nigeria. In addition to prescribing minimum standards to be met by participants, it specify the individual role and responsibility of each participant as well as conditions for participation. Some of the significant provisions of the guidelines are examined below.
Restrictions on contactless payments
The Guidelines impose transaction limits for CPs transactions, and stakeholders may set a limit on par with or below the limit set by the CBN. CPs transactions below the transaction limits may not require customers' verification[13] but CPs above the transaction limit (described as "Higher-value CPs payments") shall require customer verification[14] The obligation to ensure adherence to transaction limits is imposed on the Acquirer[15] and the Issuer[16].
As indicated earlier, the CBN in the Circular has specified the daily cumulative transaction limit using CPs at ₦50,000 ($65.08), with a single transaction limit of ₦15,000 ($19.56). Transactions surpassing these limits shall require customer verification such as PIN, mobile code, biometric identifier, etc.
Furthermore, customers who intend to perform transactions above the maximum limit are expected to write to their bank and provide an indemnity that reflects the risk involved. The bank shall only approve this after it has ran its own internal risk management verification process.
Preconditions for participation
The Guidelines impose various preconditions to participation. For instance, only CBN-licensed institutions can serve as Acquirers[17] and Issuers[18]. Participants are required to comply with the standards subsequently discussed in this article as well as obtain and maintain the required certifications.
In any case, the contactless payments image, symbol, tactile, graphics and/or the words "contactless payments" (in Braille) shall be displayed on CP instruments, CP devices and locations where CPs are accepted[19]. In addition, CPs cannot be activated by default, customers shall have the option to opt-in to CPs and they also have the right to withdraw from the CP Agreement without prior notice to the issuer.
Standards for participation
All Stakeholders who process and/or store customers' information[20] are mandated to ensure that their terminals, applications, and processing systems comply with the following standards, at the minimum:
PA DSS - Payment Application Data Security Standard;
PCI PED - Payment Card Industry Pin Entry Device;
PCI DSS - Payment Card Industry Data Security Standard;
Triple DES - Data Encryption Standards shall be the benchmark for all data transmitted and authenticated between each party. The triple DES algorithm is the minimum standard;
AES - Advanced Encryption Standards;
EMV - The deployed infrastructure must comply with the EMV requirements for contactless acceptance;
ISO 27001 - information security management system;
ISO 4443 – identification cards, contactless integrated circuit cards and proximity cards specifications;
All required scheme certifications for contactless cards and terminals; and
Other standards as may be specified by CBN from time to time[21].
Said participants are required to maintain valid certification to these standards, ensure they always remain compliant with the standards and execute CP agreements/contracts with parties. Note that participants are required to obtain CBN's approval for CPs products and for innovative use cases and value-added services[22].
CPs transaction processing
Participants are required to enter CPs agreements which clearly spell out the terms and conditions of the transaction[23] and comply with minimum requirements set by the CBN.39 Prior to consummating a CPs transaction, the transaction value and associated charges must be communicated to the customer[24].
CPs devices are required to be issuer/brand agnostic and neutral to the type of card or payment instrument used. Similarly, all CPS instruments used in Nigeria shall be neutral and agnostic as to CPS devices. In essence, such devices should not promote or favor any brand over another. This is part of the effort aimed at achieving interoperability.
All domestic contactless payments shall be switched through a Nigerian switch, all contact, devices must be connected to an account or wallet that has Bank Verification Number ("BVN") , and only accounts/wallets with BVN can be activated for CPs in Nigeria[25]. Note that all CPs transactions are required to be processed online or/and submitted via current processing specifications. The obligation to ensure this is on Payment Schemes and Card Schemes.
Dispute resolution
With respect to dispute resolution, PTSPs are required to onboard adequate support infrastructures that ensure 24/7 support coverages[26] and prevent instrument clashes when multiple contactless payments are present[27], while all participants are required to work in conjunction to ensure the resolution of disputed transactions within the timeline specified by the CBN dispute resolution framework.
Prevention of financial crimes and fraud
With respect to financial crimes, Acquirers and Issuers are required to undertake measures to prevent the use of their network for purposes associated with money laundering and other financial crimes[28], conduct KYC on all customers[29] and carry out periodic risk assessments of their processes and have effective measures to mitigate ML/TF/PF risks associated with CPs. Similarly, all other participants except Customers and Merchants are required to implement a documented risk management process to identify and treat risks associated with contactless payments, while Customers and Merchants are required to exercise due diligence in carrying out CPs transactions.
In any case, Acquirers, Issuers, and Merchants will be held liable for fraudulent transactions on CPs arising from their negligence and/or connivance. Stakeholders are also required to render monthly returns on CPs transactions (including value, fraud, data, and failed transactions) to the CBN in a format to be prescribed by CBN.
OPPORTUNITIES PRESENTED BY CPS TO NIGERIA’S FINANCIAL SERVICES SECTOR
CPs have the potential to bring significant benefits to the Nigerian financial services sector, offering numerous advantages for both consumers and businesses.
Some ways CPs can benefit the sector include the following:
a) Financial Inclusion: CPs can play a vital role in increasing financial inclusion in Nigeria by providing easier access to banking services for individuals who may not have traditional bank accounts. With the growing use of mobile phones, contactless payments can provide access to banking services to those who are unbanked or underbanked. It will enable them make digital payments using mobile devices, reducing the reliance on cash and enabling participation in the formal economy.
b) Cashless policy: Embracing CPs aligns with the Nigerian government's initiatives to promote a cashless economy and reduce reliance on physical currency. With CPs, there will be no need for cash as with CP enabled devices, consumers can pay for goods and services seamlessly.
c) Convenience: CPs offer a faster and more convenient way to transact. Customers can make payments by simply tapping their cards or mobile devices, eliminating the need to handle cash, swipe cares or enter PINs, which can speed up transactions and reduce checkout times.
d) E-commerce Growth: Contactless payment can drive the growth of e-commerce in Nigeria. By providing a secure and convenient payment method, it encourages more consumers to shop online, boosting the digital economy.
e) Enhanced Security: CPs use advanced encryption and tokenization technology, making them more secure than traditional magnetic stripe cards. This can reduce fraud and enhance consumer trust in digital payment methods.
f) Cost Savings: CPs can lead to cost savings for businesses by reducing the need for cash handling and associated security measures. It can also streamline payment processes and lower transaction fees.
g) Big data analytics: CPs generate valuable data on consumer spending habits and preferences. Financial institutions can leverage this data to gain insights into customer behavior, enabling them to offer personalized and targeted services.
h) Innovation and Competition: The introduction of CPs can spur innovation in the financial services sector as it can encourage competition between fintechs and banks as the strive to offer innovative solutions, leading to improved services for consumers.
3. CONCLUSION
The introduction of the Guidelines is a welcome development and leads sees Nigeria joining countries such as the US, UK, Canada, Germany Australia, South Africa and several other countries that are setting out clear regime for the use of CPs.
It is also commendable that the CBN commences this process by setting transactional limits, as well as other safeguards, at the onset of the rollout of the Guidelines.
By embracing contactless payment technologies and promoting their adoption, the Nigerian financial services sector can benefit from increased efficiency, security, financial inclusion, and economic growth.
[1] Yahoo News, Contactless Payment Market to Hit USD 166.46 Billion by 2030 owing to More Convenient and Faster Payment Experience for Consumers | Research by SNS Insider. Accessed from https://ca.finance.yahoo.com/news/contactless-payment-market-hit-usd-145000245.html.
[2] BanksAm, "History of contactless payments: from past century to the present day" available at https://banks.am/en/news/fintech/22668#:~:text=The%20first%20ever%20widespread%20use,making%20contactless%20payments%20for%20trips.
[3] FinExtra, "WHO urges switch to contactless to slow virus transmission" available at https://www.finextra.com/newsarticle/35384/who-urges-switch-to-contactless-to-slow-virus-transmission#:~:text=The%20World%20Health%20Organisation%20is%20advising%20consumers%20to,which%20are%20known%20carriers%20of%20viruses%20and%20bacteria
[4] UK Finance, "Fraud- The Facts 2021" available at https://www.ukfinance.org.uk/system/files/Fraud%20The%20Facts%202021-%20FINAL.pdf. It must however be stressed that CPS fraud accounts for only 2.9% of overall card fraud losses, while 55% of all card transactions were CPS transactions.
[5] Globe Newswire, “Contactless Payments Market Predicted to Garner USD 90.6 Bn By 2032, At CAGR 15.4% | Market.us”. Accessed from https://www.globenewswire.com/en/news-release/2023/04/11/2644934/0/en/Contactless-Payments-Market-Predicted-to-Garner-USD-90-6-Bn-By-2032-At-CAGR-15-4-Market-us.html#:~:text=New%20York%2C%20April%2011%2C%202023,forecast%20period%202023%20to%202032.
[6] TechCrunch, “Apple Pay is now available in South Korea”. Accessed from https://techcrunch.com/2023/03/20/apple-pay-is-now-available-in-south-korea/.
[7] Fintechnews, "Providus bank launches tap-to-pay service with Mastercard, Interswitch and Thales" available at https://fintechnews.africa/41118/fintech-nigeria/providusbank-launches-tap-to-pay-service-with-mastercard-interswitch-and thales/#:~:text=Nigerian%20financial%20services%20company%20ProvidusBank,payment%20service%20in%20the%20country
[8]Financial Nigeria, "NowNow raises 13 Million in seed funding" available at https://www.financialnigeria.com/nigerian-fintech-startup-nownow-raises-13-million-in-seed-funding-news-2537.html
[9] Available at https://squadco.com/squad-pos/
[10] Available at https://business.kuda.com/
[12] Rule 4.0 of the Guidelines
[13] Rule 9.2 of the Guidelines
[14] Rule 9.3 of the Guidelines
[15] Rule 6.1.12 Guidelines
[16] Rule 6.2.11 Guidelines
[17] Rule 6.1.1 of the Guidelines
[18] Rule 6.2.1 of the Guidelines
[19] Rule 8 of the Guidelines
[20] This covers all stakeholders except the Customers themselves.
[21] Rule 8 of the Guidelines
[22] Rule 7 of the Guidelines
[23] Rule 6.1.4 and Rule 6.2.5 Guidelines
[24] Rule 6.8.4 Guidelines
[25] Rules 6.1 and 6.2 of the Guidelines
[26] Rule 6.6.2 Guidelines. Terminals deployed are to be always functional and PTSPs are mandated to establish appropriate mechanism to detect device failure. Device failure must be rectified or replaced within 48 hours.
[27] Rule 6.6.5 Guidelines. This is very important because such terminals will likely work in proximity such as at the check-out point of supermarket/malls.
[28] Rule 6.1.9 Guidelines and Rule 6.2.9 Guidelines
[29] Rule 6.1.10 Guidelines and Rule 6.2.10 Guidelines
Originally published by Davidson Oturu on Linkedin
Oyemaja Law
Oyemaja Executives