Strengthening Global Trade: The Role of International Private Law in Securing Cross-Border QRIS Transactions

The globalization of retail commerce has historically been constrained by the inefficiencies of traditional cross-border payment systems, which relied heavily on a fragmented network of correspondent banking relationships, opaque fee structures, and significant settlement latency. As digital transformation accelerates, the emergence of instant payment systems (IPS) and standardized digital interfaces has paved the way for a more integrated global trade environment. Central to this evolution in the Southeast Asian context is the Quick Response Code Indonesian Standard (QRIS), a unified payment architecture developed by Bank Indonesia (BI) and the Indonesian Payment Association to streamline domestic and international transactions. However, the technical interoperability of QRIS is only one facet of a secure cross-border ecosystem. The true anchor of stability in these digital corridors is the application of international private law (IPL). By providing a predictable framework for choice of law, jurisdiction, and the recognition of electronic instruments, IPL principles secure the legal certainty necessary for consumers, merchants, and financial institutions to participate in a borderless digital economy. This report examines the intersection of QRIS expansion and international legal frameworks, analyzing how global standards from UNCITRAL, HCCH, and UNIDROIT facilitate the transition from bilateral to multilateral payment connectivity while managing the complex risks of data privacy, consumer protection, and sharia-compliant finance.

The Strategic Imperative of QRIS and the 17-8-45 Roadmap

The inception of QRIS in 2019 marked a pivotal shift in Indonesia’s digital financial strategy, aimed at consolidating the diverse and often incompatible QR payment platforms into a single national standard. This consolidation was not merely a matter of technical convenience; it was a foundational step toward broader financial inclusion and the digitalization of the real economy, particularly for micro, small, and medium enterprises (MSMEs). The “17-8-45” strategy—referencing Indonesia’s Independence Day—articulates an ambitious roadmap for 2026: 17 billion transactions, cross-border usage across eight countries, and a merchant network of 45 million. This expansion is designed to reduce the historical dependency on the US dollar through Local Currency Transactions (LCT), thereby mitigating exchange rate volatility and lowering the “total cost of payment” for regional trade and tourism.

Key Performance Indicators	Target (2026)	Status as of late 2025	Significance
Annual Transaction Volume	17 Billion	10.31 Billion (Sept 2025)	Demonstrates scale and system resilience
Cross-Border Partner Countries	8 Countries	4 Operational; 4 in Trial	Regional integration and LCT promotion
Merchant Adoption	45 Million	41.3 Million (92.5% MSMEs)	Financial inclusion and small business reach
User Base	60 Million	58.02 Million	Consumer trust and digital literacy

The achievement of these targets is closely tied to the internationalization of QRIS, which now encompasses a broad range of partner markets across Asia and the Middle East. Between January and April 2025, inbound cross-border QRIS payments grew by over 225% year-on-year, driven primarily by tourists from Malaysia, Singapore, and Thailand. This growth underscores the necessity of a robust legal architecture to govern these transactions, as each new jurisdiction brings a unique set of private law rules and regulatory requirements.

Foundations of International Private Law in Digital Trade

The legal security of cross-border QRIS transactions rests on the ability of the parties to understand and rely upon the law governing their digital interaction. In a domestic context, the rules are set by the central bank and national legislation; however, once a transaction crosses a border, it enters the realm of the conflict of laws. International organizations like UNCITRAL (United Nations Commission on International Trade Law) and the HCCH (Hague Conference on Private International Law) have developed model laws and principles to bridge these jurisdictional gaps.

Legal Recognition and Functional Equivalence

The UNCITRAL Model Law on Electronic Transferable Records (MLETR) of 2017 provides the critical concept of “functional equivalence,” which ensures that an electronic record is legally valid if it performs the same function as a paper-based instrument. For QRIS, this means that the digital authorization provided by a consumer scanning a code is legally recognized as a “signature” or “possession” of the payment instruction. While MLETR is often associated with trade finance instruments like bills of lading, its principles of “control” and “singularity” are vital for ensuring that a digital payment instruction cannot be duplicated or fraudulently altered as it passes through international clearing switches.

Choice of Law and Jurisdiction

A primary concern in IPL is determining which country’s law applies to a dispute arising from a cross-border transaction—the law of the sender (lex domicilii), the law of the merchant (lex loci contractus), or the law of the place of payment (lex loci solutionis). The HCCH Principles on Choice of Law in International Commercial Contracts emphasize “party autonomy,” allowing parties to agree on the governing law. However, in retail QRIS transactions, there is rarely a formal contract between the foreign consumer and the local merchant. Instead, the choice of law is typically embedded in the Terms and Conditions (T&C) of the payment application or the multilateral rulebooks governing the payment link.

IPL Principle	Application to QRIS	Impact on Legal Certainty
Functional Equivalence	Recognition of QR scans as valid signatures	Prevents legal challenges based on the lack of a paper trail
Party Autonomy	Contractual choice of law in app T&Cs	Provides predictability for PSPs and consumers
Lex Loci Solutionis	Applying law of the place where merchant is located	Simplifies enforcement for local businesses
Lex Fori	Determining procedural rules for dispute resolution	Clarifies which court has authority in a dispute

The UNCITRAL Model Law on International Credit Transfers (1992) also offers guidance by defining the responsibilities of each bank in a transfer chain, which helps allocate liability in the event of a technical failure or fraud during a cross-border QRIS transaction. Without these standards, the “push” nature of QRIS payments—where funds are irrevocably sent by the payer—could lead to significant legal exposure for consumers who lack the “chargeback” protections common in the international credit card networks.

ASEAN Regional Payment Connectivity (RPC) and Governance Models

The Association of Southeast Asian Nations (ASEAN) has pioneered a multilateral approach to payment integration through the Regional Payment Connectivity (RPC) initiative. First established in 2022 by Indonesia, Malaysia, the Philippines, Singapore, and Thailand, the RPC now includes nine central banks across the region. The legal foundation of the RPC is a Memorandum of Understanding (MOU) framework, which serves as a “soft law” instrument to signal commitment to cooperation and regulatory harmonization.

The Role of MOUs as Regulatory Anchors

These MOUs are essential because they provide a bridge between diverse national legal systems. For instance, while Indonesia’s PBI No. 23/6/PBI/2021 governs Payment Service Providers domestically, the RPC MOU ensures that these entities can interface with Singaporean providers governed by the Payment Services Act 2019. This alignment covers critical areas such as Anti-Money Laundering (AML), Counter-Terrorism Financing (CTF), and cybersecurity standards, which are integrated through the adoption of global messaging standards like ISO 20022.

Project Nexus and Multilateral Rulebooks

To move beyond the limitations of bilateral links, the Bank for International Settlements (BIS) has introduced Project Nexus, a hub-and-spoke architecture that standardizes how national payment systems connect to one another. Project Nexus replaces individual agreements with a single connection to a central gateway, managed by a multilateral entity called Nexus Global Payments (NGP).

The NGP manages a comprehensive “Scheme Rulebook,” which functions as a “lex specialis” for cross-border instant payments. This rulebook addresses:

Settlement Finality: Defining the precise moment a transaction becomes irrevocable to prevent “Herstatt risk” (settlement risk across time zones).
Foreign Exchange (FX) Transparency: Mandating competitive and transparent currency conversion rates, which reduces the “opaque” costs associated with traditional banking intermediaries.
Operational Resilience: Setting minimum technical uptime and security requirements for all participating switches.

By moving from MOUs to a centralized Scheme Rulebook, Project Nexus provides a higher degree of “hard” legal certainty, allowing QRIS to scale safely across diverse legal landscapes in Asia and Europe.

Risk Allocation and Consumer Protection in the “Push” Payment Era

The transition from “pull” payments (credit cards) to “push” payments (QRIS) represents a significant shift in the balance of legal rights and responsibilities. In a pull payment, the merchant initiates the collection of funds based on the consumer’s authorization, allowing for a structured “chargeback” process if the goods are not delivered or the transaction is fraudulent. In contrast, a QRIS push payment is initiated by the consumer and settled almost instantaneously, often leaving little room for error correction.

The Chargeback Gap

One of the primary legal challenges in cross-border QRIS is the absence of a unified, international dispute resolution mechanism comparable to those of Visa or Mastercard. While domestic regulations like Indonesia’s Regulation of the Members of the Board of Governors No. 21/18/PADG/2019 mandate consumer protection for QRIS, these rules are difficult to enforce when the merchant is located in a different jurisdiction.

Payment Method	Mechanism	Liability Allocation	Dispute Recourse
Credit Card (Pull)	Card Scheme Rules	Issuing bank can reverse funds from acquirer	Chargeback within 60-120 days
QRIS (Push)	Direct Transfer	Payer bears risk once PIN is entered	Limited to PSP grievance or local courts
Project Nexus	Hub-and-Spoke Rulebook	Standardized liability based on scheme rules	Standardized multilateral dispute procedures

To address this, legal experts recommend the adoption of “Principle-Based Convergence” across ASEAN and partner countries. This would involve harmonizing the legal definition of “authorized transactions” and establishing a multilateral clearinghouse for retail disputes. Furthermore, the World Bank’s “Good Practices (2017)” for financial consumer protection emphasize that Fast Payment Systems must have transparent disclosure requirements, ensuring users understand their rights and the fees involved before they scan a code.

Personal Data Protection and Cross-Border Data Sovereignty

As QRIS transactions involve the transmission of sensitive personal and financial information—including name, transaction history, and real-time location—the interplay between international private law and data privacy legislation becomes critical. Indonesia’s Law No. 27 of 2022 on Personal Data Protection (PDP Law), which entered full enforcement in late 2024, establishes a comprehensive framework for how this data must be handled both domestically and abroad.

Compliance under the Indonesia PDP Law

The PDP Law has a broad extraterritorial reach, applying to any entity that processes the data of Indonesian citizens if that processing has a “legal effect” within Indonesia. For cross-border QRIS transactions, this imposes three potential legal requirements:

Adequacy Assessment: The data controller must ensure the receiving country has a level of protection at least equal to Indonesia’s PDP Law.
Standard Contractual Clauses (SCCs): In the absence of an adequacy ruling, binding contracts must be in place between the Indonesian PSP and the foreign merchant or gateway.
Explicit Consent: The current “safest compliance option” is obtaining the explicit, informed consent of the user at the time of the transaction.

The legal friction arises when transaction data is stored in the “cloud” across multiple jurisdictions, making it difficult to determine which specific data protection laws apply. Bank Indonesia’s Payment System Blueprint 2030 (BSPI 2030) addresses this through the “BI-Payment Clear” and “BI-Payment Info” initiatives, which aim to centralize granular transaction data while maintaining strict national data sovereignty standards. This infrastructure allows BI to monitor systemic risks without compromising the privacy rights of individual data subjects.

Navigating Sharia Law in Middle Eastern Payment Corridors

The expansion of QRIS to Saudi Arabia and the UAE introduces another layer of private law complexity: Sharia compliance. For the millions of Indonesian pilgrims traveling for Hajj and Umrah, digital payments must not only be technically seamless but also adhere to Islamic legal principles.

Regulatory Tensions in Sharia Finance

One of the primary legal tensions in these corridors concerns the Merchant Discount Rate (MDR)—the fee charged to merchants for processing a transaction. Under Indonesian Sharia law (Fatwa No. 116/DSN-MUI/IX/2017), merchants may disclose and charge fees to consumers provided there is voluntary consent. However, Bank Indonesia’s secular regulations (PBI) explicitly prohibit transferring MDR fees to consumers. When QRIS is used in Saudi Arabia, the transaction must navigate these conflicting domestic fatwas and the regulations of the Saudi Central Bank (SAMA).

Sharia Aspect	Requirement for Digital Payments	Challenge in Cross-Border QRIS
Prohibition of Riba	No interest-based transaction fees	Ensuring transparent, flat-fee models
Avoidance of Gharar	Absolute transparency in exchange rates	Real-time FX disclosure during the scan
Hifẓ al-māl	Protection of the user’s property/assets	Robust security and fraud prevention
Sharia Governance	Supervision by Sharia Supervisory Boards (SSB)	Harmonizing fatwas across Indonesia and KSA

The achievement of “Sharia-compliant interoperability” requires institutional synergy between the Indonesian National Sharia Board (DSN-MUI) and regional counterparts. By embedding Sharia principles into the “smart” features of digital wallets—such as automated zakat (charity) deductions or halal-certified merchant filtering—QRIS can become a powerful tool for cultural and economic diplomacy in the Muslim world.

Economic Impact and the Transformation of Global Trade

The role of IPL in securing QRIS transactions has direct macroeconomic consequences. By fostering trust in digital payments, international legal frameworks enable the growth of the real economy. As of Q1 2025, QRIS was processing transactions equivalent to nearly 5% of Indonesia’s GDP, facilitating 2.6 billion transactions worth approximately $15.5 billion in just three months.

MSME Empowerment and Tourism Resilience

For MSMEs, the legal certainty provided by standardized QR codes is transformative. In Bali, studies indicate that 91% of small businesses experienced significant improvements in transaction speed and customer satisfaction following QRIS adoption. Furthermore, 60% of these businesses used their digital QRIS records to access formal bank credit, which was previously unavailable due to a lack of traditional bank statements.

However, the legal barriers to MSME participation in cross-border trade remain high. Disparities in tax laws (such as Indonesia’s 11% VAT) and the lack of low-cost international dispute resolution mechanisms can still deter small merchants from accepting foreign payments. Bank Indonesia’s BSPI 2030 aims to mitigate these risks by developing a “consolidated” national payment system that provides small players with the same level of legal and technical security as traditional banks.

Future Outlook: CBDCs and the Evolution of the “Lex Digitalis”

Looking toward 2030, the integration of Central Bank Digital Currencies (CBDCs) into the QRIS framework represents the next frontier of global trade. CBDCs, as “digital fiat,” offer the potential for immediate settlement in central bank money, effectively eliminating the “settlement risk” inherent in current private bank-intermediated systems.

The “Lex Digitalis” of the future will likely be characterized by:

Programmable Law: Using smart contracts to automate compliance with tax, AML, and consumer protection rules at the point of sale.
Multilateral Governance: A shift away from bilateral treaties toward global hub-and-spoke organizations like Nexus Global Payments.
Digital Identity Integration: Linking cross-border payments to national digital ID frameworks (e.g., Indonesia’s Digital ID) to streamline KYC and enhance security.

Conclusion: Securing the Digital Silk Road

The strengthening of global trade through cross-border QRIS transactions is as much a legal project as a technical one. International private law provides the essential “connective tissue” that allows diverse national payment systems to function as a unified, secure whole. From the UNCITRAL principles of functional equivalence to the HCCH focus on choice of law, these frameworks ensure that the “digital scan” is backed by the rule of law.

As Indonesia pursues its “17-8-45” strategy and implements the BSPI 2030, the priority must be the continuous harmonization of regulatory standards and the development of robust multilateral dispute resolution mechanisms. By bridging the gap between national sovereignty and global digital integration, QRIS and the accompanying legal architecture serve as a model for how emerging economies can secure their place in the 21st-century global marketplace. The path forward requires a persistent commitment to legal innovation, ensuring that as the technology of trade evolves, the law remains a steadfast guardian of security, efficiency, and fairness for all participants in the digital economy.

Sources used for the article: