Qatar Payments Regulation: QCB Framework, Open Banking and the Road Ahead

Qatar's payments regulatory landscape has been substantially rebuilt since 2021, when the Qatar Central Bank enacted the Payment Systems Law (Law No. 15 of 2021) and established a comprehensive licensing and oversight framework for payment services in the country. For firms operating in Qatar, advising clients doing so, or considering market entry, the regulatory picture is now substantive: and the QCB's supervisory approach has become progressively more assertive as the framework has matured.

This article sets out the key elements of the QCB's payment regulatory framework, the Himyan QR mandate and its acceptance obligations, the open banking programme timeline, the AML/CFT requirements specific to QCB-regulated payment firms, and the strategic priorities embedded in Qatar National Vision 2030 that will shape the next phase of regulatory development.

The Payment Systems Law No. 15 of 2021

Law No. 15 of 2021 is the primary legislative instrument governing payment systems and payment service providers in Qatar. It replaced earlier, more fragmented regulatory instruments and gave the QCB explicit powers to license, supervise, and sanction payment service providers operating in the country. The key provisions relevant to payment firms are:

• Licensing requirement: Any entity providing payment services in Qatar: including acquiring, payment initiation, account information services, money transfer, and issuance of electronic money: requires a QCB licence or explicit authorisation under the Law. Providing payment services without a licence is an offence under Qatari law.
• Capital requirements: Minimum capital requirements vary by licence category. Payment institutions at the basic tier must maintain minimum paid-up capital of QAR 1 million; institutions offering broader payment services face higher capital thresholds. The QCB reviews capital adequacy as part of the annual supervisory process.
• Data localisation: Payment data relating to Qatari residents processed under a QCB licence must be stored within Qatar. The data localisation obligation applies to transaction data, customer data, and AML/CFT records. Cloud processing arrangements that involve data leaving the country require prior QCB notification and, in some cases, approval.
• Outsourcing: Material outsourcing of payment processing functions: including outsourcing to parent companies or group entities: requires QCB notification and assessment against the Bank's outsourcing risk management guidelines. The QCB retains the right to inspect outsourced service providers.
• Safeguarding: Licensed payment institutions and electronic money institutions must segregate customer funds. The Law prescribes approved methods of safeguarding: designated trust accounts with QCB-approved banks, or equivalent insurance coverage. Reconciliation of safeguarded funds is required on a defined periodic basis.

QCB Licensing Categories

The QCB's licensing framework distinguishes between categories of payment service, with licence conditions calibrated to the risk profile of each service type. The primary categories are:

The Himyan QR Mandate

The QCB mandates support for Himyan QR at point of sale as part of Qatar's national payments digitalisation agenda. Himyan is the QCB-defined QR payment standard for domestic retail transactions, enabling consumers to pay by scanning a merchant-presented QR code linked to their bank account, with settlement over the QPAY domestic instant rail.

The mandate applies to merchants above defined revenue and transaction thresholds; the QCB has progressively extended the scope of mandatory compliance. Key compliance requirements for merchants and acquirers:

• All in-scope merchants must display a valid Himyan QR code at point of sale. Static QR codes are acceptable for fixed-price merchants; dynamic QR codes are required where the transaction amount is variable.
• Acquirers and payment service providers supporting merchants in Qatar must be technically capable of generating and processing Himyan-compliant QR codes. This requires connectivity to the QCB's Himyan registry and compliance with the QCB's QR technical specification.
• MDR structures for Himyan QR transactions are set by the QCB at levels intended to encourage acceptance: they are materially lower than card MDRs for equivalent merchant categories. Acquirers pricing merchant acceptance packages in Qatar must account for the Himyan rate structure in their commercial models.
• Consumer-presented QR (where the consumer presents a QR from their banking app) is also supported under the Himyan standard. Merchants accepting consumer-presented QR must configure their POS to initiate the payment request correctly and reconcile settlement from the QPAY rail.

Open Banking in Qatar

The QCB's open banking framework sets out the technical and governance standards under which licensed third-party providers (TPPs) may access customer payment account data and initiate payments on behalf of account holders. The framework is aligned with international open banking standards: API design, consent management, strong customer authentication , while incorporating Qatar-specific data protection requirements under the QCB's data governance guidelines and the Personal Data Privacy Protection Law (Law No. 13 of 2016).

The current status of Qatar's open banking programme:

• The QCB published its open banking regulatory framework and technical standards for consultation; the final standards have been issued and are in force for participating banks.
• QCB-licensed banks above a defined size threshold are required to implement open APIs conforming to the QCB specification, enabling licensed TPPs to access account information and initiate payments with customer consent.
• TPPs wishing to access open banking APIs in Qatar must hold a QCB payment service licence (Category A or B, depending on whether they offer payment initiation or account information only) and register with the QCB's TPP registry.
• Payment initiation via QCB open banking APIs routes to QPAY for domestic settlement, meaning TPPs connecting to open banking are effectively connecting to the domestic instant rail infrastructure.

The strategic opportunity for payment firms in Qatar's open banking ecosystem is currently constrained by the relatively limited number of licensed TPPs, the nascent consumer awareness of open banking payment options, and the fact that Himyan QR provides a simpler consumer UX for many domestic payment scenarios than a full open banking payment initiation flow. The medium-term opportunity is in account information services: aggregation, cash flow forecasting, and automated treasury , for business customers, where the commercial value of real-time account data access is clearer and adoption barriers lower.

AML/CFT Requirements for QCB-Licensed Payment Firms

The QCB's AML/CFT Instructions, issued under the QCB Law and aligned with FATF Recommendations, impose a comprehensive compliance programme on all licensed payment firms. The key requirements are:

• Customer Due Diligence: Full CDD for all customers at onboarding, with EDD for higher-risk profiles including PEPs, customers from FATF high-risk jurisdictions, and corporates with complex ownership structures. CDD is a continuous obligation: periodic review is required, and event-triggered reassessment must occur when the customer's risk profile changes materially.
• Transaction monitoring: Licensed payment firms must maintain a transaction monitoring programme calibrated to their customer base and business model. Rule-based systems must be supplemented by typology analysis reflecting the specific risk profile of the firm's services. Threshold alerts must be reviewed by trained AML analysts, not processed automatically.
• Suspicious Transaction Reporting: STRs must be filed with the Qatar Financial Information Unit (QFIU) when suspicion is formed: not only when suspicion reaches a defined threshold. Filing obligations are unconditional: tipping off the subject of an STR is a criminal offence.
• FATF Travel Rule: Cross-border wire transfers above QAR 3,600 (approximately $1,000) must include full originator and beneficiary information transmitted with the payment message. Payment firms offering cross-border payment services must implement Travel Rule-compliant message structures.
• Record retention: Transaction records and CDD documentation must be retained for a minimum of five years from the date of the last transaction or the end of the customer relationship, whichever is later.

Qatar National Vision 2030 and Payments Digitalisation

Qatar National Vision 2030 (QNV 2030) identifies financial services modernisation and digital economy development as strategic national priorities. The QCB's payments regulatory agenda is explicitly framed as a contribution to QNV 2030's economic diversification objectives: reducing reliance on cash, increasing electronic payment penetration, and developing Qatar as a regional hub for financial services innovation.

The practical implications for payment firms:

• Cash displacement targets: The QCB has set targets for reducing the share of cash in retail payment transactions and increasing electronic payment penetration at point of sale. These targets create regulatory pressure on acquirers and merchants to deploy compliant electronic acceptance infrastructure, including Himyan QR and card terminals, at scale.
• Government payment digitalisation: Qatari government entities are progressively migrating from cash and cheque-based G2P payments to electronic disbursement. Government salary payments, social transfers, and procurement payments are being routed through QCB-approved electronic channels. Payment firms with government sector exposure need to ensure their infrastructure meets QCB technical standards for government-designated payment flows.
• Fintech development: The QCB operates a regulatory sandbox for fintech businesses that want to test innovative payment services under a controlled regulatory environment before applying for a full licence. The sandbox is relevant for firms with novel business models: embedded payment platforms, BNPL providers, open banking aggregators: where the applicable licence category under the 2021 framework is not immediately clear.