Peru’s central bank has set a single technical standard for payment QR codes. Circular N° 0028-2026-BCRP, signed in Lima on November 5, 2026 and published in the official gazette El Peruano on November 6, creates the Estándar QR Perú. It replaces Circular 0003-2020-BCRP and took effect the day after publication. Wallet apps, banks and anyone else that creates or reads payment QR codes in Peru now has to follow it and sign up to a new public register.
What the QR Peru Standard is
The Estándar QR Perú is based on EMVCo’s QR code specification for payment systems, version 1.1 from November 2020, in what EMVCo calls Merchant-Presented Mode. In that mode the person or shop being paid shows the code and the payer scans it. The Banco Central de Reserva del Perú (BCRP) adds its own technical note on top of the EMVCo specification, and the circular lists that note as reserved.
The standard covers static codes, which stay the same for every payment, and dynamic codes, which are created for a single payment. It applies to payments to people as well as to businesses.
Three roles and one register
The circular splits the QR business into three roles. A Generador creates QR codes, a Proveedor supplies them to people and merchants, and a Lector reads them, which in practice usually means a wallet or banking app.
Every entity in any of those roles has to appear in the Registro QR Perú, which the BCRP keeps. Entities already operating have until December 31, 2026 to register. New entrants must register 30 days before they start. Entities also have to tell the BCRP 30 days before they make relevant changes to their QR services.
What changes for people paying
Most of the rules sit with the apps that read codes. Before a payer confirms, the Lector has to show who will receive the money, the amount and the currency. It has to check that the data in the code has not been altered, and it has to give users a way to file complaints.
Providers have to take steps to stop QR codes being swapped or spoofed, a common trick where a fraudster puts their own code over a shop’s. The Token QR, the data string inside the code, may not contain personal data.
The circular also says no entity may impose restrictions on interoperability. Read with the single standard, that should mean any compliant app can read any compliant code, rather than each wallet working only with its own.
Old codes, deadlines and fines
Codes that follow the old rules and codes that follow the new standard can coexist until March 31, 2028. After that, only standard codes are allowed.
The BCRP set fines in UIT, Peru’s tax reference unit. Some infractions carry a fine of 20 UIT. Once the coexistence period ends, an entity still out of line pays 5 UIT per week, up to a cap of 120 UIT. Failing to keep the register up to date costs 5 UIT.
On November 3 we covered Hong Kong’s FPS link with UnionPay QR payments, a different answer to the same question of how separate QR systems connect. For how wallet apps work, see our explainer on digital wallets.
