ISO/TS 12812-4:2017

Core banking - Mobile financial services - Part 4: Mobile payments-to-persons

ISO/TS 12812-4:2017 provides comprehensive requirements and recommendations, as well as specific use cases for implementation of interoperable mobile payments-to-persons. The emphasis is placed on the principles governing the operational functioning of mobile payments-to-persons systems and processes, as well as the presentation of the underlying technical, organizational, business, legal and policy issues, leveraging legacy infrastructures of existing payment instruments (see ISO 12812‑1:2017, Annex C). ISO/TS 12812-4:2017 includes the following items: a) requirements applicable to mobile payments-to-persons; b) recommendations regarding mechanisms involved in the operation of interoperable mobile payments-to-persons; c) a description of the different use cases for mobile payments-to-persons; d) a generic interoperability model for the provision of different mobile payments-to-persons; e) recommendations for the technical implementation of the generic architectures for the mobile payments-to-persons program; f) recommendations for mobile remittances; g) use cases with the corresponding transaction flows; h) discussion of the financial inclusion of unbanked and underbanked persons (Annex A); i) some legal aspects to consider for mobile payments-to-persons (Annex B). ISO/TS 12812-4:2017 is structured as follows: - Clause 6 sets forth the requirements that a mobile payments-to-persons program must comply with. - Clauses 7, 8 and 9 provide the different levels of implementation for the interoperability of mobile payments-to-persons. - Clause 7 describes the interoperability principles for mobiles payments-to-persons. - Clause 8 describes: a three-layer high-level architecture for mobile payments-to-persons programs; payments instruments sustained by these programs; processing details for a series of significant use cases of mobile payments-to-persons using these payment instruments. - Clause 9 provides a step-by-step data flow description for different mobile payments-to-persons implementations: bank-centric, non-bank centric and card-centric. They can be mapped into the processing use cases of Clause 8, where abstraction is made in the nature of the payment service providers.

Opérations bancaires de base — Services financiers mobiles — Partie 4: Paiements mobiles à personnes

General Information

• Status: Published
• Publication Date: 27-Mar-2017
• ICS: 03.060 - Finances. Banking. Monetary systems. Insurance
• Technical Committee: ISO/TC 68/SC 9 - Information exchange for financial services
• Drafting Committee: ISO/TC 68/SC 9 - Information exchange for financial services
• Current Stage: 9093 - International Standard confirmed
• Start Date: 29-Jul-2025
• Completion Date: 13-Dec-2025

Overview - ISO/TS 12812-4:2017 (Mobile payments-to-persons)

ISO/TS 12812-4:2017 is a technical specification within the ISO 12812 series that defines requirements, recommendations and use cases for interoperable mobile payments-to-persons (P2P) as part of core banking and mobile financial services. The standard emphasizes operational principles, technical and organizational design, legal/policy considerations and leveraging legacy payment infrastructures to enable secure, interoperable mobile P2P transactions - including proximate (device-to-device) and remote payments.

Key topics and technical requirements

• Scope and program requirements (Clause 6): mandatory requirements a mobile payments-to-persons program must meet (e.g., consumer protections, transparency and program governance).
• Device, network and application selection: guidance on selecting secure mobile environments and application deployment models.
• Logging, notice, authentication and authorization: operational requirements for audit trails, user notice and security controls.
• Interoperability scenarios (Clauses 7–9):
  • Three-corner and four-corner models for settlement and message routing.
  • Cross-system payments and payment facilitation models such as direct interoperability and shared common infrastructure.
• Three-layer generic architecture (Clause 8):
  • Layer 1: message conveyance (initiation/authorization).
  • Layer 2: common infrastructure for payment facilitation.
  • Layer 3: value-transfer and funds movement.
• Classification of payment instruments: mobile credit transfer, mobile card payments and electronic money transfers.
• Detailed transaction flows (Clause 9): bank-centric, non-bank-centric and card-centric processing examples and step‑by‑step data flows.
• Special topics: mobile remittances, financial inclusion for unbanked/underbanked users (Annex A) and intra-/inter-jurisdictional legal aspects (Annex B).

Practical applications and who uses it

ISO/TS 12812-4:2017 is practical for organizations designing, deploying or regulating mobile P2P payment services:

• Banks and core-banking vendors implementing account-to-account mobile P2P services.
• Mobile financial service providers (MFSPs) and electronic money issuers building interoperable mobile wallets.
• Fintechs and payment scheme operators creating cross-network P2P rails and wallets.
• Mobile network operators and agents participating in distribution and proximity payments (e.g., NFC, BLE, QR).
• Regulators, compliance officers and policymakers evaluating consumer protection, dispute resolution and legal frameworks. Use cases include person-to-person transfers, casual peer payments (family, babysitters, neighbors), mobile remittances and on‑device proximate payments using NFC or other proximity methods.

Related standards

• ISO 12812‑1:2017 (series overview and Annex C on legacy instruments)
• ISO 18092 (NFC peer-to-peer proximity communications)
• Other parts of the ISO 12812 series covering mobile financial services interoperability and security

Keywords: ISO/TS 12812-4:2017, mobile payments-to-persons, core banking, mobile financial services, interoperability, mobile remittances, financial inclusion.

Standards Content (Sample)

TECHNICAL ISO/TS
SPECIFICATION 12812-4
First edition
2017-03
Core banking — Mobile financial
services —
Part 4:
Mobile payments-to-persons
Opérations bancaires de base — Services financiers mobiles —
Partie 4: Paiements mobiles à personnes
Reference number
©
ISO 2017
© ISO 2017, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. [phone]
Fax [phone]
[e-mail]
www.iso.org
ii © ISO 2017 – All rights reserved

Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 2
3 Terms and definitions . 2
4 Abbreviated terms . 3
5 Specific characteristics for mobile payments-to-persons . 3
5.1 General . 3
5.2 Mobile payments-to-persons concepts . 3
5.3 User expectations . 4
5.4 Stakeholders involved in a mobile payments-to-persons program . 4
5.4.1 Mobile financial service provider . 4
5.4.2 Mobile network operator . 4
5.4.3 Agent . 4
5.4.4 Electronic money service provider . 4
6 Requirements for mobile payments-to-persons . 5
6.1 General . 5
6.2 Device, network, and application selection requirements . 5
6.2.1 General. 5
6.2.2 Requirements . 5
6.3 Logging requirements . 6
6.3.1 General. 6
6.3.2 Requirements . 6
6.4 Notice requirements . 6
6.4.1 General. 6
6.4.2 Requirements . 6
6.5 Authentication and authorization requirements . 7
6.5.1 General. 7
6.5.2 Requirements . 7
7 Scenarios for interoperability . 7
7.1 General . 7
7.2 Scenario for interoperability 1 . 7
7.2.1 General. 7
7.2.2 Three-corner model . 8
7.2.3 Four-corner model . 8
7.3 Scenario for interoperability 2 (cross-system payment) . 8
7.4 Interoperability models for payment facilitation . 9
7.4.1 General. 9
7.4.2 Direct interoperability model . 9
7.4.3 Common infrastructure .10
8 Implementation models .11
8.1 General .11
8.2 High-level architecture and network technologies.11
8.2.1 Layer 1: Infrastructure used to convey payment initiation and
authorization messages .11
8.2.2 Layer 2: Common infrastructure used for payment facilitation .12
8.2.3 Layer 3: Value transfers and funds movement.12
8.3 Classification of mobile payments-to-persons .12
8.3.1 General.12
8.3.2 Mobile credit transfer payment .13
8.3.3 Mobile card payment . . .13
8.3.4 Electronic money transfer .13
8.4 Mobile remittances .13
8.5 High-level description for significant use cases .14
8.5.1 General.14
8.5.2 Mobile payments-to-persons by card .14
8.5.3 Payments-to-persons by credit transfer .16
9 Detailed payments-to-persons transaction flows .20
9.1 General .20
9.2 Models for the processing of mobile payments-to-persons .20
9.3 Bank-centric payments-to-persons models .21
9.3.1 Split payment over the ACH system .21
9.3.2 Bank-centric single payment over the ACH system consortium model .23
9.4 Non-bank-centric models .25
9.4.1 General.25
9.4.2 Three-corner non-bank-centric methods funded by non-bank account .26
9.4.3 Split non-bank centric model funded by bank account .27
9.4.4 Three-corner non-bank-centric single model funded by bank account .29
9.5 Card-based payments .30
9.5.1 Processing functionalities .30
9.5.2 Detailed transaction flow .30
Annex A (informative) Financial inclusion for mobile payments-to-persons .33
Annex B (informative) Intra-jurisdictional versus inter-jurisdictional aspects for
mobile payments-to-persons .35
Bibliography .36
iv © ISO 2017 – All rights reserved

Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.
ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/ directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of
any patent rights identified during the development of the document will be in the Introduction and/or
on the ISO list of patent declarations received (see www .iso .org/ patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO’s adherence to the
World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see the following
URL: w w w . i s o .org/ iso/ foreword .html.
This document was prepared by Technical Committee ISO/TC 68, Financial services, Subcommittee SC 7,
Core banking.
A list of all the parts in the ISO 12812 series can be found on the ISO website.
Introduction
The ISO 12812 series is a multi-part standard addressing interoperable and secure systems for the
provision, operation and management of Mobile Financial Services (MFSs).
This document addresses how a payer interacts with a person to initiate and complete a mobile
payment. A “person” can be either a natural individual or a small business entity legally recognized
as a “person” but where the payment is casual in nature (e.g. where the purpose is to transfer funds
between people who know each other, such as family members, friends or neighbours, or where the
relationship between two people is casual, such as to pay the babysitter, nanny, handyman, etc.).
Payment instruments used for mobile payments-to-persons are rendered by appropriate MFS
applications that are available in or accessed through a mobile device. This mobile device, using an
appropriate secure environment, stores or provides access to sensitive data. Such sensitive data
include application configuration information, personal account data and user authentication data
(authentication credentials), including cryptographic keys.
This document includes a set of requirements and some recommendations intended to facilitate the
interoperability of mobile payments-to-persons. This document also outlines the need for consumer
protection mechanisms (e.g. including fair contract terms, rules on transparency of charges, clarification
of liability, complaints mechanisms and dispute resolution).
The objective of this document is to provide MFSPs with technical provisions to enable the development
of interoperable mobile payments-to-persons services, where either the payer or the payee uses a
mobile device to transact a payment to a person.
Mobile payments-to-persons may require the payer to input a unique identifier of the payee. The payee
of a mobile payments-to-persons transaction (e.g. family member, friend) should be able to verify the
received amount and the reason for the payment. Although the standard focuses on mobile payments-
to-persons resulting in account-to-account payments, mobile payments-to-persons systems have also
been deployed in scenarios where payer and/or payee are unbanked. From a wider perspective, then
mobile payments-to-persons and especially remittances may facilitate later financial inclusion (see
Annex A).
This document differentiates between proximate mobile payments-to-persons and remote mobile
payments-to-persons:
— Proximate mobile payments-to-persons refers to a payment conveyed from one mobile device to
another mobile device, where the payer and the payee are physically present in the same location.
In this document, such mobile devices are assumed to enable a contactless or other communication
channel to be established. One example is the Near Field Communication Interface (see ISO 18092),
present on an NFC-enabled Mobile Device. NFC technology in the mode called peer-to-peer
establishes such a contactless channel between the two communicating devices. This document
does not preclude the use of other proximity technologies like (e.g. bluetooth low energy, QR codes).
— Remote mobile payments-to-persons refers to payments in which both the payer and the payee
may be not physically present at the same location, meaning that the mobile device establishes a
communication channel using a wireless network.
Regarding the implementation of mobile payments-to-persons, the following factors should be
considered:
— Technology innovation is dynamic, especially for mobile devices and their operating systems, mobile
wallets and payment infrastructures. Thus, requirements should be flexible to handle current and
future technologies.
— Regulatory and policy issues should be addressed for the operation of payment systems by ensuring
conformance with national and multi-national legislation and regulation, (e.g. Know Your Customer
(KYC), Anti-Money Laundering (AML), the U.S. Office of Foreign Assets Control (OFAC) and Combating
the Financing of Terrorism (CFT), data protection/privacy and customer protection).
vi © ISO 2017 – All rights reserved

— Global utilization of mobile payments-to-persons in the two following areas:
a) The deployment of mobile devices in developing countries that are often challenged by geographical
boundaries, a lack of a centralized banking infrastructure, and a need for the provision of MFS to
under-banked and/or unbanked individuals.
b) Social networks are used by millions or even billions of people in systems relying on interpersonal
services (e.g. music, games, relationships). Many of these services generate direct payments-to-
persons relationships which may involve the use of mobile payments-to-persons.
Mobile payments-to-persons constitute one type of MFS. The contents of this document are closely
related with other parts of the standard. Potential implementers of mobile retail payment solutions
should look at part 5. Both parts 4 and 5 of ISO 12812 seek to support all possible technologies and
are not intended to favour any specific technology. Therefore, individual implementations of a mobile
payments-to-persons service may be highly dependent upon or require the application of other parts of
the ISO 12812 standard. In particular:
— ISO 12812-1 describes the general framework and definitions for the standard;
— ISO 12812-2 specifies requirements and recommendations for security and data protection;
— ISO 12812-3 specifies requirements and recommendations for the management of mobile financial
applications.
Figures 1 to 6 or part thereof are courtesy of the European Payments Council.
TECHNICAL SPECIFICATION ISO/TS 12812-4:2017(E)
Core banking — Mobile financial services —
Part 4:
Mobile payments-to-persons
1 Scope
This document provides comprehensive requirements and recommendations, as well as specific use
cases for implementation of interoperable mobile payments-to-persons.
The emphasis is placed on the principles governing the operational functioning of mobile payments-to-
persons systems and processes, as well as the presentation of the underlying technical, organizational,
business, legal and policy issues, leveraging legacy infrastructures of existing payment instruments
(see ISO 12812-1:2017, Annex C).
This document includes the following items:
a) requirements applicable to mobile payments-to-persons;
b) recommendations regarding mechanisms involved in the operation of interoperable mobile
payments-to-persons;
c) a description of the different use cases for mobile payments-to-persons;
d) a generic interoperability model for the provision of different mobile payments-to-persons;
e) recommendations for the technical implementation of the generic architectures for the mobile
payments-to-persons program;
f) recommendations for mobile remittances;
g) use cases with the corresponding transaction flows;
h) discussion of the financial inclusion of unbanked and underbanked persons (Annex A);
i) some legal aspects to consider for mobile payments-to-persons (Annex B).
The document is structured as follows:
— Clause 6 sets forth the requirements that a mobile payments-to-persons program must comply with.
— Clauses 7, 8 and 9 provide the different levels of implementation for the interoperability of mobile
payments-to-persons.
— Clause 7 describes the interoperability principles for mobiles payments-to-persons.
— Clause 8 describes:
1) a three-layer high-level architecture for mobile payments-to-persons programs;
2) payments instruments sustained by these programs;
3) processing details for a series of significant use cases of mobile payments-to-persons using
these payment instruments.
— Clause 9 provides a step-by-step data flow description for different mobile payments-to-persons
implementations: bank-centric, non-bank centric and card-centric. They can be mapped into the
processing use cases of Clause 8, where abstraction is made in the nature of the payment service
providers.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments) applies.
ISO 12812–1, Core banking — Mobile financial services — Part 1: General framework
ISO 12812–2:2017, Core banking — Mobile financial services — Part 2: Security and data protection for
mobile financial services
ISO 12812–5, Core banking —Mobile financial services — Part 5: Mobile payments to businesses
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO 12812-1 and the following apply.
ISO and IEC maintain terminological databases for use in standardization at the following addresses:
— IEC Electropedia: available at http:// www .electropedia .org/
— ISO Online browsing platform: available at http:// www .iso .org/ obp
3.1
agent
entity that transfers funds to an MFSP on behalf of the payer or disburses funds from an MFSP to the payee
Note 1 to entry: The definition applies especially to remittance and covers both three- and four-corner systems.
3.2
mobile payments to person
mobile payment where the payee is a person
3.3
mobile remittance
transfer of money through mobile device between two persons located or not in the same country
3.4
mobile remittance service provider
entity that provides a mobile remittance service
3.5
mobile payments-to-persons program
operational network, governed by laws, rules and technical specifications, standards, providing mobile
payments-to-persons services
3.6
payee identifier
information enabling a MFSP to identify the beneficiary of a mobile payments-to-person
3.7
unbanked
individual who does not have access to a bank account or who has no contract with a financial institution
for banking services
2 © ISO 2017 – All rights reserved

4 Abbreviated terms
ACH Automatic Clearing House
AML Anti-Money Laundering
BIC Business Identifier Code
CFT Combating the Financing of Terrorism
CI Consumers International
CSM Clearing and Settlement Mechanism
IBAN International Bank Account Number
KYC Know Your Customer
MFS Mobile Financial Service
MFSP Mobile Financial Service Provider
MNO Mobile Network Operator
5 Specific characteristics for mobile payments-to-persons
5.1 General
The content in this clause is generic in nature and can be applied across a wide variety of mobile
payments-to-persons. The objective is to contribute to a common understanding on how the various
mobile payments-to-persons programs work.
Together, the different sections of this clause propose a flexible framework for mobile payments-to-
persons programs which includes:
— functional and technical commonalities between different mobile payments-to-persons as classified
in Clauses 8 and 9;
— functional architectures suitable to mobile payments-to-persons;
— provisions to cover regional requirements and/or constraints, in particular, those of a legal or
regulatory nature.
5.2 Mobile payments-to-persons concepts
Depending upon the nature of the mobile payments-to-persons system, the transfer may involve any
combination of:
— a deposit account or a credit account associated with the payer and/or the payee;
— an agent accepting from the payer or disbursing to the payee funds through a variety of methods,
including cash;
— electronic money held by the payer or payee, either resident in a server or stored in a mobile device
using an appropriate secure environment (see ISO 12812-2).
5.3 User expectations
The next list (not exhaustive) precises some expectations of users (payers and payees) of mobile
payments-to-persons systems:
a) payee availability of funds at all times;
b) easy to use service;
c) quick transfer and confirmation;
d) increasingly seek transferability of funds with persons enrolled by different MFSPs;
e) resistance against attacks (theft, skimming, etc.);
f) transparency of charges;
g) clarification of liability;
h) availability of complaint and dispute resolution mechanisms.
5.4 Stakeholders involved in a mobile payments-to-persons program
5.4.1 Mobile financial service provider
The MFSP contracts the customer for a mobile payments-to-persons service provided in the framework
of an MFS program. An MFSP directly operates the mobile payments-to-persons service or may
subcontract some elements of the program to a third party.
A primary role of the MFSP is the issuance of mobile payments-to-persons applications to be used
during the transaction. The MFSP also implement risk prevention and technical controls that ensure
the security of the transaction in conformance with the rules of the MFS program. In particular, the
MFSP controls the access to mobile payments-to-persons services to their enrolled customers using
authentication mechanisms.
An open MFS program involves at least one business agreement between two or more different
MFSPs in order to offer customers services according to mutually contracted governance rules (see
ISO 12812-1:2017, B.3).
NOTE In this document, the acronym MFSP refers to a “payments-to-persons MFSP”.
5.4.2 Mobile network operator
The MNO operates the wireless network that may be required to proceed to a mobile payments-to-
person transaction. The MNO provides access to the network after authenticating the user. The MNO
may also act as the distribution channel for the mobile device and associated authentication means.
5.4.3 Agent
The agent is the entity entitled by contract with an MFSP to disburse cash to the payee (cash-out) or to
accept cash (cash-in) from a payer to proceed to a mobile payments-to-person to a designated payee. An
agent may be a regulated entity.
5.4.4 Electronic money service provider
The electronic money service provider is an entity (that may be regulated based on national laws or
regulations) that is authorized to issue and exchange electronic money between their customers.
4 © ISO 2017 – All rights reserved

6 Requirements for mobile payments-to-persons
6.1 General
This clause identifies a set of requirements that are common to both proximate and remote mobile
payments-to-persons.
These requirements are similar to those covering the payments to a business environment. Where in
particular receipt delivery is needed, printed or in electronic form, the requirements of ISO 12812-5 apply.
A mobile payments-to-person transaction involves typically an initial connection between the mobile
device of the payer and an MFSP after the selection of an application by the payer. Upon the payer
authentication and the retrieval of payee’s routing information, the MFSP of the payer establishes a
second connection with the MFSP of the payee to instruct the payment.
The requirements set out in this clause shall apply to:
— the implementation of the mobile payments-to-persons application;
— the protocols executed between the MFSPs involved in the transaction, as well as to the protocols
between the payer/payee and their MFSP. In particular, these protocols shall convey data needed to
conform to 6.3, 6.4 and 6.5.
NOTE Security and data protection requirements are addressed in ISO 12812-2.
6.2 Device, network, and application selection requirements
6.2.1 General
These requirements are intended to ensure that a customer has the freedom to choose under certain
conditions the mobile device and MNO for access to MFSs that will be used.
6.2.2 Requirements
6.2.2.1 An MFSP shall permit customers (e.g. payer or payee) to select the mobile device they desire
for the access to the mobile payments-to-persons service, provided that the mobile device supports a
secure environment compatible with the MFSP requirements and is consistent with ISO 12812-2.
6.2.2.2 An MFSP shall facilitate the selection of the MNO which the customer desires to handle mobile
communications services, provided that the MNO supports a secure environment compatible with the
MFSP requirements.
6.2.2.3 A mobile device shall permit a customer to:
— select the appropriate mobile payments-to-persons application(s) including a mobile wallet, for
handling any particular mobile payments-to-persons transaction;
— permit a customer to disable an MFS application (see ISO 12812-3:2017, 7.1).
6.2.2.4 An MFSP shall ensure that when a mobile wallet is used for mobile payments-to-persons, it is
capable of providing, at least, the following functionality:
— a trusted user interface to:
a) manage (register, update, delete) data that may be used for the service;
b) allow the user to select and use the payments-to-persons service (can be one interface managing
all payment means or different interfaces for different means);
— a data repository (on the mobile device or a secure remote server).
6.3 Logging requirements
6.3.1 General
These requirements are intended to facilitate the traceability of transactions and enable the customer
to verify that these transactions have been performed correctly.
6.3.2 Requirements
6.3.2.1 An MFSP shall provide the means for a customer to view details of each mobile payment
transaction. The transaction log shall, at a minimum, display the last 10 transactions handled by a mobile
payments-to-persons application, or the recent transactions completed over the past 30-day period,
whichever provides the most information. Beyond the immediate logging information, the MFSP shall
arrange to provide additional information to a customer upon request under reasonable terms.
6.3.2.2 The transaction log shall make available the following data:
— transaction identifier;
— transaction date;
— transaction time;
— transaction amount(s);
— transaction currency code(s);
— transaction type (e.g. debit, credit);
— payee/payer information (e.g. name/device identifier and location);
— transaction verification/integrity information (e.g. cryptogram).
NOTE A parallel requirement to provide a transaction log to a payee may not be practical because the payee
can be a customer of a different MFSP.
6.4 Notice requirements
6.4.1 General
These requirements are intended to:
— reduce the risks and consequences of unauthorised or incorrectly executed payment transactions
so that the payer and the payee may inform their MFSPs as soon as possible about any contestations
concerning allegedly unauthorised or incorrectly executed payment transactions, and
— accelerate the availability of the funds by the payee.
6.4.2 Requirements
6.4.2.1 The payer MFSP shall notify a payer that a payment has been authorized, approved, or
completed.
6.4.2.2 The payee MFSP shall notify the payee about the status of a payment (e.g. that a payment has
been received into the payee’s account).
6 © ISO 2017 – All rights reserved

6.4.2.3 The payee MFSP shall notify the payee about the ability to access the funds that were transferred
into the payee’s account.
6.4.2.4 The MFSP shall accomplish the notice required by this section through an appropriate
method of communication (e.g. through pop-up notice in the application, by text, by email and by paper
statement).
6.5 Authentication and authorization requirements
6.5.1 General
These requirements are intended to reduce risks and consequences of unauthenticated or unauthorized
payment transactions using preventive measures to authenticate and authorize the payer and the payee.
6.5.2 Requirements
6.5.2.1 The payer MFSP shall authenticate the payer to verify the identity of the payer and his/her
mobile device and shall authorize the transaction after validating the availability of funds and according to
its internal risk management procedures. For authentication and authorization methods, see ISO 12812-
2. For payment-to-person transaction authentication, authorization and acceptance discussion and use
cases, see 9.2, 9.3 and 9.4.
6.5.2.2 The payee MFSP shall authenticate the payee to verify the identity of the payee and his/her
mobile device and shall authorize the transaction according to its internal risk management procedures.
For authentication and authorization methods, see ISO 12812-2. For payment to person transaction
authentication, authorization and acceptance discussion and use cases, see 9.2, 9.3 and 9.4.
7 Scenarios for interoperability
7.1 General
Interoperability of a mobile payments-to-persons program refers to the ability of a payer enrolled
with an MFSP to execute a mobile payments-to-person transaction with a payee who is not necessary
enrolled with the payer MFSP. Both MFSPs must have access to a mobile payments-to-persons system.
This document describes two interoperability scenarios:
— Scenario 1, where the transaction is processed within a single mobile payments-to-persons system;
— Scenario 2, where the transaction is processed through different mobile payments-to-persons
systems and interoperability models for payment facilitation.
Implementers interested in specific examples of how interoperability between MFSP has been handled
in SEPA/EPC situations may refer to documentation in EPC 492.09 version.
NOTE The figures in Clauses 7 and 8 are inspired from the EPC document.
7.2 Scenario for interoperability 1
7.2.1 General
In scenario 1, MFSP(s) are members of the same mobile payments-to-person system. This scenario
covers two models described in 7.2.2 and 7.2.3.
In both models, the MFSP(s) participating in the transaction:
— implement common protocols to connect to the payment system for the execution of payments
using a given payment instrument;
— have access to a common clearing and settlement facility;
— enrol their customers for a mobile payments-to-persons service;
— provide their customers with a mechanism (e.g. a mobile payments-to-persons application, a mobile
wallet) to transmit payment orders through wireless communication networks.
7.2.2 Three-corner model
In a three-corner model, both the payer and the payee are customers of the same MFSP. The three-
corner model is also called closed-loop or MFSP centric (see ISO 12812-1:2017, Annex B).
The fact that only one MFSP is involved may result in a simplified implementation of the use cases, such
as the identification of the payee (which is known to the MFSP), the payment confirmation and the
immediacy of the funds availability by the payee.
7.2.3 Four-corner model
In this model, the payer and the payee are customers of the different MFSPs. The four-corner model is
also called open-loop or inter-MFSP collaborative (see ISO 12812-1:2017, Annex B).
In this model, MFSPs have implemented common protocols and access to shared system infrastructures
for payment initiation, processing and settlement.
7.3 Scenario for interoperability 2 (cross-system payment)
Scenario 2 refers to interconnectivity options to enable a payer enrolled by an MFSP member of a
system A to transfer funds to a payee enrolled with an MFSP of a different system B. The business
rationale for scenario 2 is the need for a MFSP to boost the volume of transactions and to extend the
mobile payments-to-persons service to a larger number of payees.
Possible solutions include:
— Bilateral or multilateral agreements between systems.
— The creation of a common infrastructure (e.g. a hub) to support cross-system payments-to-persons
payments and develop a common directory shared between systems and similar in functionality
to the one designed in 7.4. This cross-system directory may be implemented as the federation of
existing common directories and be accessible using a common protocol.
— The hub may offer different levels of service, depending in the investment effort decided. For
instance, the hub may:
a) provide a service for protocol conversion, or
b) require the implementation of a specific protocol to be supported for the PSPs, or
c) provide APIs for the service to be offered (e.g. access to a Common Directory).
NOTE Future versions of the standard can provide technical solutions for cross-system interoperability.
8 © ISO 2017 – All rights reserved

Figure 1 — Interoperability model for scenario 2
Figure 1 describes the interfaces required for the transmission of the payment instructions between
the different stakeholders. For scenario 2, the routing of the payment instruction requires that both
systems implement an interface for access of the respective system’s MFSP to a common infrastructure.
7.4 Interoperability models for payment facilitation
7.4.1 General
A first concern for the mobile payments-to-persons program is to facilitate the initiation of the payment
using an identifier (e.g. alias) of the payee easy to handle by the payer, but sufficient to retrieve the
payee routing information.
This document proposes two interoperability models for the facilitation of payments to persons:
— The direct interoperability model, where the payer provides to his/her MFSP the information needed
to route the payment instruction to the payee MFSP. It is based on the use of existing infrastructure
and delivers direct interoperability between payers and payees, as described in 7.4.2.
— The common infrastructure model, which involves the implementation of a common infrastructure
(CI) to which each MFSP participating in a system has access to. The payer MFSP sends a request to
the CI using the payee identifier provided by the payee (e.g. an alias) and receives as a response the
appropriate routing information for the payment transaction (e.g. to the payee’s payment account
through IBAN/BIC for credit transfers/ACH transactions). This model is described in 7.4.3.
NOTE Multiple versions of the common infrastructure model exist.
7.4.2 Direct interoperability model
The direct interoperability model is dependent on the payer’s/payee’s ability to forward all relevant
payment information (BIC, IBAN, PAN, name, address, etc.) to his/her MFSP. The information for
the payment transaction is directly provided by the payer to its MFSP. Implementing the direct
interoperability model in a mobile payments-to-persons system means that the payer MFSP does not
need to collect additional information in order to generate the payment instruction.
In this way, the mobile payments-to-persons transaction may be performed in four steps:
— payment initiation by the payer including payee information;
— generation of the payment instruction by the payer MFSP;
— debit of the payer account and credit of the payee account;
— notification to the payee of the funds availability.
7.4.3 Common infrastructure
In this model, interoperability is achieved by the usage of a centralized common infrastructure which
may have many shapes and purposes and which could even be implemented in a distributed way. The
primary purpose of this infrastructure is to act as a directory service or switch for routing purposes
as described in Figure 2. This centralized infrastructure could also offer various value added services
such as delivery services which are, however, beyond the scope of the ISO 12812 standard.
Figure 2 — Common infrastructure model
Figure 2 adds an additional step prior to the generation by the payer’s MFSP of the payment instruction.
The information for the payment transaction is to be retrieved by the payer’s MFSP from a central data
server based on the payee’s al
...