Clarification on merchant onboarding requirements under the Regulation of Payment Aggregators and Payment Gateways

Terms of use

Terms of Use

The use of this site and the content contained therein is governed by the Terms of Use. When you use this site you acknowledge that you have read the Terms of Use and that you accept and will be bound by the terms hereof and such terms as may be modified from time to time.

All text, graphics, audio, design and other works on the site are the copyrighted works of nasscom unless otherwise indicated. All rights reserved.
Content on the site is for personal use only and may be downloaded provided the material is kept intact and there is no violation of the copyrights, trademarks, and other proprietary rights. Any alteration of the material or use of the material contained in the site for any other purpose is a violation of the copyright of nasscom and / or its affiliates or associates or of its third-party information providers. This material cannot be copied, reproduced, republished, uploaded, posted, transmitted or distributed in any way for non-personal use without obtaining the prior permission from nasscom.
The nasscom Members login is for the reference of only registered nasscom Member Companies.
nasscom reserves the right to modify the terms of use of any service without any liability. nasscom reserves the right to take all measures necessary to prevent access to any service or termination of service if the terms of use are not complied with or are contravened or there is any violation of copyright, trademark or other proprietary right.
From time to time nasscom may supplement these terms of use with additional terms pertaining to specific content (additional terms). Such additional terms are hereby incorporated by reference into these Terms of Use.

Disclaimer

The Company information provided on the nasscom web site is as per data collected by companies. nasscom is not liable on the authenticity of such data.
nasscom has exercised due diligence in checking the correctness and authenticity of the information contained in the site, but nasscom or any of its affiliates or associates or employees shall not be in any way responsible for any loss or damage that may arise to any person from any inadvertent error in the information contained in this site. The information from or through this site is provided "as is" and all warranties express or implied of any kind, regarding any matter pertaining to any service or channel, including without limitation the implied warranties of merchantability, fitness for a particular purpose, and non-infringement are disclaimed. nasscom and its affiliates and associates shall not be liable, at any time, for any failure of performance, error, omission, interruption, deletion, defect, delay in operation or transmission, computer virus, communications line failure, theft or destruction or unauthorised access to, alteration of, or use of information contained on the site. No representations, warranties or guarantees whatsoever are made as to the accuracy, adequacy, reliability, completeness, suitability or applicability of the information to a particular situation.
nasscom or its affiliates or associates or its employees do not provide any judgments or warranty in respect of the authenticity or correctness of the content of other services or sites to which links are provided. A link to another service or site is not an endorsement of any products or services on such site or the site.
The content provided is for information purposes alone and does not substitute for specific advice whether investment, legal, taxation or otherwise. nasscom disclaims all liability for damages caused by use of content on the site.
All responsibility and liability for any damages caused by downloading of any data is disclaimed.
nasscom reserves the right to modify, suspend / cancel, or discontinue any or all sections, or service at any time without notice.

For any grievances under the Information Technology Act 2000, please get in touch with Grievance Officer, Mr. Anirban Mandal at data-query@nasscom.in.

New

See all

No notification found.

Clarification on merchant onboarding requirements under the Regulation of Payment Aggregators and Payment Gateways

Komal Gupta

@Komal

June 26, 2020

Public Policy

2396

Based on feedback from industry, NASSCOM recently made a representation to the Reserve Bank of India (RBI) on a particular ambiguity in the Guidelines on Regulation of Payment Aggregators (PA) and Payment Gateways (PG) published by it on March 17, 2020 (Guidelines).

This pertains to merchant onboarding requirements under Sections 7.3 and 7.4 of the Guidelines. The provisions in the final Guidelines are:

“7.3. PAs shall be responsible to check Payment Card Industry-Data Security Standard (PCI-DSS) and Payment Application-Data Security Standard (PA-DSS) compliance of the infrastructure of the merchants on-boarded.

7.4. Merchant site shall not save customer card and such related data. A security audit of the merchant may be carried out to check compliance, as and when required.”

Our understanding is that merchants who comply with PCI-DSS and other applicable requirements in the Guidelines can continue to store customer card data. However, the provision are drafted as separate sections in the Guidelines and result in ambiguity, leading to an interpretation that merchants cannot store card data despite PCI compliance.

Such an interpretation would be contrary to the paragraph 6.6 of Annex-1 of the Discussion Paper published on the RBI website on 17.09.2019 which clearly stated that merchants can store card data as long as they have customer consent and their infrastructure for storing customer payment data and connecting to the aggregator is PCI-DSS and PA-DSS compliant on an on-going basis.

Below are the industry concerns in case merchants are prohibited from storing card data below:

(a) Card data security: Merchants who achieve certified compliance to these PCI standards meet the same rigorous technical requirements and compliance validation completed by acquirers, PAs, issuers and any other entities handling card data. The RBI, in its Payment And Settlement Systems In India: Vision – 2019-2021, has recognized PCI standards as “a desirable best practice by all the entities in a payment transaction chain, irrespective of their status as a regulated entity or otherwise (emphasis added)”.

The RBI has also previously required PCI-DSS compliance for all acquiring infrastructure operational on IP based solutions by acquirers, processors/aggregators and large merchants (Reference). Prohibiting merchants from storing card data despite compliance with PCI standards does not improve the safety of cardholder data and trust in the payment ecosystem. On the contrary, storing card data for all merchants on payment aggregators can lead to customer data getting consolidated across very few PA systems, which could make the customer data more accessible and vulnerable to data breaches.

(b) Fraud Risks: Merchants use card data to analyze fraud risk, build fraud mitigation tools and strategies. Today, most merchants have robust risk assessment frameworks to control frauds on their platforms, which have been built in collaboration with banks and payment system operators. Many merchants collaborate directly with issuers and others in the payments ecosystem to proactively mitigate fraud, track fraud patterns and help implement instant response and recovery actions. Without card data, merchants cannot engage in such crucial fraud prevention measures, which will have a huge impact on consumer confidence and adoption of digital payments.

(c) Merchant locked in with single PA: The card storage related requirements, will force the merchants to work with a single PA, which shall have the customer card data. Merchants will lose the ability to work with multiple PAs and will have difficulty switching aggregators even when faced with poor service or other issues like security concerns on the PA’s side. Decrease in competition and control in the hands of a few players in the market will directly impact cost for consumers and reduce any incentive to continuously innovate and strive towards excellence. If a PA facing down time or security issues is not able to manage the increase in traffic that merchants may experience during peak times; or is facing technical issues and transaction failures, it would result in a widespread impact across the digital ecosystem, adversely impacting numerous other merchants and customers.

Working with one PA will prohibit the merchants from diversifying and mitigating transaction risk. Any security breach in the systems of the PA will have significant unintended consequences on the merchant activities. This will extend to all the merchants working with this PA, thereby having an unimaginable impact on the industry.

(d) Customer service: Without customer card data, merchants will not be able to perform basic functions such as resolution of customer complaints/disputes, customer service and speedy resolution of refunds requests. While PAs have regulatory obligation to resolve disputes, merchants still need to prioritize and resolve customer concerns, as customer satisfaction is critical for their business. A deprecated customer service would increase the number of customer grievances and escalations, which could have been easily managed at the initial stage by the merchant itself.

(e) Product Innovation: Dependence on PAs will prevent merchants from offering seamless and innovative payment experiences to their customers in line with RBI’s vision of “Empowering Exceptional (E) Payment Experiences.” For example, merchants will be unable to provide customized checkout and single click payment, resulting in unnecessary friction for consumers. Merchants will not be able to offer subscription-based services that require storage of card data to bill customers on a recurring basis.

Most of the payment innovations have been driven by merchants who want to give their customers a seamless and safe online payment experience. Merchants have a direct relationship with their customers and therefore understand the needs of customers, which they enable by working with PAs and banks. Various merchant entities have been investing heavily in ensuring safety and security of payment transactions while innovating for a better customer experience. However, this regulation inhibits the merchants’ ability to promote digital transactions. Therefore, it is crucial that merchants who meet the applicable Security Standards continue to be able to store card data to avoid large-scale interruptions in customer experience, business operations and digital payments adoption.

We have requested RBI to:

? Clarify or publish FAQs confirming that PCI-DSS compliant merchants who meet other applicable onboarding requirements in the Guidelines may continue to save customer card and related data.
? Develop a framework to store card data to encompass the security measures (PCI-DSS compliance), reporting requirements and governance mechanisms. The PA shall be responsible to confirm merchant’s compliance with the framework. This will provide the right visibility to RBI and balance the needs of the merchant.

Read our previous blogs on PA/PG Guidelines here.

For any questions or clarification on this issue, please write to komal@nasscom.in.

data NASSCOM policy RBI security payment gateway payment aggregator merchants on-boarding

Disclaimer

That the contents of third-party articles/blogs published here on the website, and the interpretation of all information in the article/blogs such as data, maps, numbers, opinions etc. displayed in the article/blogs and views or the opinions expressed within the content are solely of the author's; and do not reflect the opinions and beliefs of NASSCOM or its affiliates in any manner. NASSCOM does not take any liability w.r.t. content in any manner and will not be liable in any manner whatsoever for any kind of liability arising out of any act, error or omission. The contents of third-party article/blogs published, are provided solely as convenience; and the presence of these articles/blogs should not, under any circumstances, be considered as an endorsement of the contents by NASSCOM in any manner; and if you chose to access these articles/blogs , you do so at your own risk.

Komal Gupta

Policy Analyst

Policy Professional| Former Tech and Business Journalist|