Reserve Bank of India: Representation on Facilitating Compliance with Card-on-File Tokenisation

Terms of use

Terms of Use

The use of this site and the content contained therein is governed by the Terms of Use. When you use this site you acknowledge that you have read the Terms of Use and that you accept and will be bound by the terms hereof and such terms as may be modified from time to time.

All text, graphics, audio, design and other works on the site are the copyrighted works of nasscom unless otherwise indicated. All rights reserved.
Content on the site is for personal use only and may be downloaded provided the material is kept intact and there is no violation of the copyrights, trademarks, and other proprietary rights. Any alteration of the material or use of the material contained in the site for any other purpose is a violation of the copyright of nasscom and / or its affiliates or associates or of its third-party information providers. This material cannot be copied, reproduced, republished, uploaded, posted, transmitted or distributed in any way for non-personal use without obtaining the prior permission from nasscom.
The nasscom Members login is for the reference of only registered nasscom Member Companies.
nasscom reserves the right to modify the terms of use of any service without any liability. nasscom reserves the right to take all measures necessary to prevent access to any service or termination of service if the terms of use are not complied with or are contravened or there is any violation of copyright, trademark or other proprietary right.
From time to time nasscom may supplement these terms of use with additional terms pertaining to specific content (additional terms). Such additional terms are hereby incorporated by reference into these Terms of Use.

Disclaimer

The Company information provided on the nasscom web site is as per data collected by companies. nasscom is not liable on the authenticity of such data.
nasscom has exercised due diligence in checking the correctness and authenticity of the information contained in the site, but nasscom or any of its affiliates or associates or employees shall not be in any way responsible for any loss or damage that may arise to any person from any inadvertent error in the information contained in this site. The information from or through this site is provided "as is" and all warranties express or implied of any kind, regarding any matter pertaining to any service or channel, including without limitation the implied warranties of merchantability, fitness for a particular purpose, and non-infringement are disclaimed. nasscom and its affiliates and associates shall not be liable, at any time, for any failure of performance, error, omission, interruption, deletion, defect, delay in operation or transmission, computer virus, communications line failure, theft or destruction or unauthorised access to, alteration of, or use of information contained on the site. No representations, warranties or guarantees whatsoever are made as to the accuracy, adequacy, reliability, completeness, suitability or applicability of the information to a particular situation.
nasscom or its affiliates or associates or its employees do not provide any judgments or warranty in respect of the authenticity or correctness of the content of other services or sites to which links are provided. A link to another service or site is not an endorsement of any products or services on such site or the site.
The content provided is for information purposes alone and does not substitute for specific advice whether investment, legal, taxation or otherwise. nasscom disclaims all liability for damages caused by use of content on the site.
All responsibility and liability for any damages caused by downloading of any data is disclaimed.
nasscom reserves the right to modify, suspend / cancel, or discontinue any or all sections, or service at any time without notice.

For any grievances under the Information Technology Act 2000, please get in touch with Grievance Officer, Mr. Anirban Mandal at data-query@nasscom.in.

New

See all

No notification found.

Reserve Bank of India: Representation on Facilitating Compliance with Card-on-File Tokenisation

Apurva Singh

@apurvaa

January 24, 2022

Public Policy

328

Backdrop

The RBI, on December 23, 2021, had granted an extension to merchants and payments aggregators to purge card-on-file data by six months i.e., till June 20, 2022. After this, the merchants and payment aggregators, in accordance with the PA/PG guidelines, will be required to purge stored card data and implement card-on-file tokenisation.[i] In this regard, we made a representation to the FinTech Department, Reserve Bank of India (RBI) highlighting the existing concerns of the industry on the implementation of Card-on-File tokenisation (CoFT).

NASSCOM’s representation to RBI

We highlighted that while the deadline to store cards has been extended for merchants and PAs, the concerns around readiness of regulated entities (REs) remain unaddressed. These concerns may cause disruption in the digital payment ecosystem and on consumer experience.

The industry, especially small and medium enterprises (SMEs) and start-ups are still recovering from the aftereffects of disruption caused by e-mandate on recurring transactions. This is also evidenced by the information available on the websites of many banks indicating that most of the merchants onboarded by the banks for their Merchant Standing Instructions are large merchants and not the SMEs.[ii] This is despite extensions granted by the RBI to the industry to develop and integrate their respective solutions to comply with the e-mandate on recurring transactions.

One of the key reasons behind it is the absence of transparency around the readiness of regulated entities (REs). Till the deadline i.e., September 30, 2021, the ecosystem was uncertain if the regulated entities have their respective solutions ready, and there were delays in sharing stable Application Programming Interface (API) documentation which further delayed the compliance with the e-mandate.

Assessing the state of preparedness

Even though an extension has been granted by the RBI to merchants and payment aggregators for storing card details till June 30, 2022, the entire ecosystem appears to be operating in the absence of transparency around the coverage of issuer banks which networks have at this point and the state of readiness of the RBI regulated entities. To this effect i.e., ensuring smooth transition to CoFT by the industry, we made the following recommendations to the RBI:

The payments ecosystem is an interdependent ecosystem wherein various stakeholders – card networks, card issuers and merchants – rely on each other to ensure seamless digital transactions for customers. Merchants are dependent on readiness of REs i.e., issuer banks, card networks, who offer tokenisation services. In the absence of timely viable solutions for tokenisation, merchants may again be left in a lurch at the time when the current deadline for compliance expires. A viable solution for merchants would be one where at-least banks issuing 80% of the cards have integrated and tested the CoFT solution with the networks and stable APIs are available to the merchants for them to test and integrate themselves with the CoFT solutions. Without this, they will face the risk of being required to purge card data from their systems without having access to tokenised data.
In the recent past, when RBI had extended the timeline for e-mandate on recurring transactions in March, 2021, issuer banks were still not ready by September 30, 2021, thereby resulting in disruption for the merchants and consumers.
To ensure smooth transition and integration of the respective systems, and to ensure that consumer experience is not impacted, we suggest:

RBI monitored compliance of regulated entities: As stated above, there is no clarity about how many issuer banks and acquirer banks have integrated their solutions with card networks. RBI monitored compliance shall ensure that the REs adhere to the timeline and the transition to CoFT does not adversely disrupt the ecosystem like e-mandate on recurring transactions.
This information should be published by the RBI on its website and updated weekly or at an appropriate frequency to serve as a single and credible source of information for the entire ecosystem.

For more information, kindly write to apurva@nasscom.in.

[i] Read more about it here, here and here.

[ii] For instance, the HDFC Bank has, as on January 21, 2022, listed 40 merchants on its website who are live with its Merchant Standing Instructions. Neither of these 40 merchants is an SME. Similarly, Yes Bank has a list of 14 merchants who are live with its Standing Instructions for Yes Bank Credit Card. Neither of these 14 merchants is an SME. While Public Sector Banks like the State Bank of India and the Bank of Baroda have gone live, they do not have list of merchants publicly available on their respective websites.

Card on File Tokenisation

Disclaimer

That the contents of third-party articles/blogs published here on the website, and the interpretation of all information in the article/blogs such as data, maps, numbers, opinions etc. displayed in the article/blogs and views or the opinions expressed within the content are solely of the author's; and do not reflect the opinions and beliefs of NASSCOM or its affiliates in any manner. NASSCOM does not take any liability w.r.t. content in any manner and will not be liable in any manner whatsoever for any kind of liability arising out of any act, error or omission. The contents of third-party article/blogs published, are provided solely as convenience; and the presence of these articles/blogs should not, under any circumstances, be considered as an endorsement of the contents by NASSCOM in any manner; and if you chose to access these articles/blogs , you do so at your own risk.

Apurva Singh

Senior Policy Associate

Write to me for all things related to FinTech, Drones, Data and Gaming

Call for Inputs: TEC’s Draft Standa...

moncourt.ananya831