RBI's tokenisation deadline from December 31: All you need to know

Under the new RBI rules, online merchants will not be able to store the card information of users and will have to replace each card number with a randomised token number by December 31.

India's leading digital payments platform PhonePe has already announced that its SafeCard tokenisation solution for online businesses enables their end customers to experience the convenience of saved card transactions with added security. PayU, Razorpay, Visa among others have also launched tokenisation solutions in compliance with the RBI guidelines.

What do the new guidelines say?

The Reserve Bank of India (RBI) in September prohibited merchants from storing customer card details on their servers with effect from January 1, 2022, and mandated the adoption of CoF tokenization as an alternative to card storage.

Also Read | Industry bodies urge RBI to extend card tokenisation deadline

Under the rules, sensitive customer information is to be stored in the form of an encrypted 'token' to help secure transactions. These tokens then allow payments to be processed without disclosing the customer details or allowing the payment intermediaries to store customer data that could breach security and privacy.

Earlier, the central bank had also extended the scope of 'tokenisation' card payment services to several consumer devices including laptops, desktops, wearables like wristwatches, bands and Internet of Things (IoT), in addition to mobile phones and tablets.

Citing the convenience and comfort factor for users while undertaking card transactions online, the RBI had said that many entities involved in the card payment transaction chain store actual card details and some merchants force their customers for storing card details. In the recent past, there were incidents where card data stored by some merchants have been compromised/leaked. Availability of such details with a large number of merchants substantially increases the risk of card data being stolen, it added.

The RBI in March 2020 had stipulated that authorised payment aggregators and the merchants onboarded by them should not store actual card data with a view to minimising vulnerable points in the system. On a request from the industry, it had extended the deadline to end-December 2021 as a one-time measure.

Industry bodies urge RBI to extend the deadline

Citing several operational challenges that will hinder the transition to the token-based payments ecosystem, the industry bodies voiced their concerns over industry readiness on the RBI directive on card-on-file tokenization. The Merchant Payments Alliance of India (MPAI) and the Alliance of Digital India Foundation (ADIF) have urged the central bank to extend the tokenisation deadline of December 31 for merchants.

Also read: RBI issues corrective action for shadow banks

The industry bodies also said that if implemented in the present state of readiness, the new RBI mandate could cause major disruptions and loss of revenue, especially for merchants.

Online merchants likely to lose up to 40% of revenues

India has an estimated 98.5 crore cards, which are used for about 1.5 crore daily transactions worth Rs 4,000 crore.

Industry body Confederation of Indian Industry (CII) said online merchants can lose up to 20-40 per cent of their revenues after December 31. "And for many of them, especially smaller ones, this would sound the death knell, causing them to shut shop," it added.

For a tokenisation solution to be consumer-ready (i.e. for consumers to be able to complete transactions successfully using tokens instead of their card information), the solution should have completed three steps, it said. The steps include token provisioning and token processing and scale-up for multiple use cases.

(With agency inputs)

Watch the latest DH Videos here: