RBI Tokenisation Deadline: The Reserve Bank of India has announced that its new guidelines on storing credit card data will come into effect from July 1 instead of the earlier date of January 1, 2022. The central bank made the announcement a day back through an official notification. It said that the decision was taken after requests from industry stakeholders to allow extension in the plan. The industry bodies had asked the Reserve Bank of India to extend the deadline from December 31 to a later date citing various challenges in implementing the new rule under which merchants will not be able to store credit card or debit card information of customers.
The RBI had previously announced the rule on March 17, 2020, wherein it asked merchants to put in their views on making a new payment system for the safety of cardholders in India. On December 23, the Reserve Bank of India issued a new notification on tokenisation.
“In terms of our circular DPSS.CO.PD.No.1810/02.14.008/2019-20 dated March 17, 2020 on “Guidelines on Regulation of Payment Aggregators and Payment Gateways”, the authorised non-bank payment aggregators and merchants on-boarded by them were prohibited from storing card data (CoF) from June 30, 2021. At the request of industry stakeholders, this timeline was extended to December 31, 2021,” said the bank,
“In light of various representations received in this regard, we advise the timeline for storing of CoF data is extended by six months, i.e., till June 30, 2022; post this, such data shall be purged,” added the RBI.
The Reserve Bank of India has asked every merchant and payment gateway to delete all sensitive customer data available on their end in order to make payments more secure. Merchants have to use encrypted tokens for transactions.
In a notice issued in September this year, the RBI said, “With effect from January 1, 2022, no entity in the card transaction / payment chain, other than the card issuers and / or card networks, shall store the actual card data. Any such data stored previously shall be purged.”
“For transaction tracking and / or reconciliation purposes, entities can store limited data – last four digits of actual card number and card issuer’s name – in compliance with the applicable standards,” it added.
However, just before the previous deadline, the Merchant Payments Alliance of India (MPAI) and the Alliance of Digital India Foundation (ADIF) on Wednesday urged the RBI to extend the card-on-file (CoF) tokenisation deadline.
Citing several operational challenges that will hinder the transition to the token-based payments ecosystem, the industry bodies voiced their concerns over industry readiness on the RBI directive on card-on-file tokenization.
MPAI and ADIF said that ‘ecosystem readiness’ is a sequential process of going live with stable API (application programming interface) documentation for tokenised transactions.
The digital payments ecosystem is a long way from consumer-ready solutions and unless regulated entities are compliant, merchants will not be able to successfully process tokenised transactions, they said in the joint letter.
Under the new rule, when you start purchase of an item with a merchant, the merchant will initiate tokenisation. It will ask for your consent to tokenise your card. Once you give consent, the merchant will send a tokenisation request to the card network. The card network will then create a token, which will act as a proxy to your 16-digit card number, and send it back to the merchant. The merchant will save this token for future transactions. You will also have to enter your CVV and OTP like before to approve transaction. If you want to use another card, the same process is to be followed again.
(With inputs from IANS)
Read all the Latest Business News here
Comments
0 comment