4:09 PM
Blogger
12:09 PM
Blogger
7:11 AM
Blogger
By Shashank Didmishe
The Reserve Bank of India (RBI) on Friday extended the deadline for merchants to delete the card storage data of their customers under the card-on-file tokenisation system by three months till September 30. This is the third time the central bank has extended the timeline for mandatory card tokenisation.
The RBI first extended the deadline by six months from June 30, 2021, till December 30, 2021, and then by another six months till June 30.
Noting that considerable progress has been made on card tokenisation and some merchants have already initiated the use of tokens, the central bank observed that the system is yet to gain traction with all categories of merchants. Additionally, merchants are yet to install an alternate system where customers can choose to enter the card details manually, the central bank said.
“It has been decided to extend the timeline for storing of CoF (card-on-file) data by three months, till September 30, after which such data shall be purged,” the RBI said in a notification.
In 2020, the RBI had directed merchants to delete users’ card data stored on their platforms for protection of financial information of the customers. Under the tokenisation system merchants will not be allowed to store the card details such as the 16-digit number, expiry dates and CVV, but will instead generate a token through which the transaction will take place.
Several industry players had voiced concerns on the skewed preparedness of the merchants for implementing tokenisation. While larger e-commerce platforms and companies have already begun the shift to generating tokens, smaller merchants did not have the readiness to migrate to the new system. Additionally, concerns were also raised that tokenised transactions may not be able to match the requisite speed and complexity for card payments.
So far, 195 million tokens have been generated, RBI said in a separate notification. In comparison, the tokenised transaction ecosystem should be able to handle around 2,000 transactions per second in order for smooth processing, according to experts. Despite being in the nascent stage, the RBI has urged cardholders to opt for tokenised transactions as it will provide an additional security layer. Cardholders unwilling to use tokens have the option of entering their card details manually.
“Stolen data in the hands of fraudsters may result in unauthorised transactions and resultant monetary loss to cardholders. Within India as well, social engineering techniques can be employed to perpetrate frauds using such data,” the central bank said.
The industry welcomed the RBI’s decision. Vishwas Patel, executive director, Infibeam Avenues and chairman, Payments Council of India, said that certain issues had emerged ahead of the final roll-out of the system. Solutions required to resolve the issues were being actively worked on but were to be primarily resolved by the networks, issuers and acquirers within the ecosystem, he added.
“The timeline to implement the fixes was very close to June 30, 2022 and hence the industry perceives a risk to the overall readiness for a smooth transition to the tokenisation framework. Hence this extension of three months by RBI will provide breathing space for all parties involved to comply with the tokenisation norms,” Patel said.
Meanwhile, some large merchants have already asked their customers to move to the tokenisation framework. On Friday, Amazon’s Indian arm wrote to its customers seeking their explicit consent to store their card details in a tokenised form. Earlier, the Indian operations of Uber and Zomato had reached out to their customers. Mastercard and Google Pay had tied up to offer tokenisation services and allow the app’s users to pay with their cards without having to share their credentials with a third party.
6:11 AM
Blogger
The Reserve Bank of India’s (RBI) is believed to be examining the “buy now pay later” (BNPL) services and pre-paid payment instruments (PPIs) such as wallets.
The central bank is concerned about PPIs being loaded through lines of credit, as it could result in systemic risks. New age financial players have been using lines of credit from banks and non-banking financial companies (NBFCs) to load customers’ wallets. The central bank appears to be apprehensive adequate due diligence may not be taking place while the PPIs are being loaded.
The RBI, they stressed, encourages innovation but it shouldn’t be based on regulatory arbitrage.
Persons, familiar with the matter, point out the RBI is not opposed to PPIs being loaded by debit card, cash, debits from banking accounts, as it believes that to offer a line of credit, the entity needs to have a licence. As Fintechs do not have the licence to lend, the central bank believes, they are not operating within the legal framework. The persons also said that there are some concerns on data security and privacy because the ownership of the customer is not always clear.
Earlier this week, the central bank came out with a circular barring non-bank institutions or fintech companies from loading credit lines onto PPIs, warning them of heavy penalty if they continue to offer such services. The move came after some fintech firms started using credit lines from banks or NBFCs to load the wallets of consumers.
The directive is expected to hit the business models of a growing number of fintech firms, including Slice, PayU’s LazyPay and KreditBee.
Sources said the central bank believes that the financial entities that mimic banks (by undertaking certain core functions of banks like credit disbursement) but are not subject to similar stringent norms and licensing requirement can’t be permitted to do so. This is because if they are allowed to resort to such practices, they will most likely threaten the health of the broader banking system and, at the same time, undermine the customer protection mechanism. Against this backdrop, the RBI is learnt to be examining such products.
Meanwhile, sources said some of the industry players are approaching the RBI to offer them up to a year, through some kind of a sunset clause, to stop these schemes that have become popular, especially after the Covid outbreak.
As reported by FE, the fintech lending industry is likely to request the RBI to apply a one-year grandfathering clause to its new circular barring the loading of wallets with credit lines. The relaxation, if permitted, would allow lenders who have prepaid card-based outstandings to smoothly migrate their existing customers to a different mode of credit issuance. Digital Lenders Association of India and Fintech Association for Consumer Empowerment are holding discussions with their members about the communications to be sent to the RBI.
1:11 AM
Blogger
Most of the large merchants have implemented the Reserve Bank of India (RBI’s) card-on-file tokenisation norms, sources familiar with the matter said.
The RBI on Friday extended the deadline for merchants to delete the card storage data of their customers under the card-on-file tokenisation system by three months till September 30.
As many as 195 million tokens have been issued so far and the number is going up fast, they said, adding that the system is already well-prepared to adopt the new mechanism.
Card-on-file typically refers to card information stored by payment gateway and merchants to process future transactions. To curb frauds, the central bank had directed all merchants and payment gateways to remove sensitive details of the credit and debit cards of customers that are saved at their end, and comply with its tokenisation norms by June 30, 2022.
Tokenisation usually refers to the replacement of actual credit and debit card details with an alternate code called the ‘token’. This will be unique to a particular combination of card, token user and device. The ‘token’ can be used in place of an actual card number for online purchases. This is expected to make online transactions a lot safer for customers.
However, the tokenisation of card data will have to be done only with customers’ consent, which requires an additional factor of authentication by them.
In September last year, the central bank had barred merchants from storing customer card details on their servers from January 1, 2022. It had then mandated the adoption of the card-on-file tokenisation as an alternative to card storage. Subsequently, the central bank granted a six-month extension of the deadline to comply with the order.
RSS Feed
Twitter
