RBI Extends Deadline to Comply With Card Tokenisation Norms Till September 30

RBI's purpose of card tokenisation is to increase and improve customer safety. With tokenisation, storage of card details is limited.

By Press Trust of India | Updated: 24 June 2022 23:49 IST

RBI Extends Deadline to Comply With Card Tokenisation Norms Till September 30

RBI has extended the deadline for card tokenisation for the third time

Highlights

RBI now directed the merchants to implement its tokenisation norms
This is the third time that RBI has extended the deadline
Industry stakeholders have highlighted some issues

The Reserve Bank of India (RBI) on Friday extended the card-on-file (CoF) tokenisation deadline by three months to September 30, in view of various representations received from industry bodies. Card-on-file, or CoF, refers to card information stored by payment gateway and merchants to process future transactions. Tokenisation is the process of replacing actual card details with a unique alternate code called 'Token' — thereby enabling more secure transactions.

The RBI now directed the merchants to implement its tokenisation norms by September 30. This is the third time that the central bank has extended the deadline of its implementation.

The industry stakeholders have highlighted some issues related to the implementation of the framework in respect of guest checkout transactions, the RBI said in a statement.

[Sponsored] Samsung Galaxy S24: The Ultimate Camera Phone With Smarter On-Device AI

Also, a number of transactions processed using tokens is yet to gain traction across all categories of merchants.

"These issues are being dealt with in consultation with the stakeholders, and to avoid disruption and inconvenience to cardholders, the Reserve Bank has today announced an extension of the said timeline of June 30, by three more months, i.e., to September 30," it said.

As per the RBI mandate to enhance the security of online transactions, card details saved on the merchant website/app were to be deleted by the merchants by June 30.

RBI Allows Linking Credit Cards With UPI, to Start With RuPay

To date, about 19.5 crore tokens have been created, the statement said.

"Opting for CoFT (i.e. creating tokens) is voluntary for the cardholders. Those who do not wish to create a token can continue to transact as before by entering card details manually at the time of undertaking the transaction (commonly referred to as 'guest checkout transaction')," it noted.

The basic purpose of tokenisation is to increase and improve customer safety. With tokenisation, storage of card details is limited.

RBI Says Will Only Work Against Issues of Registered Digital Lending Apps

Currently, many entities, including merchants, involved in an online card transaction chain store card data like card number, expiry date, (Card-on-File) citing cardholder convenience and comfort for undertaking transactions in future.

While this practice does render convenience, the availability of card details with multiple entities increases the risk of card data being stolen/misused. There are instances where such data stored by merchants, have been compromised.

Given the fact that many jurisdictions do not mandate an additional factor of authentication (AFA) for authenticating card transactions, stolen data in the hands of fraudsters may result in unauthorised transactions and resultant monetary loss to cardholders. Within India as well, social engineering techniques can be employed to perpetrate frauds using such data, the statement said.

To create a token under the CoF framework, it said, the cardholder has to undergo a one-time registration process for each card at every online/e-commerce merchant's website/mobile application by entering the card details and giving consent for creating a token.

The consent is validated by way of authentication through an AFA. Thereafter, a token is created, which is specific to the card and online/e-commerce merchant. The token cannot be used for payment at any other merchant.

For future transactions performed at the same merchant website/mobile application, the cardholder can identify the card with the last four digits during the checkout process, the RBI said.

Thus, the cardholder is not required to remember or enter the token for future transactions and a card can be tokenised at any number of online or e-commerce merchants, it noted.

This extension of three months by the RBI will provide breathing space for all parties involved to comply with the tokenisation norms and it will surely help in a smoother transition, said Vishwas Patel, Executive Director, Infibeam Avenues Ltd and Chairman, Payment Council of India (PCI).

Will crypto tax hurt the industry in India? We discuss this on Orbital, the Gadgets 360 podcast. Orbital is available on Spotify, Gaana, JioSaavn, Google Podcasts, Apple Podcasts, Amazon Music and wherever you get your podcasts.

Affiliate links may be automatically generated - see our ethics statement for details.

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.