The Reserve Bank of India (RBI) on Thursday extended the card tokenisation deadline by six months to June 30, 2022 following requests from several stakeholders who feared that the rules would hurt small merchants.
Tokenisation is a process by which card details are replaced by a unique code or token, generated by an algorithm, allowing online purchases to go through without exposing card details, in a bid to improve data security.
The RBI had ordered all companies in India to purge saved credit and debit card data from their systems from January 1, 2022.
In a circular issued on Thursday, the central bank said that in the “light of various representations received... the timeline for storing of card on file (CoF) data is extended by six months, i.e., till June 30’’, after which the data will have to be purged.
The RBI added that in addition to tokenisation, industry stakeholders may devise alternate mechanisms to handle any use case which includes recurring e-mandates, EMI option or post-transaction activity (like dispute resolution or reward/loyalty programme) that requires storage of the CoF data by entities other than card issuers and card networks.
On Wednesday, the Merchants Payments Alliance of India and Alliance of Digital India Foundation while pointing out to several operational challenges, said the entire industry was not yet ready. They had also added that if implemented from January 1, 2022 there could be revenue losses of anywhere between 20 per cent and 40 per cent.
Sijo Kuruvilla George, executive director of ADIF, pointed out that merchants will lose out in this process
for no fault of theirs and they cannot create tokenisation infrastructure under the RBI rules.
According to CII, India has an estimated 98.5 crore cards, which are used for about 1.5 crore daily transactions worth Rs 4,000 crore. as per the RBI annual report for 2020-21, the value of the Indian digital payments industry during the year was Rs 14,14,85,173 crore.
