Card tokenisation: Banks gear up for new regime, yet challenges persist with small merchants

“We have to, however, be concerned about the readiness of small merchants and, more importantly, consumers,” Warrier said, adding that the lender is educating customers about the benefits of tokenisation and how to ensure their card transactions do not get declined.

Sony A, chief information officer (CIO) at South Indian Bank, said implementation of these guidelines “is taking a little longer than originally planned” as tokenisation involves various stakeholders including acquiring merchants, payment gateway operators, card networks, and issuing banks.

Sony said that from the merchant’s perspective, it would be a challenge to get their respective payment gateways certified with each card network to start processing token transactions. “However, the big payment gateways would have completed the process,” Sony added.

Already, the RBI has extended the timeline for card tokenisation implementation three times in the last one and a half years. In June, the central bank offered the payments ecosystem time till September 30 to delete all card-on-file (CoF) data but due to lack of infrastructure, potential for interruption and inconvenience to cardholders, industry stakeholders requested a postponement.

As Moneycontrol wrote in an explainer, in order for a customer to tokenise their card, while making a payment on an online merchant website or mobile app, they need to enter card details and opt for the tokenisation option.

At the backend, the merchant forwards it to the respective bank or card network like Visa, RuPay or MasterCard. A digital token unique to the customer is then generated and sent back to the merchant, who saves it. After successful generation of the token, a customer can use the saved token to make payments the next time they visit the shop.

For customers, there is no big change in the payment experience as they will be able to see the same masked card details and last four digits of their card number.

Large players’ take

Fintech companies said they are ready to embrace the tokenisation regime.

To give an example, Paytm on September 19 said it has tokenised more than 52 million cards across Visa, MasterCard, and RuPay. “We have made strong progress in supporting the RBI’s mandate on card-on-file tokenisation,” the company spokesperson said.

“Being the pioneer of digital payments in the country, we firmly believe that tokenisation is a crucial step towards making online card transactions more secure for consumers,” the spokesperson said.

Akash Sinha, co-founder, and chief executive officer at fintech Cashfree Payments, too said the company is well placed and ready to comply with tokenisation norms before the RBI’s September 30 deadline.

“As per our findings, the number of merchants who have integrated tokenisation has increased significantly, across industries,” Sinha said.

“Earlier this year, we were among the first few tokenisation solution providers to introduce the interoperability feature across payment gateways… Innovative features like these have added to the appreciative response of our merchants to our token vault solution,” he added.

Sinha said the overall outlook regarding the industry’s preparedness for tokenisation seems positive. Merchants, especially those operating on a larger scale, have shown particular readiness in this respect, which can be attributed to the approaching festive season.

Challenges galore

Bankers said that the role of a financial institution like a bank in tokenisation is limited to the acceptance of CoF transactions. Any change of this nature is likely to cause some disruptions in the ecosystem, they added.

“The readiness of each and every player is important as the whole process is so interconnected and sequential that even if one entity involved in the transaction fails to implement it, the transaction cannot effectively happen,” Warrier of Federal Bank said.

“Since this is an industrywide initiative, all players are working hand-in-hand to ensure that customers face minimal disruption. Having said that, it is expected that initially, success rates for transactions will be low,” Warrier added.

Regulatory impact

The RBI’s Master Directions issued in April on the issuance of cards has also led to a fall in the overall number of outstanding credit cards in the country, said Sanjay Agarwal, senior director at rating agency CareEdge.

As per the RBI’s diktat, if a credit card has not been used for more than one year, the lender should start the process to close the card after intimating the cardholder. If no reply is received from the cardholder within 30 days, the card account is to be closed by the card issuer, subject to payment of all dues by the cardholder.

As per the latest RBI data, the total number of outstanding credit cards stood at nearly 7.8 crore in August, sharply lower than over 8 crore cards that were outstanding in July.

Further, even as the RBI’s Master Directions on card issuance allowed non-banking financial companies (NBFCs) to issue a pure-play NBFC credit card, no large non-bank lender in India including Bajaj Finance, Mahindra Finance and Shriram Transport Finance, among others, has issued their own cards, as Moneycontrol reported earlier.

As per a CNBC-TV 18 report, even if NBFCs start applying for a licence to issue their own credit cards, the RBI is likely to reject the request.