Tokenisation: Startups, digital platforms seek six months extension from RBI

Digital platforms and startups fear 20 to 40% loss in revenue if transactions fail

Association bodies of startups and leading digital platforms have written to the Reserve Bank of India (RBI) seeking an extension of at least six months from the December 31, 2021 deadline for the tokenisation of credit and debit cards.

Members of the Merchant Payments Alliance of India (MPAI) include large digital platforms like Netflix, Disney Hotstar, Spotify, Zoom, Microsoft, Policybazaar among others. The Alliance of Digital India Foundation (ADIF) is a think tank for India’s digital start-ups and has 470 members.

Tokenisation refers to the replacement of credit and debit card details with an alternate code called a 'token'. RBI's guidelines for payment gateways (PGs) and payment aggregators (PAs) state that PAs and merchants shall not store card credentials of customers in their database starting January 1, 2022.

In the absence of an alternative such as Card on File Tokenisation, customers who wish to use their credit or debit cards will have to enter their details afresh for each transaction, including their 16-digit card number, card expiry date and card verification value (CVV).

The two bodies have also sought a phased implementation of the new mandate as well as the generation of consumer awareness about the impact of the policy change. They have highlighted in their letter to the RBI that regulated entities are not prepared, in the absence of a hard mandate to comply.

Sijo Kuruvilla George, Executive Director, Alliance of Digital India Foundation said, "In the scenario that banks are lax on preparedness, the brunt of that will be borne by merchants in the form of loss of revenue – we are looking at revenues losses of anywhere between 20 to 40 percent at the minimum should that be the case."

Moneycontrol had reported on December 21 that banks on the other hand are worried that many smaller merchants are yet to integrate the tokenisation framework and last-mile integration is incomplete.

According to bankers quoted in Moneycontrol's previous reports, 2022 will start on a chaotic note for the payments ecosystem as well as for customers if the guidelines are implemented now.

"Both banks and networks are almost prepared but merchants are not," a banker had said on the condition of anonymity.

George however added, "It is important to note that it’s only after the readiness of bank, card networks and Application Programming Interface (APIs) are made available that merchants are able to take effective measures on their part to comply."

A statement by ADIF and MPAI said that their letter to the RBI read, "Merchants cannot start the testing and certification of their payment processing systems until banks, card networks, and PA/PGs are certified and live with stable APIs for consumer-ready solution."

A tokenised card transaction is considered safer as the card details are not shared with the merchant during transaction processing. The cardholder can get the card tokenised by initiating a request on the app provided by the token requestor.

But, ADIF and MPAI are concerned that in case of under-preparedness, customers will be left to punch in their card details for every transaction making it unviable and unsafe.

Vishal Mehta, Chair of the Governing Council of the MPAI said, "This unpreparedness will impact recent digital payments adopters even deeply. The frequency and intensity of phishing attempts will go up as entire card details are to be entered for each transaction, causing a significant increase in irreversible fraudulent transactions."

One of the key concerns is that customers too are yet to understand how tokenisation works and what is expected of them. However, Moneycontrol has learned from sources that the regulator is already mulling an extension of three to four months so that the ecosystem can be better prepared.

A final and official decision from the RBI is awaited. RBI has already extended the deadline once from March 31, 2021 to December.