Data localisation: Payments firms that failed to comply with RBI norms being monitored, may escape penalty

Around 15 major data and payments service providers that have failed to meet Reserve Bank of India's (RBI's) data localisation norms, will be closely monitored over the next few months by the central bank. However, the service providers that include Mastercard and Visa, may not attract a penalty or restriction of business operations for now.

"Most companies have adhered to the deadline and the rest of the companies have made significant progress. It is a matter of time - in a few days or months' time – the norms will be dealt with...A penalty or any restriction is not being looked at as of now," a source told Moneycontrol.

The 15-odd firms are at various stages of implementing the RBI directive, and the central bank will meet with the individual companies over the next few days to know about their progress.

All payments service providers were given until October 15 to ensure transaction data of Indian citizens is stored locally and not abroad. Almost 80 percent of industry players including Amazon, Alibaba and WhatsApp have reportedly complied with the data storage norms.

"The regulator will look at the reasons and rationale on why the companies have not adhered to it. An action will be taken only after that, depending on the severity and nature of the violation…These companies have made significant progress and RBI is taking updates every 15 days," sources said.

A former RBI official said, some companies will require special proprietary hardware and may need more time to indent, acquire and import the same.

"Time is also required to make changes in the  software disassociate or de-merge the data or Balkanise data to meet India's requirements. Overall, there will be a financial impact, but surely not earth shaking for these large companies. The audit report needs to be submitted in December and that time can be used to manage the strategy for the road ahead," the source added.

Emails sent to RBI and Mastercard remained unanswered. Visa, on the other hand, declined to comment saying that the company would come up with a statement on the issue at a later stage.

In April, RBI had given global payments companies operating in India six months time to localise Indian customers data.

"While it is not possible to guess the forthcoming action of the regulator, it surely could involve financial penalties or imposition of restrictions on further growth of business (i.e. no additional consumers or merchants or a freeze on level of transactions in volume and value)…In any case, the data on soil concept is not unique to India and has been faced by these international players in other jurisdictions also," the RBI official said.

Industry bodies representing US firms, such as the US India Business Council and the US India Strategic Partnership Forum have written to the finance minister to lobby against data localisation. However, the government refused to budge and stuck to the deadline issued by RBI.

A week ago, in a closed-door meeting between RBI Deputy Governor BP Kanungo, top foreign data companies and other stakeholders, the banking regulator rapped foreign firms and their representative bodies for trying to take a diplomatic route, another source aware of the discussions told Moneycontrol.

According to sources, apart from representatives from Visa, Mastercard, American Express, Amazon, Western Union, Discover, and MoneyGram, think tank iSPIRT (Indian Software Products Industry Round Table) was present at the meeting.

Some companies have sought more time from RBI stating that their fraud detection and other data processing systems were distributed on machines across the world, and that it could would take some time before it is redesigned to work in India alone. As an alternative, they offered to store copies of data of Indian citizens or data mirroring in the country for easy access by regulators, tax authorities and law enforcement.

Essentially, this means maintaining an identical copy of all the data stored in India, which is otherwise stored on a server in another country.

Nehaa Chaudhari, Public Policy Lead, Ikigai Law said, "Mirroring data will work or not work depending on the problem you are trying to solve. The circular doesn't make the problem very clear… If it is a question of data access (by RBI or authorities), then mirroring works. If it is just about supervision then also mirroring should be enough. So the demand of keeping financial data only in India also doesn’t make sense…It is not clear what unfettered access in the RBI circular means."

Nonetheless, the former RBI official quoted above said that the regulator should be the only entity to be approached for any suggestion and not the government.

Kiran Shetty, CEO of SWIFT India, which was one of early companies to set up a data centre in India said, "Every regulator has a reason for requesting an architecture and am sure there are legitimate requirement if they need it. I think from the business point of view, the operating model and cost structures don't change.

"As for competition, it is always constructive and the players are willing to accept because there is value in India and the level-playing field is something that is bringing companies here," Shetty added.