Ecosystem largely prepared to implement tokenisation, says RBI Dy Governor T Rabi Sankar

Representative image.

Reserve Bank of India (RBI) Deputy Governor T Rabi Sankar on June 8 said that the payments ecosystem is 'by and large prepared' to implement tokenisation for card-based transactions ahead of the June 30 deadline for new norms.

Card on File Tokenisation (CoFT) – refers to the process of replacing card details with a ‘token’ that will be unique for every debit or credit card and merchant platform where it is used. The process is aimed at making card transactions more secure as card data is not stored on merchant platforms and will hence cannot be accessed through a breach for frauds.

As per RBI's new norms, payment aggregators, payment gateways and merchants can store card credentials of customers in their databases only until June 30, a deadline that has already been extended twice, most recently by six months on December 23.

In the absence of an alternative mechanism like tokenisation, customers using their credit or debit cards from July 1 will have to enter the details afresh for each transaction, including the 16-digit card number, expiry date and card verification value (CVV).

The Deputy Governor said, "With about three weeks to go, the progress has been satisfactory. Over the last several months our teams have been constantly discussing with all stakeholders to ensure that the process of tokenization is implemented smoothly. The system is by and large prepared."

Rabi Sankar added that all card networks including Visa, RuPay and Mastercard are offering tokenisation and 16 crore tokens have been created until now.

However, merchants are worried that the ecosystem is only partially prepared and if the deadline for norms are not extended then cards payments will see major disruptions and revenue losses for merchants starting July 1.

On the possibility of a timeline extension the Deputy Governor said, "I really don't think there is any need to speculate on whether or not the timeline will be extended. There are a few collateral issues that have come to our notice, which we will adjust as we go. These are new issues that crop up every time you shift a regime."

According to multiple sources, banks have not yet made any representations with either the apex banking body Indian Banks' Association (IBA), or with the RBI for another extension.

Moneycontrol had reported on May 20 that according to the Merchant Payments Alliance of India (MPAI), whose members include digital platforms such as Netflix, Disney+ Hotstar, Spotify, Zoom, Microsoft, and Policybazaar; processes that are at development or testing stage include processing of large transaction volumes on tokens and ensuring transactions are processed quickly.

There is also no clarity on the execution of guest checkouts and how merchants can implement cashbacks and rewards in the absence of card data.

Mohit Kalawatia, a member of the MPAI Secretariat had said, “Currently, e-commerce platforms execute around 900-1,000 transactions per minute. During testing with tokens, merchants have been able to process only two to eight transactions per minute.”

The success rate of those two to eight transactions was less than 1 percent, Kalawatia added.

“So, in a real-world scenario, at the current readiness, you will see only 0.05 percent of the 900-1,000 transactions going through,” he said.

Another company executive who did not wish to be identified had said that the card networks are in talks with the RBI for clarification on these fronts.

“For some of the issues, there are solutions but they all include temporary storage of card data,” the executive had said. “The card networks are yet to get a response from the RBI on these proposed solutions. What the ecosystem is worried about is that if the card networks come up with an RBI-approved solution very close to the deadline, then it will be very difficult to implement them in time.”

In response to queries by Moneycontrol, Mastercard had said that there are still some areas where the company is working with the stakeholders and hoping for quick resolution. Visa and RuPay had not responded to email queries from Moneycontrol.