In a first for India, Visa introduces CoF Tokenisation on Grofers, BigBasket and MakeMyTrip

Representative Image

Digital payments company Visa said on October 6 that it has launched Card-on-File (CoF) Tokenisation services in India in line with the recently issued RBI guidelines.

This makes Visa the first cards issuer to launch CoF Tokenisation in India ahead of the December 31 deadline for the Reserve Bank of India’s (RBI) guidelines for Payment Aggregators (PG) and Payment Gateways (PG).

The service has been launched in partnership with payment solutions provider Juspay and is now available for customers on platforms such as Grofers, BigBasket, and MakeMyTrip, Visa said.

This comes after the RBI extended the tokenisation framework to CoF tokenisation, permitting card issuers to offer these services as Token Service Providers (TSPs) on September 7.

TR Ramachandran, Group Country Manager for India and South Asia at Visa said, “The RBI’s move to allow CoF tokenisation for e-commerce payments will revolutionise digital payments across India’s e-commerce platforms. Having launched CoF tokenisation services in over 130 countries globally, we are confident of the technology’s ability to build a safe, secure and seamless environment for digital payments.”

“This will be critical in building consumer trust on merchant platforms and reassure them of the safety of their payment credentials on these platforms. We have enabled all our banking partners for tokenisation and continue to work closely with merchants, payment aggregators and gateways to ready the ecosystem for CoF tokenization rollout,” he added.

Why CoF tokenisation is important?

According to the central bank, Tokenisation refers to the replacement of actual card details with an alternate code called the “token”, which shall be unique for a combination of card, token requestor (i.e. the entity which accepts requests from the customer for tokenisation of a card and passes it on to the card network to issue a corresponding token) and device.

With an aim of granting further protection to customers from incidents of fraud and making card-based payments more secure, the RBI released guidelines for PAs and PGs in March 2020. As per the guidelines, PAs and merchants shall not store card credentials of customers in their database starting January 1, 2022.

In the lack of an alternative like CoF Tokenisation, customers who wish to use their credit or debit cards would have to enter details afresh for each transaction – including their 16-digit card number, card expiry date and card verification value (CVV).

With CoF Tokenisation, actual card data will be replaced with encrypted digital tokens, which will then be used to facilitate and authenticate transactions.

Visa said, “This devaluation of sensitive card details alleviates risk and reduces the vulnerability of sensitive data, as only tokens are present in transit, across the ‘in-rest’ and ‘in-use’ phases. These new guidelines are expected to enhance consumer trust in e-commerce payments, ensure seamless transaction experience as well allow card issuers the comfort of authorizing a higher number of transactions.”