RBI extends card tokenisation deadline to June 30, 2022

Representative image

The Reserve Bank of India (RBI) on December 23 extended the deadline for card tokenisation till June 30, 2022.

"The timeline for storing of CoF data is extended by six months, i.e., till June 30, 2022; post this, such data shall be purged," the central bank said in its circular, directed to all payment system operators.

In addition to tokenisation, industry stakeholders may devise alternate mechanisms to" handle any use case (including recurring e-mandates, EMI option, etc.) or post-transaction activity (including chargeback handling, dispute resolution, reward / loyalty programme, etc.)" that currently requires storing card data (CoF) by entities other than card issuers and card networks, the RBI further noted.

The earlier deadline set by the Reserve Bank was set to expire on December 31, 2021. Moneycontrol had reported on December 21 that the banking sector regulator is likely to push the deadline amid apprehensions raised by the stakeholders.

Earlier, the industry lobby of banks, Indian Banks Association (IBA), had made representation to the RBI for an extension of the tokenisation deadline. That apart, some banks too had approached the regulator seeking an extension.

“Banks are prepared but the problem is with other stakeholders, mainly small and mid-sized merchants,” a source familiar to the development had told Moneycontrol.

Tokenisation refers to the replacement of credit and debit card details with an alternate code called a “token”. A token is unique for each card, token requestor and device. The token requestor is the entity that accepts a request from a customer for tokenisation of a card and passes the request on to the card network for the issue of a corresponding token.

A tokenised card transaction is considered safer as the card details are not shared with the merchant during transaction processing. The cardholder can get the card tokenised by initiating a request on the app provided by the token requestor.

The token requestor will forward the request to the card network, which, with the consent of the card issuer, will issue a token corresponding with the combination of the card, the token requestor, and the device.

Earlier, the RBI had asked banks to check the level of preparedness at the entity level. The central bank has reached out to banks in recent weeks to ensure the transition is smooth, according to people familiar with the development.

“The RBI wants banks to ensure the banking system is prepared for the new rules. The regulator is in touch with most banks on this subject,” said a senior official at a private sector bank, on condition of anonymity.

While banks were confident of meeting the new norms along with payment networks, merchants were not ready. During consultations with the RBI, banks warned the regulator of potential chaos as small merchants need more time for the big shift.