Banks, payment providers, and merchants are preparing for potential disruptions after the September 30 deadline as tokenization has not yet been tested with large quantities of payments.
Additionally, because of the timing of the new deadline—right in the middle of the festive season—merchants are scrambling to adopt the new payment method to prevent any disruptions and loss of sales.
Card on File Tokenisation (CoFT) replaces card details with a ‘token’ that is unique for each debit or credit card and merchant platform that uses it. This is an alternative that card networks such as Visa, Mastercard, and RuPay, as well as payment gateways, merchants, and banks, were preparing for to meet Reserve Bank of India (RBI) norms.
According to RBI’s norms, payment aggregators (PAs), payment gateways (PGs), and merchants cannot store the card credentials of customers in their databases after September 30.
The Merchant Payments Alliance of India (MPAI), whose members include digital platforms such as Netflix, Disney+ Hotstar, Spotify, Zoom, Microsoft, and Policybazaar, has written to the RBI twice in the last month, requesting that the regulator direct card networks, PAs, and PGs to demonstrate that CoFT solutions perform as well as card-based processing across use cases.
According to the latest representation sent on September 21, MPAI said that success rates with tokens in testing mode for regular transactions have increased to 70–75 percent as opposed to the previous 65–70 percent. However, this is still lower than the 85-90 percent success rates of transactions executed with card details.
Industry experts stated that although preparedness has improved over the past month and is far better than the earlier deadline of June 30, there are still concerns that problems may develop once tokenization is introduced for all card transactions. It had only been tested on a small number of transactions up until now.
Shashank Kumar, co-founder and Managing Director of payment gateway Razorpay said, “The ecosystem is ready, but the systems are not tested at scale. Whenever you start testing at scale, surely there will be issues that will come to light that we may not have seen before. So, there is going to be a period of stabilization during which there will be some loss of sales etc.”
Kumar added that the disruptions should be resolved in a few weeks. Unlike the recurring payments disruption, all stakeholders are better prepared for this shift because it affects all card transactions rather than just 2 percent of overall card transactions as in the case of recurring payments.
However, even a few weeks of disruption may be burdensome for merchants during the festive season. Failures may affect shopping sentiment with discounts on card transactions across online platforms. Customers will still be able to pay with cash or via the Unified Payment Interface (UPI).
The fear of losing out on festive season sales, on the other hand, has also pushed merchants to align faster with the norms.
“There has been significant growth in the number of merchants, across industries, that have adopted the tokenization mechanism. The overall outlook regarding the industry’s preparedness for tokenization seems positive. Merchants, especially those who operate at a larger scale, have shown particular readiness in this respect, which can be attributed to the approaching festive season,” said Akash Sinha, co-founder and CEO of Cashfree Payments.
Platforms seeking customer consent to tokenize the cards prior to the previous deadline, as well as over the course of the last few months, have also aided in speeding up the process. Online platforms have tokenised cards at scale ahead of September 30, having already received customer consent.
PhonePe recently said that it has tokenised 1.4 crore credit and debit cards, while Paytm said that 5.2 crore cards on its platform have been tokenised. Visa said in a statement that it has provisioned tokenisation of over 16 crore cards.
Recurring payments see low success rate
With a number of MPAI merchants relying on a subscription-led model, the low success rate of tokenisation for renewal mandates has been a concern.
While setting up new recurring payments mandates has a success rate of 60-65 percent, renewal approval rates on these tokens are only 35-40 percent, according to MPAI's representation to the RBI last week.
“Merchants who rely entirely on PA/PGs for payments have limited visibility on success rates. Such members are yet to be granted access to token flows developed by PA/PGs. As a result, there is ambiguity on the efficacy of token-based mandate processing solutions,” the representation said.
According to MPAI, some card networks are yet to share bank identification numbers (BINs), which are required to map mandate IDs and process recurring payments. MPAI members have not been able to test at scale for BINs shared due to clearance delays.
On June 24, RBI extended the deadline to implement CoF tokenisation by three months after a review of the issues involved and after detailed discussions with all stakeholders, it is observed that considerable progress has been made in terms of token creation.
“Those who do not wish to create a token can continue to transact as before by entering card details manually at the time of undertaking the transaction (commonly referred to as ‘guest checkout transaction’),” RBI had said.
