Context: Recently, Reserve Bank of India (RBI) has directed that no entity or merchant, other than card issuers and card networks, should store card details — or card-on-file (CoF) — from January 1, 2022.

• RBI allowed for tokenisation of cards while making payments, which can reduce the risk of card data being stolen.

Key Points of the recent notice

• RBI has extended tokenisation of CoF by card issuers.
• With effect from January 1, 2022, no entity in the card transaction or payment chain, other than the card issuers and card networks, should store the actual card data. Any such data stored previously will be purged.
• The Reserve Bank has permitted card issuers to offer card tokenisation services as token service providers (TSPs). 
• The facility of tokenisation will be offered by the TSPs only for the cards issued by or affiliated to them.

About Tokenisation

• Tokenisation refers to replacement of actual card details with an alternate code called the “token”.
• It will be unique for a combination of card, token requestor and device. 

Benefits

• It reduces the frauds that occur by sharing card details like card number and CVV. 

Usage

• The token is used to perform contactless card transactions at point-of-sale (PoS) terminals and QR code payments.
• The RBI has also extended tokenisation of Card-on-File (CoF) transactions

Working

• The cardholder can get the card tokenised by initiating a request on the app provided by the token requestor. 
• The token requestor will forward the request to the card network which, with the consent of the card issuer, will issue a token corresponding to the combination of the card, the token requestor, and the device. 
• Tokenisation has been allowed through mobile phones or tablets for all use cases and channels like contactless card transactions, payments through QR codes and apps.
• The tokens are generated by companies like Visa and MasterCard, which act like Token Service Providers (TSPs).
• They provide the tokens to mobile payment or e-commerce platforms so that they can be used during transactions instead of the customer’s credit card details.
• When users enter their card details into a virtual wallet like Google Pay or PhonePe, these platforms ask one of these TSPs for a token. 
• The TSPs will first request verification of the data from the customer’s bank. 
• When the data has been verified, a code is generated and sent to the user’s device. 
• Once the unique token has been generated, it remains irreversibly linked to the customer’s device and cannot be replaced. 
• Thus, each time a customer uses his or her device to make a payment, the platform will be able to authorise the transaction by simply sharing the token, without having to reveal the customer’s true data. 
• Tokens can be generated to safeguard payments in mobile wallets and physical or online stores like Amazon. 

Who can Tokenise cards?

• The RBI has permitted card issuers to act as TSPs, which will offer tokenisation services only for cards issued by or affiliated to them. 
• The ability to tokenise and de-tokenise card data will be with the same TSP. 
• Tokenisation of card data will be done with explicit customer consent requiring Additional Factor of Authentication (AFA) validation by the card issuer.
• Normally, in a tokenised card transaction, the stakeholders involved are the merchant, the merchant’s acquirer, card payment network, token requestor, issuer and customer.

Card-on-File (CoF) Transaction

• It is a transaction where a cardholder has authorised a merchant to store the cardholder’s Mastercard or Visa payment details. 
• The cardholder then authorises that same merchant to bill the cardholder’s stored Mastercard or Visa account.
• E-commerce companies and airlines and supermarket chains normally store card details in their system.

Reasons behind Tokenisation step of RBI

• Citing convenience and comfort for users while undertaking card transactions online, many entities involved in the card transactions store actual card details, which is CoF. 
• In fact, some merchants force their customers to store card details. 
• Availability of such details with a large number of merchants substantially increases the risk of card data being stolen.
• In the recent past, there have been incidents where card data stored by some merchants have been compromised or leaked. 
• Any leakage of CoF data can have serious repercussions because many jurisdictions do not require an AFA for card transactions. 
• Stolen card data can also be used to perpetrate frauds within India through social engineering techniques.