Context: Recently, Reserve Bank of India (RBI) has decided to restrict the implementation of tokenization of debit and credit cards for online transactions by a further six months following representations from stakeholders.
Key decision

• RBI has also extended tokenization of Card-on-File (CoF) transactions where card details are saved by merchants — and directed the merchants not to store card details in their systems from January 1, 2022.
• A CoF transaction is one in which a cardholder has authorized a merchant to store his or her Mastercard or Visa payment details, and to bill the stored account.
• E-commerce companies and airlines and supermarket chains often store card details.

About Tokenisation

• It refers to replacement of actual credit and debit card details with an alternate code called the “token”, which will be unique for a combination of card, token requestor and device.
• A tokenised card transaction is considered safer as the actual card details are not shared with the merchant during transaction processing.
• Customers who do not have the tokenisation facility will have to key in their name, 16-digit card number, expiry date and CVV each time they order something online.

Benefits of Tokenization

• Transaction safety: Tokenization reduces the chances of fraud arising from sharing card details.
• Easy payments: The token is used to perform contactless card transactions at point-of-sale (PoS) terminals and QR code payments.
• Data storage: Only card networks and card-issuing banks will have access to and can store any card data.

How are the transactions currently processed?

• There are many players involved in processing one card transaction today like: Merchant; Payment aggregator; Issuing bank; Card network
• When a transaction happens on a merchant platform, the data is sent to the payment aggregator (PA).
• The PA next sends the details to either the issuing bank or the card network.
• Then issuing bank sends an OTP and the transaction flows back.

Key Impact of current decision
Is the industry ready to implement this?

• Not fully, that is why the RBI had to extend the deadline.
• The industry currently can convert CoF into a tokenized number. However, the readiness to process the token is negligible.
• About 90% of banks are ready with provisioning of token on Visa. Only 25-30% banks are ready on Mastercard.

On businesses

• If the industry isn’t ready, several business models would be impacted.
• E-mandates (recurring payments) will stand ineffective from 1 July.
• Card EMIs account for 25% of online e-commerce sales. That option will no longer be available.
• Cashbacks/discount offers by banks will be impacted, too.
• A user may not be able to use Mastercard saved cards on a merchant platform to make a transaction and will have to enter the card details every time a transaction is made.
• This could be the same for some Visa cards.

Key Suggestion

• The new system is a much bigger disruption to the way digital payments will henceforth be processed.
• Integration of systems and the ability to process is one part.
• The industry also needs to test the performance and success rate of the tokenization solution.

In addition to tokenisation, industry stakeholders may devise alternate mechanisms to handle any use case, including recurring e-mandates and EMI option or post-transaction activity, including chargeback handling, dispute resolution, reward or loyalty programme, that currently involves storage of CoF data by entities other than card issuers and card networks.