RBI temporarily permits merchants and payment aggregators to save customer card data

Share

Tweet

Share

Share

Email

Comments

The Reserve Bank of India (RBI) has relaxed card-on-file data storage norms of guest transactions checkout. Apart from the card issuer and the card network, the merchant or its payment aggregator involved in the settlement of the transactions can save the data for a maximum of T+4 days (Transaction+4 days) or till the settlement date, whichever is earlier.

And, the acquiring banks have been permitted to store card-on-file data till January 2023 to handle other post-transactional activities.

Last month, the RBI extended the deadline for card-on-file tokenisation by three months to September 30 as transaction processing based on these tokens was yet to gain traction across all categories of merchants. While the initial deadline was January 1, 2022, it was extended for another six months till July 1, 2022 and then for another three months.

The RBI had said the extended time should be utilised by the industry for facilitating all stakeholders to be ready for handling tokenised transactions and to implement an alternate mechanism to handle all post-transaction activities (including chargeback handling and settlement) related to guest checkout transactions, that involve/require storage of CoF data by entities other than card issuers and card networks. The regulator also asked the payment companies to create public awareness about the process of creating tokens and using them to conduct transactions.

What is Tokenisation?
Tokenisation is the replacement of an actual or clear card number with an alternative code called a “token”. A tokenised card transaction is considered secure as the actual card details are not shared with the merchant during transaction processing. This will reduce the chances of leaking card information.

What is guest checkout transaction?
Guest checkout transactions are those where the cardholder decide to manually enter the card details at the time of undertaking the transaction. They just have to enter the 16 digit number and do the transaction. This will be a non-tokenized transaction. The complexity of the situation on the back end means that a proper technical solution will take time, and the industry informed the central bank.