Will India Pay For RBI's Hurry?

Central bank’s no-card-storage rule can severely disrupt digital payments in 2022

- Rohit Kumar and Deepro Guha

In March 2020, the Reserve Bank of India issued guidelines that prohibit merchants (including all e-commerce websites, streaming platforms) and payment aggregators (such as Razorpay and Instamojo) from storing customer card information. The aim of this measure is to increase security of stored card details while reducing the risk of data breaches.

Globally, and even in India, there have been several instances of financial data leaks over the last few years. With digital transitions increasing manifold, the likely consequences of a data leak – both financial as well as in terms of trust – can be very real and damaging. Taking cognisance of this issue, RBI has been progressively tightening regulations to ensure financial data security while also limiting the number of actors who can store sensitive data.

The no-card-storage norms are scheduled to come into effect on January 1, 2022. But even though the first notification was issued early last year, it was only in September 2021 that a reasonably effective alternative to the current system – Card-on-file Tokenisation (CoFT) –was permitted, giving the players in the digital payments ecosystem just a little over three months to adapt.

CoFT is the process of de-identifying sensitive cardholder data by replacing the actual card details with an alternative code called the “token”, which is unique for every combination of card and merchant. While seemingly ‘simple’, this tweak requires an ecosystem-wide change in tech systems and workflows, with sequential compliance from the many entities in the digital payments transaction chain.