Payment players, merchants seek further extension as they are not ready yet
Even as banks, payment companies and merchants are working on implementing the Reserve Bank of India’s card tokenisation, a smooth transition is unlikely as many merchants may not be able to meet the January 1 deadline.
According to industry experts and players, merchants may require more time for tech integration. “Some issuing banks are still not ready but the large banks and companies, including Mastercard, Visa and NPCI, are prepared and integration is being done with the major merchants. However, we are already in December and merchants might need some more time for a smoother rollout. Merchants will need express permission from customers to tokenise the card data and all this requires time. Payments Council of India (PCI) is in the process of sending feedback to the RBI on the current position of its members,” said Vishwas Patel, Chairman, PCI and Executive Director, Infibeam Avenues Limited.
The RBI has asked payment aggregators and the merchants onboarded by them not to store actual credit card data. Starting January 1, 2022, no entity in the card transaction or payment chain, other than the card issuers and/or card networks, shall store the actual card data. Instead, cardholders can get digital tokens to complete their online transactions. This is being done to prevent fraud.
Concerns about readiness
The Alliance of Digital India Foundation, which had in August asked the RBI to extend the compliance deadline, is planning to send another recommendation.
“We, at ADIF, have concerns about readiness. These norms require an ecosystem-wide change in tech systems and workflows. The policy change affects three major players: banks, intermediary payment systems and merchants. In the scenario that banks are lax on preparedness, the brunt of that will be borne by merchants in the form of loss of revenue — we are looking at revenue losses of anywhere between 20 per cent and 40 per cent at the minimum should that be the case,” it said. It pointed out that only after banks and card networks are ready and APIs are made available can merchants even be able to take effective measures on their part to switch or comply.
Major banks, including HDFC Bank, ICICI Bank, HSBC India, and players such as SBI Cards, NPCI, Visa, Mastercard are prepared. Paytm, PhonePe, Worldline, Razorpay, Cashfree and PayU too have announced their tokenisation solutions. RBI is unlikelt to extend the deadline further.