Why RBI gave more time for tokenization?

What’s all the fuss about tokens?

India’s central bank wants to ensure that consumers are protected from fraud. Hence it came up with the concept of ‘tokenization’ – the process of replacing the actual card details with a unique alternative code called a token. RBI has made card-on-file (COF) tokenization mandatory with effect from July 1, 2022. COF refers to the card information saved by payment gateways and merchants to complete future purchases. Going forward, only the card network and card issuing banks will have access to and store any card data. The first circular came in January 2019, but it was amended and the deadline was extended.

How are transactions processed today?

Today four to five players are involved in processing a card transaction – the merchant, the payment aggregator, the issuing bank and the card network. Currently, when a transaction takes place on a merchant platform, the data is sent to the Payment Aggregator (PA). The PA then sends the details to the issuing bank or card network. Then the issuing bank sends an OTP and the transaction flows back. The number on which the transaction is done is CoF. Now, since CoF will be replaced with tokens, end-to-end rewiring of the processing leg is needed.

Is the industry ready to implement it?

Not completely, which is why RBI had to extend the deadline. The industry can currently convert CoF to a token number. However, the preparation to process the token is negligible. About 90% of banks are ready to provision tokens on Visa. Only 25-30% banks are ready on MasterCard. Amex and Diner’s Club are not yet ready with solutions for India.

Which business models can be affected?

If the industry is not ready, many business models will be affected. The e-mandate (recurring payment) will become ineffective from July 1. Card EMI accounts for 25 per cent of online e-commerce sales. That option will no longer be available. Cashback/discount offers of banks will also be affected. A user may not be able to use a MasterCard saved card on a merchant platform to make a transaction, and will have to enter the card details every time a transaction is made. It may be the same for some Visa cards.

What is the way forward?

The integration of the system and the ability to process is a part. The industry also needs to test the performance and success rate of tokenized solutions. Hence the stakeholders had made several representations to the RBI seeking extension of the time limit. Even the banks wanted the deadline to be extended – they understood that the new system was a huge disruption in the process of digital payments. RBI on its part realized how little prepared the industry was.