RBI extends card tokenisation deadline till June 30; ADIF urges RBI to ensure readiness for it across banks

The Reserve Bank of India on Thursday extended card tokenisation deadline by six months till June 30, 2022, from the earlier deadline of December 31, 2021.

"The timeline for storing of CoF (card-on-file) data is extended by six months, i.e., till June 30, 2022; post this, such data shall be purged," it said in a notification.

"In addition to tokenisation, industry stakeholders may devise alternate mechanism(s) to handle any use case or post-transaction activity that currently involves or requires storage of CoF data by entities other than card issuers and card networks."

The RBI's card tokenisation guidelines mandated replacing the actual card data with encrypted digital tokens, which are then used to facilitate and authenticate transactions.

The devaluation of sensitive card details would have alleviated risk and reduced vulnerability of sensitive data. However, industry bodies urged the RBI to extend card tokenisation deadline beyond December 31, 2021.

The Merchant Payments Alliance of India (MPAI) and the Alliance of Digital India Foundation (ADIF) had recently urged the central bank to extend the CoF tokenisation deadline of December 31 for merchants

Citing several operational challenges that will hinder the transition to the token-based payments ecosystem, the industry bodies voiced their concerns over industry readiness on the RBI directive on card-on-file tokenisation.

The MPAI and ADIF said that 'ecosystem readiness' is a sequential process of going live with stable API (application programming interface) documentation for tokenised transactions. The digital payments ecosystem is a long way from consumer-ready solutions and unless regulated entities are compliant, merchants will not be able to successfully process tokenised transactions, they said in the joint letter.

The Alliance of Digital India Foundation (ADIF) on Friday welcomed the Reserve Bank of India's (RBI) move to extend card tokenisation deadline by six months till June 30, 2022, urging the central bank to ensure readiness across all banks in a timely manner.

There were concerns across all stakeholders in the payment ecosystem around CoF (card-on-file) tokenisation readiness. Merchants were also fearing payment disruptions and revenue losses as a result.

"We also call upon the RBI to take steps to ensure readiness across all banks. Should bank readiness not come through in a timely and robust manner, we stand the risk of finding ourselves in the same predicament again in June as now," said Sijo Kuruvilla George, Executive Director, ADIF.

Unless banks are compliant, merchants will not be able to successfully process tokenised transactions and have solutions consumer ready.

The ADIF said that it is equally important that consumer education and awareness is given the required importance and not just the technical aspects related to the switch to tokenisation.

"It is only when consumers are aware of tokenization and its benefits, that they will be able to make an educated choice for opting in," the foundation said.

In a notification on Thursday, the RBI said: "The timeline for storing of CoF (card-on-file) data is extended by six months, i.e., till June 30, 2022; post this, such data shall be purged".

"In addition to tokenisation, industry stakeholders may devise alternate mechanism(s) to handle any use case or post-transaction activity that currently involves or requires storage of CoF data by entities other than card issuers and card networks."

The RBI's card tokenisation guidelines mandated replacing the actual card data with encrypted digital tokens, which are then used to facilitate and authenticate transactions.