Tokenization: Why the RBI has given more time for tokenization

What is the News?

Reserve Bank of India(RBI) had issued guidelines banning the storage of customer card numbers by online merchants and payment aggregators and introducing the concept of Tokenization. These guidelines were scheduled to come into effect on 1 January but have now been postponed to 1st July 2022.

How are the transactions processed today?

There are four-five players involved in processing one card transaction —the merchant, the payment aggregator, the issuing bank and the card network. 

Currently, when a transaction happens on a merchant platform, the data is sent to the payment aggregator (PA). The PA next sends the details to either the issuing bank or the card network. 

Then the issuing bank sends an OTP and the transaction flows back. The number on which the transaction is built is the card-on-file(CoF). 

What do the new guidelines aim to bring?

RBI wants to ensure that consumers are protected from fraud. It, therefore, came up with the concept of ‘tokenization’—a process of replacing actual card details with a unique alternate code called the token.

In this method, CoF will be replaced with a token. But for this, an end-to-end rewiring of the processing leg is required.

What business models can get impacted by Tokenization?

E-mandates (recurring payments) will stand ineffective from 1 July. 

Card EMIs account for 25% of online e-commerce sales. That option will no longer be available. 

Cashbacks/discount offers by banks will be impacted too. 

A user may not be able to use the saved card detail on a merchant platform to make a transaction. S/he will have to enter the card details every time a transaction is made.

Source: This post is based on the article ‘Why the RBI has given more time for tokenization’ published in Livemint on 24th Dec 2021.