Tokenisation refers to replacement of actual credit and debit card details with an alternate code called the “token”, which will be unique for a combination of card, token requestor and device.

Features and advantages

• A tokenised card transaction is considered safer as the actual card details are not shared with the merchant during transaction processing.
• Customers who do not have the tokenisation facility will have to key in their name, 16-digit card number, expiry date and CVV each time they order something online.
• This could be cumbersome exercise and may impact transaction value, especially when done through stored cards.
• In case of multiple cards, each will have to be tokenised.

Significance

• India has an estimated 100 crore debit and credit cards, which are used for about 1.5 crore daily transactions worth Rs 4000 crore.
• The value of the Indian digital payments industry in 2020-21, as per RBI’s annual report, was Rs 14,14,85,173 crore.

RBI guidelines

• In September 2021, the RBI published new guidelines. Merchants will not be permitted to keep credit card information on their servers under the new rules.
• It forbade retailers from holding consumer card information and required the use of card-on-file (CoF) tokenisation as an alternative to card storage.
• The new regulation was supposed to go into effect on January 1, 2022.
• Customers must provide complete card data each time they make an online payment, according to the RBI’s new tokenisation mandate.
• As per new guidelines, online players will have to delete any credit and debit card data stored on their platforms and replace them with token to secure card details of consumers.

Impact

• An estimated 5 million customers, who have stored their card details for online transactions on various platforms, could be impacted if the online players and merchants are not able to implement the changes at their backend. E-commerce platforms, online service providers and small merchants could be especially hit. Equated monthly instalments and subscription-based transactions that are paid through stored cards will also have to adhere to new rules. Now, with the latest extension, the RBI expects the systems to be ready for seamless launch in six months.
• While 90 per cent of banks are ready for tokens on the Visa platform, Mastercard is yet to catch up. The RBI had banned Mastercard from issuing any new cards on July 14 this year for not complying with data localisation requirements. Even as CoF conversion to a tokenised number is being done, the system is not geared up for processing the tokens as merchants are not ready at their end.
• Digital payment firms and merchant bodies had sought urgent intervention of the RBI to extend the deadline for implementation of the new credit and debit card data storage norms, or card-on-file tokenisation (CoF).
• Industry sources argue that all stakeholders – banks, card schemes, aggregators, gateways, processors, merchants, consumers and the regulator – in effect have to come together for successful implementation of the norms, which requires time and preparation. Specifically, the RBI policy change affects three major players: banks, intermediary payment systems and merchants.  

Way forward

• Three steps have to be completed for smooth implementation of tokenisation. Token provisioning: the consumer’s card number should be convertible into a token, which means the card networks have to be ready with the relevant infrastructure.
• Token processing: Consumers should be able to complete their transaction successfully through the tokens.
• Scale-up for multiple use cases: Consumer should be able to use the token for things like refunds, EMIs, recurring payments, offers, promotions, guest checkouts etc.

How to structure:

1) Give an intro about card tokenisation and what it means

2) Mention the RBI guidelines related

3) Discuss the various impact on the stakeholders

4) Conclude

Reference:

1. https://indianexpress.com/article/explained/explained-what-is-tokenisation-and-why-has-rbi-issued-new-guidelines-7688122/