Delhi High Court: Assets From Illegal Cricket Betting are Proceeds of Crime Attachable by ED  ||  Delhi HC: Extension to Issue SCN U/S 110 of The Customs Act Must be Granted Before Six Months Expire  ||  Delhi HC: Statements to Customs under Section 108 During Goods Seizure Aren't Admissible As Evidence  ||  Delhi HC: Oral Waiver of a Show-Cause Notice is Invalid And Continued Detention of Goods is Unlawful  ||  Supreme Court: Letter of Intent is a 'Promise in Embryo', Rights Arise Only After Conditions Met  ||  SC Auction Sale under Order XXI Rule 90 CPC Cannot Be Challenged on Pre-Proclamation Grounds  ||  NCLT Kochi: CoC May Invite Fresh Bids, Regulations Only Restrict Alteration of Existing Bids  ||  Chhattisgarh HC: Father Must Provide Maintenance and Marriage Expenses to Unmarried Adult Daughter  ||  Delhi HC Rules That ‘Hermès’ and the 3D Shape of its ‘Birkin’ Bag are Well-Known Trademarks in India  ||  Kerala HC: Arrest is Illegal if Accused isn’t Produced in 24 Hours and Rearrest From Prison is Barred    

Enhancement to tokenisation of card transactions- (Reserve Bank of India) (07 Sep 2021)

MANU/RPRL/0130/2021

Banking

The Reserve Bank of India (RBI) has today announced the following enhancements to the extant framework on card tokenisation services:

a. the device-based tokenisation framework advised vide circulars of January 2019 and August 2021 has been extended to Card-on-File Tokenisation (CoFT) services as well, and

b. card issuers have been permitted to offer card tokenisation services as Token Service Providers (TSPs). The tokenisation of card data shall be done with explicit customer consent requiring Additional Factor of Authentication (AFA).

The above enhancements are expected to reinforce the safety and security of card data while continuing the convenience in card transactions.

Citing the convenience and comfort factor for users while undertaking card transactions online, many entities involved in the card payment transaction chain store actual card details [also known as Card-on-File (CoF)]. In fact, some merchants force their customers to store card details. Availability of such details with a large number of merchants substantially increases the risk of card data being stolen. In the recent past, there were incidents where card data stored by some merchants have been compromised / leaked. Any leakage of CoF data can have serious repercussions because many jurisdictions do not require an AFA for card transactions. Stolen card data can also be used to perpetrate frauds within India through social engineering techniques.

Reserve Bank had, therefore, stipulated in March 2020 that authorised payment aggregators and the merchants onboarded by them should not store actual card data. This would minimise vulnerable points in the system. On a request from the industry, the deadline was extended to end-December 2021 (RBI circular CO.DPSS.POLC.No.S33/02-14-008/2020-2021 dated March 31, 2021), as a one-time measure. RBI has been in regular consultation with the industry to facilitate the transition.

It may be noted that introduction of CoFT, while improving customer data security, will offer customers the same degree of convenience as now. Contrary to some concerns expressed in certain sections of the media, there would be no requirement to input card details for every transaction under the tokenisation arrangement. The efforts of Reserve Bank to deepen digital payments in India and make such payments safe and efficient shall continue.

Tags : ENHANCEMENT   TOKENISATION   CARD TRANSACTIONS  

Share :        

Disclaimer | Copyright 2025 - All Rights Reserved