Why has the RBI decided to postpone the card tokenization deadline for card transactions?

Nearly a week before the new card tokenization norms (card on file or COF norms) were to take effect for all card transactions on the web, there is a change of plan. RBI decided to put off the implementation of the card tokenization plan by 6 months from 01st January 2022 to 01st July 2022. Effectively, now all the merchants and banks have another 6 months to get their house in order ahead of implementation of COF.

The entire idea of Card on File tokenization was to offer a more secure way of sharing data while transacting online. The RBI had been uncomfortable with the current system of merchant websites like Flipkart and Amazon being permitted to store basic card information on the web. For example, currently, the merchant can store data like card number and expiry date for future use. However, CVV and OTP on mobile change each time.

This enabled faster transactions and was helpful to the customers and to the merchants, but it came at a cost of higher risk to data integrity. In the last few months, there have been several high profile cases of data hacks where data of millions of individuals was compromised. The RBI COF model was meant to address this shortfall in the current system. The date will be an unlinked string so it offers an additional layer of security.

However, the Merchants Payment Alliance of India or the MPAI had asked RBI for 6 more months to facilitate a smooth transition to the new system. That is because the COF model called for a higher degree of readiness and preparedness from banks, card networks, payment gateways and payment aggregators. Also, there was a huge risk of loss of business as it was being estimated that merchants would lose 20-30% of their online business.

RBI may have been driven less by the demands of MPAI and more by the Omicron risk. For example, currently there are an estimated 98.50 crore cards in use in India and this move would impact close to 15 million transactions a day implying a daily rupee volume of Rs.4,000 crore. Omicron would again need a big focus on digital gateways. RBI felt, it would be too much of a risk to effect the change at this point of time. Hence the postponement.