The Reserve Bank of India on Thursday extended card tokenisation deadline by six months till 30 June 2022, from the earlier deadline of 31 December 2021.
"The timeline for storing of CoF (card-on-file) data is extended by six months, ie, till 30 June 2022; post this, such data shall be purged," it said in a notification.
"In addition to tokenisation, industry stakeholders may devise alternate mechanism(s) to handle any use case or post-transaction activity that currently involves or requires storage of CoF data by entities other than card issuers and card networks," the RBI said.
The RBI's card tokenisation guidelines mandated replacing the actual card data with encrypted digital tokens, which are then used to facilitate and authenticate transactions.
Industry Bodies Push for Extension
The devaluation of sensitive card details would have alleviated risk and reduced vulnerability of sensitive data. However, industry bodies urged the RBI to extend card tokenisation deadline beyond 31 December 2021.
The Merchant Payments Alliance of India (MPAI) and the Alliance of Digital India Foundation (ADIF) had recently urged the central bank to extend the CoF tokenisation deadline of 31 December for merchants.
Citing several operational challenges that will hinder the transition to the token-based payments ecosystem, the industry bodies voiced their concerns over industry readiness on the RBI directive on card-on-file tokenisation.
The MPAI and ADIF said that 'ecosystem readiness' is a sequential process of going live with stable API (application programming interface) documentation for tokenised transactions.
The digital payments ecosystem is a long way from consumer-ready solutions and unless regulated entities are compliant, merchants will not be able to successfully process tokenised transactions, they said in the joint letter.
(At The Quint, we are answerable only to our audience. Play an active role in shaping our journalism by becoming a member. Because the truth is worth it.)