In News:

• From October 1, the Reserve Bank of India’s card-on-file (CoF) tokenisation norms have kicked in, which aim at improved safety and security of card transactions.
• Now, for any purchases done online or through mobile apps, merchants/payment aggregators/payment gateways will not be able to save crucial customer credit and debit card details.

What’s in today’s article:

• Tokenisation for credit and debit card transactions – About, working, safety & security, India’s journey towards tokenisation

Tokenisation for credit and debit card transactions

• Tokenisation refers to the replacement of actual card details with a unique alternate code called the token.
• This token shall be unique for a combination of card, token requester and the device.
  • Token requester is the entity which accepts requests from the customer for tokenisation of a card and passes it on to the card network to issue a corresponding token.
• 

How does tokenised transactions work?

Who can offer tokenisation services?

• Tokenisation can be performed only by the authorised card network and recovery of original Primary Account Number (PAN) should be feasible for the authorised card network only.
• Adequate safeguards have to be put in place to ensure that PAN cannot be found out from the token and vice versa, by anyone except the card network.

Safety & security

• A tokenised card transaction is considered safer as the actual card details are not shared with the merchant during transaction processing.
• The token requestor cannot store Primary Account Number (PAN), or any other card details.
• Card networks are also mandated to get the token requester certified for safety and security that conform to international best practices/globally accepted standards.
• This is significant given the increasing size of payment transactions carried out through credit cards/debit cards.
  • As per the RBI’s annual report for 2021-22, during 2021-22, payment transactions carried out through credit cards increased by 27 per cent to 223.99 crore in volume terms and 54.3 per cent to 9.72 lakh in value terms.

India’s journey towards tokenisation

• In September 2021, the RBI prohibited merchants from storing customer card details on their servers with effect from January 1, 2022.
  • It mandated the adoption of card-on-file (CoF) tokenisation as an alternative.
• Later, the RBI extended the implementation date of card-on-file (CoF) tokenisation norms by another six months to June 30, 2022 which was further extended to September 2022.