RBI extends card tokenisation deadline till June 30

Mumbai: The Reserve Bank of India on Thursday extended card tokenisation deadline by six months till June 30, 2022, from the earlier deadline of December 31, 2021.

“The timeline for storing of CoF (card-on-file) data is extended by six months, i.e., till June 30, 2022; post this, such data shall be purged,” it said in a notification.

“In addition to tokenisation, industry stakeholders may devise alternate mechanism(s) to handle any use case or post-transaction activity that currently involves or requires storage of CoF data by entities other than card issuers and card networks.”

The RBI’s card tokenisation guidelines mandated replacing the actual card data with encrypted digital tokens, which are then used to facilitate and authenticate transactions.

The devaluation of sensitive card details would have alleviated risk and reduced vulnerability of sensitive data. However, industry bodies urged the RBI to extend card tokenisation deadline beyond December 31, 2021.

The Merchant Payments Alliance of India (MPAI) and the Alliance of Digital India Foundation (ADIF) had recently urged the central bank to extend the CoF tokenisation deadline of December 31 for merchants.

Citing several operational challenges that will hinder the transition to the token-based payments ecosystem, the industry bodies voiced their concerns over industry readiness on the RBI directive on card-on-file tokenisation.

The MPAI and ADIF said that ‘ecosystem readiness’ is a sequential process of going live with stable API (application programming interface) documentation for tokenised transactions. The digital payments ecosystem is a long way from consumer-ready solutions and unless regulated entities are compliant, merchants will not be able to successfully process tokenised transactions, they said in the joint letter.