Is 3-Month Extension Sufficient For The Payment Ecosystem To Prepare For Card Tokenisation?

Giving a breather to the payment ecosystem, the Reserve Bank of India (RBI) on Friday extended the deadline for card tokenisation by three months till September 30, 2022. Although many from the industry had earlier sought a six-month extension, industry associations and experts have welcomed the three-month extension.

The decision was taken by the RBI to avoid disruption and inconvenience to cardholders. In a statement, the central bank said that considerable progress has been made in terms of token creation. However, transaction processing based on these tokens is yet to gain traction across all categories of merchants. 

Further, an alternate system for guest-checkout transactions has not been implemented by the industry stakeholders so far, the RBI added. Guest-checkout is a widely used term for transactions where cardholders decide to enter the card details manually at the time of undertaking the transaction.

The Payments Council of India (PCI) welcomed the extension provided by the RBI.

“The PCI has been in discussions with its members and it has been observed that while the overall industry was striving and committed to meet the timeline, certain issues had emerged in the final roll out. Solutions required to resolve the issues were being actively worked on but were to be primarily resolved by the networks, issuers and acquirers within the ecosystem,” Vishwas Patel, chairman of PCI, said.

Hence, this extension of three months by RBI will provide breathing space for all parties involved to comply with the card tokenisation norms, he added.

Tokenisation is the process where actual card details are replaced with an alternate code, called a token. Under the RBI’s guidelines for tokenisation and card storage, payment aggregators, merchants and payment gateways will have to purge the customers’ card data stored with them.

It is to be noted that the RBI has deferred the implementation of guidelines for card transactions for the third time. It was first postponed from June 30, 2021 to December 30, 2021 and then later to June 30, 2022. 

According to Kazim Rizvi, founder of public policy think tank The Dialogue, the industry has made a lot of progress between December 2021- June 2022. However, there are certain loose ends when it comes to tokenisation. While advancements on token provisioning have been done, the industry is grappling with issues with respect to solutions for use cases. 

Rizvi is of the view that solutions for use cases, such as guest checkouts, EMIs, and recurring transactions, are still in the development and implementation phase. Some of them do not even exist yet, he added.

“Different stakeholders are at different stages of readiness. When it comes to token provisioning, preparedness is great. But for use cases, it’s not. We have card networks, banks, payment aggregators and payment gateway (PA/PG), and merchants – four key players within the ecosystem. They are not equally prepared,” he said.

In the case of merchants, while larger players may be able to ready themselves for tokenisation soon, smaller merchants with lesser technological capabilities will be far more impacted and more vulnerable to disruption. Hence, they need more time to integrate.

“A number of merchants and banks were almost ready to implement the card tokenisation guidelines within June 30. If we look at the overall digital economy, there are a large number of small-mid merchants along with big merchants. While a few of the big merchants were not ready, many of the small-medium merchants were not ready,” Mihir Gandhi, payments leader at PwC India, said.

From a business point of view, there could be an impact on online payments if the infrastructure is not ready, he noted. A customer will most likely not bother entering a 16-digit number for a card every time. Either the customer will go away from the website or they would use alternative methods such as net banking or UPI or wallet. Hence, the transactions on cards may drop, he added.

As per experts, the industry will be in a much better position in the next 90 days to implement the tokenisation guidelines. However, Rizvi is of the view that there should be phased implementation. 

“We need to have a greater amount of testing before the guidelines to delete the card-on-file data are implemented. The industry did not have the time to test solutions and the process,” he said.

While APIs to enable merchants to process the transaction are being made available to them, more time is needed to run tests and pilot programmes in order to ensure minimum transaction failures, he added. 

On the other hand, big players in the payment ecosystem seem to be prepared for the switch to tokenisation for card transactions. 

A spokesperson of digital payments firm PhonePe said that it initiated processing of token-based transactions in April and has processed around 4.5 Mn transactions till date with a higher success rate than that of card number-based transactions. The startup said that over 70% of monthly active cards on its platform have been tokenised. 

“PhonePe was the first player to go live with all three major card networks (Mastercard, Rupay, Visa) in December 2021. We were the first in industry to get there, because we believe this move will help protect consumers against merchant-specific data leaks, which in turn will help induce trust and grow the cards business in the medium to long run,” the spokesperson added.