Is The Payments Ecosystem In India Finally Ready For Card Tokenisation?

Is The Payments Ecosystem In India Finally Ready For Card Tokenisation?


The RBI’s new rules for the storage of card details via tokenisation will come into effect from October 1

While several merchants have implemented the tokenisation infrastructure, there are several problems that still need to be addressed

One of the major problems is concerns about the effect card tokenisation will have on mandates for recurring payments

After the extension of the deadline for card tokenisation by the Reserve Bank of India (RBI) thrice over the last one-and-a-half years, the new rules for the storage of card details will come into effect from October 1. The central bank, in June, gave the payments ecosystem time till September 30 for purging all card-on-file (CoF) data.

Industry stakeholders had requested the central bank to extend the deadlines owing to a lack of infrastructure adoption and the possibility of disruption and inconvenience to cardholders. As such, the extension of three months gave a breather to the industry. 

The card networks (like RuPay, Visa and MasterCard), issuers (banks) and acquirers (merchants) were in different stages of readiness for the new norms in June and needed more time to integrate with one another. However, as the implementation deadline nears, the question is if the payments ecosystem is finally ready for the transition.

Commenting on the readiness now, Fintech Zaggle’s MD and CEO Avinash Godkhindi told Inc42 that a large number of entities have already adopted tokenisation. “Tokenisation will encourage the end consumers to store the payment information without being worried about information misuse. So honestly, most of the major merchants are ready.” 

He added that networks will help smaller merchants adopt tokenisation and that coverage visibility data in terms of users adopting tokenisation is something that only the network will have. 

What Is Card On File Tokenisation Framework?

In January 2019, the central bank released the guidelines for implementing tokenisation for card transactions. The initial deadline for the ecosystem to comply with the guidelines was June 30, 2021.

The process of tokenisation starts from the card networks’ end, where cardholders can request a free 16-digit alphanumeric code called a token to replace their original card number. Customers will need to use this token when making payments at any merchants’ websites.

The process is somewhat similar to how UPI operates via a UPI ID. Like with UPIs, merchants will be allowed to store only this token (in the case of UPI, the UPI ID) data, and will need to purge all existing card data stored on their platforms. If users fail to tokenise their cards, they will have to manually enter every detail (card number, expiry date, account holder name and CVV) on the merchant’s website, which again will be deleted after a single use.

Merchants of several platforms such as Google Play, NPCI and Razorpay have already adopted tokenisation, while PhonePe and PayU have launched tokenisation solutions for online debit and credit card transactions.

The main idea behind tokenisation is to reduce the number of places where a user’s card data is stored. Under the new rules, only the card network, the card issuing bank and the end user will know the actual card details. Merchants (ecommerce sites), payment gateways/payment aggregators (PA/PG; who process online payments) and acquiring banks (the merchant’s bank) will have to use tokenised data. Herein lies the problem, as the latter entities will have to build new infrastructure or modify the existing one to adhere to the new guidelines.

Recurring Mandates Remain A Concern 

Recently, PhonePe announced that 80% of its monthly active users have tokenised their cards. On a positive note, it claimed that the success rate of tokenised transactions showed an improvement of about 2% in comparison with card-based transactions over the past few weeks.

Rohit Kumar, founding partner of TQH Consulting, told Inc42 that overall, the payments ecosystem seems to be more ready than before for card tokenisation. 

“While we are still seeing some payment failures in test runs, the main concern that remains is recurring payments. Many merchants worry that we’ll see a repeat of the October 2021 e-mandate – recurring payments will fail and customers will have to re-enter their card details every month. Not only will this lead to inconvenience for customers, it will also hit revenue for merchants,” he said.

He added that the ecosystem lacks authoritative information about how ready the players are, and the RBI should release a status report, if possible.

It must be noted that several subscription-based companies saw a fall in their revenues when the RBI’s new guidelines on recurring payments came into effect last year. In June this year, the central bank hiked the e-mandate limit to INR 15,000 for recurring payments.

Most recently, NASSCOM and the Merchant Payments Alliance of India (MPAI) made a joint submission to the RBI discussing challenges faced by the ecosystem on card tokenisation. 

While several member organisations of the MPAI are now accepting the tokenisation methodology, the industry body’s research revealed that the success rate of mapping card details onto tokens was in the range of 90%-95%.

“We emphasised that (…end consumers) should be able to successfully conduct payment transactions using tokenised card details for the ecosystem to be ‘ready’. However, merchants which rely on payment aggregators/gateways (PA/PGs) are yet to make any meaningful progress on the same,” the MPAI-NASSCOM joint report stated.

Besides, the problem seems to be a tripartite one for recurring payments wherein new mandates will have to be created with mandate IDs and tokens instead of mandate ID and card details, existing e-mandates based on card details will have to be token-based, and auto-debits will have to be enabled for bank accounts based on a combination of mandate ID and token, for which infrastructure is still not full-proof.

Thus, on one hand, merchants are in favour of tokenisation, while on the other hand, there are concerns about infrastructure readiness and the adverse impact tokenisation can have on recurring mandates.

Note: We at Inc42 take our ethics very seriously. More information about it can be found here.

You have reached your limit of free stories
Become An Inc42 Plus Member

Become a Startup Insider in 2024 with Inc42 Plus. Join our exclusive community of 10,000+ founders, investors & operators and stay ahead in India’s startup & business economy.

Unlock 60% OFF
Cancel Anytime
Unlock 50% OFF
Cancel Anytime
Already A Member?
Discover Startups & Business Models

Unleash your potential by exploring unlimited articles, trackers, and playbooks. Identify the hottest startup deals, supercharge your innovation projects, and stay updated with expert curation.

Is The Payments Ecosystem In India Finally Ready For Card Tokenisation?-Inc42 Media
How-To’s on Starting & Scaling Up

Empower yourself with comprehensive playbooks, expert analysis, and invaluable insights. Learn to validate ideas, acquire customers, secure funding, and navigate the journey to startup success.

Is The Payments Ecosystem In India Finally Ready For Card Tokenisation?-Inc42 Media
Identify Trends & New Markets

Access 75+ in-depth reports on frontier industries. Gain exclusive market intelligence, understand market landscapes, and decode emerging trends to make informed decisions.

Is The Payments Ecosystem In India Finally Ready For Card Tokenisation?-Inc42 Media
Track & Decode the Investment Landscape

Stay ahead with startup and funding trackers. Analyse investment strategies, profile successful investors, and keep track of upcoming funds, accelerators, and more.

Is The Payments Ecosystem In India Finally Ready For Card Tokenisation?-Inc42 Media
Is The Payments Ecosystem In India Finally Ready For Card Tokenisation?-Inc42 Media
You’re in Good company