Tokenization of Debit and Credit Cards.

Q Why is it in News ?

A The Reserve Bank of India (RBI) has decided to defer the implementation of tokenization of debit and credit cards for online transactions by a further six months following representations from stakeholders.

Q What is RBI decision ?

A 

• RBI has also extended tokenization of Card-on-File (CoF) transactions where card details are saved by merchants — and directed the merchants not to store card details in their systems from January 1, 2022.
• A CoF transaction is one in which a cardholder has authorized a merchant to store his or her Mastercard or Visa payment details, and to bill the stored account.
• E-commerce companies and airlines and supermarket chains often store card details.

Q What is Tokenisation?

 A

• Tokenisation refers to the replacement of credit and debit card details with an alternative code called a ‘token’.
• This token is unique for a combination of card, token requestor (the entity that accepts a request from the customer for tokenisation of a card and passes it on to the card network to issue a token) and the device.

Q What are benefits of Tokenization ?

A 

• Transaction safety: Tokenization reduces the chances of fraud arising from sharing card details.
• Easy payments: The token is used to perform contactless card transactions at point-of-sale (PoS) terminals and QR code payments.
• Data storage: Only card networks and card-issuing banks will have access to and can store any card data.

Q How are the transactions currently processed?

A 

• There are many players involved in processing one card transaction today:

1. Merchant
2. Payment aggregator
3. Issuing bank
4. Card network

• When a transaction happens on a merchant platform, the data is sent to the payment aggregator (PA).
• The PA next sends the details to either the issuing bank or the card network.
• Then issuing bank sends an OTP and the transaction flows back.

Q Is the industry ready to implement this? 

A 

• Not fully, that is why the RBI had to extend the deadline.
• The industry currently can convert CoF into a tokenized number. However, the readiness to process the token is negligible.
• About 90% of banks are ready with provisioning of token on Visa. Only 25-30% banks are ready on Mastercard.

Q What will be the Impact on businesses ?

A If the industry isn’t ready, several business models would be impacted.

• E-mandates (recurring payments) will stand ineffective from 1 July.
• Card EMIs account for 25% of online e-commerce sales. That option will no longer be available.
• Cashbacks/discount offers by banks will be impacted, too.
• A user may not be able to use Mastercard saved cards on a merchant platform to make a transaction and will have to enter the card details every time a transaction is made.
• This could be the same for some Visa cards.

Q What can be way forward ?

A 

• The new system is a much bigger disruption to the way digital payments will henceforth be processed.
• Integration of systems and the ability to process is one part.
• The industry also needs to test the performance and success rate of the tokenization solution.