The Reserve Bank of India mandated the deletion of card-on-file data by merchants and PA/PGs. Industry bodies and civil society organisations gave inputs seeking an extension of this deadline in December last year, including The Dialogue and Deepstrat, which published a paper outlining the challenges associated with rushed compliance. The RBI, taking cognisance, gave a six-month extension, which is due to end on June 30.
As part of research efforts on this, we conducted a series of interviews with key stakeholders in the digital payments ecosystem that are impacted by these regulations and to understand their level of readiness. These interviews helped garner insights from members of the digital payments community. While the industry has shown significant progress in implementing the tokenisation solution, as per our findings, the ecosystem as a whole does not seem to be fully ready, although it is making strides towards preparedness and requires some more time to go ahead with the mandate.
Recommendations:
- The majority of the stakeholders recommended that an extension of the deadline is essential for testing the solutions for different use cases and the scalability of the tokenisation solution.
- At least six months of extension is required for successfully implementing the tokenisation mandate.
- There is a need for the RBI to come up with a phased implementation programme to minimise the impact of potential disruption on stakeholders, including consumers.
- A separate testing period should be given to the merchants to understand the workings of tokenisation and the issues that may arise in conducting high-volume transactions.
- Awareness programmes in vernacular languages are required to ensure that customers are aware of the intricacies and implementation of tokenisation before consenting to its usage.
- RBI must make the readiness of the industry transparent to gain the trust of the ecosystem.
The report is authored by Ayush Tripathi, Senior Research Associate and Saksham Malik, Programme Manager.
