RBI's push towards card security likely to hit merchants, lenders: Industry sources

The Reserve Bank of India`s plans to move towards card tokenisation is likely to hit a wide range of companies from major e-commerce firms and food delivery firms to lenders, while increasing the use of cash, said industry sources and bankers.

RBI issued guidelines in March 2020 saying that merchants will not be allowed to save card information on their websites to boost data security. It issued fresh guidelines in September 2021 giving companies until the end of the year to comply with the regulations and offering them the option to tokenise.

Tokenisation is a process by which card details are replaced by a unique code or token, generated by an algorithm, allowing online purchases to go through without exposing card details, in a bid to improve data security.
The RBI has ordered all companies in India to purge saved credit and debit card data from their systems from Jan. 1, 2022.

Merchants and bankers argue they have not been given enough time to comply with the changes, while opting out of tokenisation would mean a customer would need to manually key in their card details each time they completed an online purchase, which could put some customers off.

"Introducing an additional step in payments adds friction and several studies show that customers may end up dropping out in case of a discretionary purchase," said Sijo Kuruvilla George, who heads the New Delhi-based think-tank Alliance of Digital India Foundation, which represents Indian startups.
"We estimate revenue losses of about 20-40% for merchants, with the smaller firms being more adversely impacted," he added.

Meanwhile, senior executives at state-owned banks and private lenders said they worry the move will lead to a marked decline in card transactions and an increase in cash payments over the short-term, undoing years of work by lenders and the government to boost digitisation.

"Not all banks are going to be ready by January and even if they are, it is likely that to avoid inconvenience, customers may opt for a one-step cash on delivery, instead of keying in details," said a banker with a leading Indian lender, who asked not to be named because he is not authorised to speak to the media.

"So not only will card transactions decline but cash in circulation will also go up, which is another concern."
Credit card transactions in India crossed the 1 trillion rupees ($13.13 billion) mark in October while other modes of digital payments have also seen a sharp uptick over the years.

The industry is still waiting for clarity on how cash back schemes and monthly-installment type card purchases will work and has asked the central bank for more clarity and time, said an executive at an internet firm, who asked not to be named as the information is not public.

"The RBI is expecting the entire industry to come on to tokenisation, complete testing, move forward in less than four months, that is a very extreme ask from the industry," the executive added.

The RBI did not immediately respond to an email seeking comment on the matter. Companies such as Amazon, Walmart`s Flipkart, and Indian food delivery firm Zomato, who are likely to be affected, also did not immediately respond to a request for comment.

Industry executives say that even if certain card networks, banks and merchants are ready, ensuring that the processes are fully integrated system-wide and are seamless can take months.

"It may take about six- to nine months more for the entire ecosystem to be fully ready," said Manas Mishra, Chief Product Officer at payments firm PayU.
($1 = 76.2150 Indian rupees)
($1 = 76.1350 Indian rupees)