Banks Seek To Delay Card Storage Guidelines By Another Six Months

Banks have sought another extension of the Reserve Bank of India's card data storage guidelines by six months. These were set to kick in from July.

In a request submitted to the regulator through the Indian Banks' Association, banks have argued that the time provided for implementation of the guidelines is too short, two bankers aware of the developments said on conditions of anonymity.

Moreover, there are still only a few avenues for tokenising card data making it difficult to implement the card storage guidelines, banks have said in the request, the two bankers said. Further, even after tokenising a card, the success rate for transactions at this point in time is low, the banks have said in their request.

While the IBA has submitted the request, the RBI has not given any assurances on such an extension.

The guidelines, originally introduced in March 2020, said merchants can no longer store customer card data. At the time, the guidelines were to come into effect by June 2021. Since then the deadline has been extended at least two times, with the last extension coming in December 2021.

If the extension is not provided by the RBI, the Indian banking system is likely to face considerable disruption, with customers being forced to enter their card details every time they want to transact on a merchant's payment page, the first of the two bankers quoted above said.

Retailers have raised similar concerns.

While speaking with reporters on June 8, RBI Deputy Governor T Rabi Sankar had said the progress on implementation of the card tokenisation guidelines was "satisfactory".

"About 16 crore tokens, by last count, had already been created. This number would pick up as we come closer to the deadline and even as we go beyond the deadline. It is not that everyone should have a token before that, you can also do it later," Rabi Sankar told reporters.

As of April 2022, there were 7.51 crore credit cards and over 92 crore debit cards in force in India, according to monthly data provided by the RBI.

The head of a payment gateway, who also spoke on conditions of anonymity, said most banks are currently not equipped to accept tokens to authorise payments. So even if the customer's card information is tokenised, it cannot be used for conducting a transaction. Currently, payment gateways are still negotiating finer issues such as pricing of tokenisation with card networks, he said.

Asim Parashar, partner, PwC India, said banks asking for an extension on tokenisation seems like a genuine request from a system dealing with resource constraints.

"Is it doable? Yes. But banks and financial institutions just need some more time to implement the guidelines. Currently, they are lacking the tools and employee resources for implementation. Moreover, they are dealing with compliance on a host of other issues. So time is crucial," Parashar said.