U.S. Firms Seek Another 12 Months To Meet Data Localisation Rules

Multinational firms, including the large card companies like Mastercard and Visa, which have failed to meet the Reserve Bank of India's data localisation norms, are seeking another year to become compliant.

The companies are willing to comply with the RBI's rules but have sought 12 months to complete the process, said Mukesh Aghi, chief executive officer of the U.S.-India Strategic Partnership Forum, an industry body acting on behalf of U.S. businesses. The firms are willing to commit to a milestone-based implementation plan, Aghi told BloombergQuint in an interview.

In April, the RBI had asked all payment services providers to start storing all data only locally. The regulator gave firms until Oct. 15 to comply. The RBI has given no indication of an extension of the deadline. An email was sent to the RBI on Monday morning. The story will be updated with its response.

While a large percentage of firms have complied with the rules, MasterCard, Visa and American Express, which account for the largest chunk of digital payments, have failed to do so, said a person familiar with the matter. Among the online payment firms, GooglePay is not complaint while WhatsApp's new product plan is under assessment to judge compliance, said the person.

Aghi said there has been no indication from the regulator on penalties or strictures that could be imposed on non-compliant firms. The card companies remain committed to ensuring that customers are not inconvenienced, he added.

Data Localisation: Two Sides Of The Debate

The RBI in its April circular said that payments data must be stored only locally. Foreign firms, however, argued that data mirroring is adequate for supervisory processes. Data is mirrored when it is copied to a storage device in real time. This data is then available for supervisory purposes cited by the RBI in its April communication.

The government and the RBI, however, are not in favour of this. On Monday, a government official, speaking on the condition of anonymity, said the government supports the RBI's insistence of localisation of payments data.

Aghi said the U.S. companies suggested a solution where the data can be mirrored in India. But that was not acceptable. “They just wanted to balkanise the data completely.” At that point, the U.S. companies made it clear that they are not opposed to complying with the local regulations but need time to understand the technical requirements and make the transition.

AP Hota, former chief executive officer of the National Payments Corporation of India, told BloombergQuint in an interview last week that he sees justification in the RBI's demand for local data storage. However, he also believes that the time needed to transition to local data storage, particularly for card companies, will be much more than six months given by the RBI. They would need at least three years to complete the transition, Hota said. While data mirroring could have been an interim solution, he said rules for data mirroring would have to be put in place too. Hota is currently an adviser to SWIFT.

What Does It Mean For Card Companies And Consumers?

Storing data locally will mean increased costs for card companies as they will have to set up large data storage operations. It would also impact their ability to leverage economies of scale in analytics of the data.

For the card companies, this means a shift in the business model, said an industry expert while speaking on the condition of anonymity. This person added that with the RBI insisting on data storage only in India, global firms would need to decide whether they want to build a local product conforming to those requirements.

The impact on consumers, however, may be limited since the payments market has a high degree of competition and fee structures are often regulated.