What changed
RBI now requires all new debit and credit cards to be issued for domestic use only unless the customer explicitly opts for international usage. Existing magstripe cards used internationally must be converted to EMV chip cards, and a threshold limit for international transactions must be set. All IP-based acquiring infrastructure (including acquirers, processors/aggregators, and large merchants) must be PCI-DSS and PA-DSS certified.
What it means for you
Banks must overhaul card issuance and merchant terminal processes to meet these deadlines, increasing operational costs but reducing fraud risk. The move shifts liability for international fraud more onto banks and requires tighter coordination with card networks for real-time monitoring. Non-compliance could invite regulatory action.
What you must do
- Issue all new debit/credit cards as domestic-only by default; enable international use only on customer request with EMV chip and PIN.
- Convert existing magstripe cards used internationally to EMV chip cards by June 30, 2013.
- Set and communicate international transaction thresholds for active magstripe cards, with an omnibus limit (e.g., USD 500) for cards never used abroad.
- Ensure all IP-based acquiring infrastructure (including acquirers, processors/aggregators, and large merchants) is PCI-DSS and PA-DSS certified by June 30, 2013.
- Move towards real-time fraud monitoring at the earliest and provide SMS-based card blocking with confirmation.
Who it affects
All scheduled commercial banks including RRBs, Urban Co-operative Banks, State Co-operative Banks, District Central Co-operative Banks, Authorised Card Payment Networks
What is the deadline for converting existing magstripe cards to EMV chip?
June 30, 2013, but only for customers who have used their cards internationally at least once.
What is the omnibus threshold for international usage on cards never used abroad?
Banks may set a limit not exceeding USD 500 until individual thresholds are established.
Do all merchant terminals need PCI-DSS certification?
Yes, all IP-based acquiring infrastructure, including acquirers, processors, aggregators, and large merchants, must be PCI-DSS and PA-DSS certified by June 30, 2013.