What changed
The RBI circular dated March 17, 2020, mandated that neither Payment Aggregators nor their merchants can store customer card credentials. Based on industry requests, RBI has now extended the compliance timeline for non-bank PAs by six months, to December 31, 2021, as a one-time measure. All other provisions of the earlier circular remain unchanged.
What it means for you
Non-bank Payment Aggregators get additional time to implement tokenisation and other secure solutions, reducing immediate compliance pressure. Banks and other payment system participants must continue to ensure that no card credentials are stored beyond the new deadline. This extension provides a window for smoother transition but does not dilute the ultimate requirement to stop storing sensitive card data.
What you must do
- Update internal compliance calendars to reflect the new deadline of December 31, 2021 for non-bank PAs.
- Ensure that all merchants onboarded by your PA or bank comply with the tokenisation framework by the extended date.
- Continue to monitor and enforce the prohibition on storing customer card credentials in any database or server.
- Coordinate with technology partners to finalise and test tokenisation solutions within the extended timeline.
Who it affects
Non-bank Payment Aggregators, Payment Gateways, E-commerce marketplaces involved in payment aggregation, Merchants onboarded by Payment Aggregators
Does this extension apply to bank Payment Aggregators as well?
No, the extension is specifically for non-bank Payment Aggregators. Bank PAs were already required to comply by September 30, 2020, as per earlier circulars.
What happens if a non-bank PA fails to comply by December 31, 2021?
The circular does not specify penalties, but non-compliance would mean violating RBI's directive under the Payment and Settlement Systems Act, 2007, which could lead to regulatory action including possible suspension or revocation of authorisation.
Are e-commerce marketplaces that use a separate PA affected by this rule?
Yes, but only if they are directly undertaking payment aggregation. If they use a separate PA, they are treated as merchants and must ensure their PA complies with the storage ban.