What changed
The earlier timeline for storing CoF data was extended by six months from December 31, 2021 to June 30, 2022. Post this date, such data shall be purged. Additionally, RBI now allows industry stakeholders to devise alternate mechanisms beyond tokenisation for handling use cases that require CoF data, such as recurring e-mandates, EMI options, and dispute resolution.
What it means for you
Banks and payment aggregators get a six-month breather to comply with the CoF storage ban, but must ensure all stored card data is purged by June 30, 2022. The flexibility to create alternate mechanisms means lenders can explore solutions beyond tokenisation for recurring payments and chargebacks, reducing operational disruption. Non-compliance post-deadline could attract regulatory action under the Payment and Settlement Systems Act.
What you must do
- Audit all systems to identify where actual card data (CoF) is stored by your entity or merchants you onboard.
- Plan and execute purging of all stored card data by June 30, 2022, ensuring no residual copies remain.
- Evaluate and implement tokenisation or approved alternate mechanisms for recurring payments, EMI, chargebacks, and loyalty programs.
- Communicate the revised timeline and compliance requirements to all merchants and third-party vendors handling card data.
Who it affects
Non-bank payment aggregators, Merchants on-boarded by payment aggregators, Payment system providers and participants (excluding card issuers and card networks)
What is the new deadline for purging stored card data?
The deadline has been extended from December 31, 2021 to June 30, 2022. After this date, all actual card data stored by non-bank payment aggregators and merchants must be purged.
Can we use alternatives to tokenisation for recurring payments?
Yes, RBI permits industry stakeholders to devise alternate mechanisms for use cases like recurring e-mandates, EMI options, chargeback handling, and loyalty programs, in addition to tokenisation.
Does this circular apply to card issuers and card networks?
No, the restriction on storing CoF data applies to entities other than card issuers and card networks. Issuers and networks are exempt from this purging requirement.