What changed
RBI extended device-based tokenisation to Card-on-File Tokenisation (CoFT), allowing card issuers to become Token Service Providers (TSPs) for their own cards. Tokenisation now requires explicit customer consent with AFA validation. From January 1, 2022, all entities except card issuers and networks must stop storing actual card data and purge any previously stored data.
What it means for you
Banks and payment aggregators must stop storing full card credentials by Jan 1, 2022, and purge existing data. Card issuers can now offer tokenisation services, enhancing security for recurring payments. Merchants and PAs must rely on tokens instead of storing card-on-file data, reducing fraud risk but requiring system upgrades.
What you must do
- Ensure your systems purge all stored actual card data by January 1, 2022, retaining only last four digits and issuer name for reconciliation.
- If you are a card issuer, prepare to offer CoFT services as a Token Service Provider with explicit customer consent and AFA.
- Update merchant onboarding agreements to prohibit storage of card credentials and mandate tokenisation for recurring transactions.
- Provide cardholders with options to view and de-register tokens via mobile app, internet banking, IVR, or branches.
Who it affects
All Payment System Providers and Participants, Card issuers (banks), Payment Aggregators and Payment Gateways, Merchants storing card-on-file data, Card networks
What is the deadline for purging stored card data?
All entities except card issuers and card networks must purge stored actual card data by January 1, 2022. Only last four digits and issuer name can be retained for reconciliation.
Can card issuers now offer tokenisation services?
Yes, RBI now permits card issuers to act as Token Service Providers (TSPs) for cards issued by them, subject to explicit customer consent and AFA validation.
What happens if a card is renewed or replaced?
The card issuer must seek explicit consent from the cardholder before linking the new card to merchants where the old card was registered for CoFT.