What changed
RBI has firmly rejected any change to the October 1, 2022 deadline for purging Card-on-File (CoF) data by all entities except card issuers and networks. As an interim relief, merchants and payment aggregators can retain CoF data for up to T+4 days (or until settlement, whichever is earlier) solely for settling guest checkout transactions. Acquiring banks are allowed to continue storing CoF data for post-transaction activities until January 31, 2023.
What it means for you
Banks and payment aggregators must urgently complete the purge of stored card data by October 1, 2022, or face penal action including business restrictions. The narrow T+4 day window for guest checkout data is a temporary concession, not a relaxation of the overall ban. Acquiring banks have a slightly longer runway until January 31, 2023, to adjust their post-transaction processes, but must plan for full compliance thereafter.
What you must do
- Purge all stored Card-on-File (CoF) data by October 1, 2022, except for card issuers and networks.
- For guest checkout transactions, ensure CoF data is retained only for T+4 days or until settlement, whichever is earlier, and then deleted.
- Acquiring banks: continue storing CoF data for post-transaction activities only until January 31, 2023, and plan for full deletion by that date.
- Review and update internal systems and agreements with merchants and PAs to enforce the new data retention limits.
- Prepare for potential RBI audits and ensure compliance documentation is ready to avoid penal action.
Who it affects
All payment system providers and participants, Merchants and payment aggregators (PAs), Acquiring banks, Card issuers and card networks (exempted from purge)
What is the exact deadline for purging CoF data?
The deadline remains October 1, 2022. No extension has been granted. All entities except card issuers and networks must purge stored card data by this date.
Can we store CoF data for guest checkout transactions after October 1?
Yes, but only as an interim measure. Merchants and PAs can store CoF data for a maximum of T+4 days (T being transaction date) or until settlement, whichever is earlier, and only for settlement purposes. The data must be purged immediately after.
What happens if we fail to comply?
RBI has warned of appropriate penal action, including imposition of business restrictions, for any non-compliance. This is a serious regulatory requirement.