Banks, merchants push for card tokenisation as deadline looms

Mumbai | Bengaluru: Indian banks and merchants have started reaching out to customers asking them to tokenise their credit and debit cards before the June 30 deadline set by the regulator, according to communication seen by ET. This comes even as several merchants continue to be nervous about the readiness of the ecosystem to handle transaction and tokenisation volumes, and avoid payment disruptions for consumers.

So far, large merchants including Uber, Swiggy and MakeMyTrip have gone live, and are allowing customers to tokenise their cards. Flipkart, Amazon, Myntra,

and GoIbibo among others are in the final stages of integrations and expected to start the process of tokenising consumer cards in the coming weeks.

Tokenisation is a process by which card details are replaced by a unique code or token, allowing online purchases to go through without exposing sensitive details. As per the Reserve

’s latest diktat, all merchants must delete customer debit and credit card data on or before June 30 and replace card payments with unique tokens for all online, point-of-sale and in-app transactions.

“We have started sending out customer communication, indicating what all has to be done to tokenise cards. We are all ready with the process and are meeting all regulatory guidelines,” said a senior banker with a private sector lender.

A communication sent by

to customers says that they should tokenise their cards to avoid inconvenience while making online transactions.

“By 30th June, complete an additional step of saving your card details, through tokenisation, to eliminate the inconvenience of re-entering the card details,” the customer communication states. “Failing to do so will lead to the deletion of your current saved card details on merchant websites and apps.”

While Indian banks and payment networks such as Visa, Mastercard and RuPay claim to be ready with their tokenisation solutions, large merchants continue to be unsure about the scalability of the payments network for tokenisation, and the readiness of entire ecosystem as they fear disruptions in payment experiences of consumers.

“In line with RBI’s directive, we were among the first ones to go live with tokenisation … Overall, we have been tokenising cards for more than six months now. While we are committed to making the process seamless, we expect challenges with respect to the ecosystem readiness for use cases such as processing of EMIs or card-based offers. This may impact customer experience till all use cases are solved,” said a MakeMyTrip spokesperson, responding to ET’s queries.

“We are working towards ensuring a seamless shift to comply with RBI directives on tokenisation,” said Uber India spokesperson.

Flipkart, Myntra and Nykaa did not respond to ET’s queries until Sunday press time, while Amazon India said it is partnering with authorities to ensure uninterrupted payment experience for customers.

The payment industry including merchants have been making closed-door representations to the Reserve Bank of India, relaying their concerns about payment use cases such as guest checkouts and recurring payments, including equated monthly instalments, which have still not found implementation in the tokenisation solutions offered at present.

Merchants need to offer a tokenisation option, whereby the customer will enter card details and tokenise the card for future payments. In case a merchant doesn’t offer this option, customers will have to enter their card and CVV details each time they make a payment on the platform.

“What merchants are concerned about is whether the entire payment chain is ready to implement tokenisation and handle the volumes at scale, and therefore some merchants are taking steps in advance to accelerate the implementation so that customer experience is not disrupted starting July. However, the robustness of the ecosystem to handle this volume of tokenisation still remains to be untested,” said a fintech executive who did not want to be named.

Several large merchants are also wary of implementing tokenisation for their customers because of the fear of disruptions in consumer experience.

“The payments industry is not fully ready to execute tokenisation, with the biggest challenge being integration across various players in the value chain. Large marketplaces don’t want to begin the process yet, since they don’t want to disrupt consumer payment experience, which may lead them to lose out on customers amidst heavy competition. So, what does a marketplace do in case a payment is stuck, while a customer tokenises and pays for a product? These are some of the answers the industry is trying to find,” said a person, who didn’t want to be named.

The RBI in March 2020 had said that payment aggregators and merchants onboarded by them would be prohibited from storing card details of customers to improve data privacy and avoid frauds in online transactions. That was supposed to come into effect from June 2021. After multiple deadline extensions, a new implementation date on June 30 has been set.