The MPAI, an association that represents merchants, has requested the Reserve Bank of India (RBI) to plug issues around recurring payments through tokens before giving effect to the no-card storage rule, three people familiar with the development told ET.
“We humbly request that the RBI mandates card networks, payment aggregators and payment gateways to share a status report to demonstrate their readiness to fulfil tokenized transactions across all use cases,” the MPAI said in a letter to the RBI. “We also request that the RBI takes appropriate actions as deemed necessary to ensure that issues with token flows for recurring payments are duly addressed, before requiring the ecosystem to action the no-card storage rule.”
ET has seen a copy of the letter addressed to the central bank.
Tokenisation is a process by which card details are replaced by a unique code or token, allowing online purchases to go through without exposing sensitive card details.
Central bank rules require all merchants to delete customer debit and credit card details before October 1 and replace card payments with unique tokens. Merchants are meeting on Monday, and will likely request a deferral of this deadline.
Discover the stories of your interest
Merchants warn that implementing tokenisation without adequate preparedness will result in major disruption in recurring payments, akin to that seen in October last year when the mandate was first brought in.
“As merchants, we don’t know whether the upstream partner is ready. While we have been given verbal assurances by our partners, we haven’t received any sample transactions nor have we been able to test this on our own platform,” said one of the merchants involved in the discussions. “We fear that the recurring piece will once again face massive disruption.”
The RBI said in July it would not extend the timeline for storing card data and directed all stakeholders, except for card issuers and card networks, to purge the customer data before October 1, 2022. This is the third such extension in the past 18 months. As an interim measure, the RBI allowed merchants and payment aggregators to store card-on-file (CoF) only for guest checkout transactions for a maximum period of transaction date plus four days.
It also said that penal action, including imposition of business restrictions, will be considered in case of any non-compliance.
While banks and other industry participants say they are in complete readiness, merchants have submitted to the central bank that processing recurring payments still remains a challenging exercise due to the multiple steps involved.
Tokenising cards for such payments requires creation of mandates, and then this mandate needs to be migrated on tokens. The third leg of ensuring periodic auto-debits on the relevant account based on a combination of mandate ID and token is also a tricky process, experts say.
“We note that our members who are completely dependent on payment aggregators have had no testing experience on all three of the above-mentioned elements to date,” the letter to the RBI states. “Members that have been able to test still have only limited visibility on the efficacy of recurring payment flows due to lean upstream readiness. At the merchant’s end, access to bank identification numbers (BINs) from card networks is necessary to map mandate IDs and process recurring payments. Progress on this front is also limited.”
