RBI Directs Card Issuers to Share Card Data With Outsourcing Partners Only With Explicit Consent from the Cardholder

Circular No. RBI/2023-24/132 DOR.RAUG.AUT.REC.No.81/24.01.041/2023-24; Dated: 07.03.2024

The RBI has amended certain provisions of the master direction on the ‘issuance of credit and debit cards’ [Master Direction No. RBI/2022-23/92/DoR.AUT.REC.No.27/24.01.041/2022-23; Dated: 21-04-2022]. As per the amended norms, RBI directs card issuers to share card data (including transaction data) of cardholders with outsourcing partners only with explicit consent from the cardholder.

The key amendments include

(a) Implementation of an effective mechanism by card issuers to monitor the end use of funds,

(b) No prior approval required by banks/NBFCs to become a co-branding partner of card issuers,

(c) Provision for card issuers to allow cardholders to modify billing cycle at least once, and

(d) Debit to credit card account must be done as per the RBI-prescribed framework. The provisions are effective from March 7, 2024.

The Key amendments are discussed in detail below –

(a) RBI directs card issuers to put in place effective mechanisms to monitor the end use of funds

As per the amended norms, the RBI has directed the card issuers to put in place an effective mechanism to monitor the end-use of funds. Business credit cards can be issued together with add-on cards wherever required. This ensures that card issuers monitor fund usage, thereby ensuring proper utilisation.

(b) Cardholders must be given an option to modify billing cycle at least once as per cardholders’ convenience

Card issuers do not follow a standard billing cycle for all credit cards issued. To provide flexibility in this regard, cardholders must be provided with the option to modify the billing cycle of the credit card at least once as per the cardholders’ convenience.

(c) No Prior Approval is required by banks and NBFCs to become a Co-branding partner of card issuers

As per the amended norms, no prior approval shall be required by the banks (i.e. all banks including Payments Banks, State Co-operative Banks and District Central Co-operative Banks) and NBFCs registered with the RBI (NBFCs – ICC, HFC, Factor, MFI, and IFC) to become co-branding partner of card-issuers.

(d) Card Transaction-Related Data may be directly drawn from card issuer system for enhanced convenience

For the cardholder’s convenience, card transaction-related data may be drawn directly from the card issuer’s system in an encrypted form and displayed in the co-branding partner (CBP) platform with robust security. The information displayed through the CBP’s platform must be visible only to the cardholder and must neither be accessed nor stored by the CBP.

(e) Timeframe for payment of Business Credit Cards may be agreed upon by card issuers and principal holders

For business credit cards, where the liability rests fully with the corporate or business entity (principal account holder), the timeframe provided for payment of dues and adjustment of refunds may be as agreed between the card issuer and the principal account holder. This ensures flexibility and efficient financial management for businesses.

(f) Card issuers must provide a list of payment modes for making payments towards credit card dues

Card issuers must provide a list of payment modes authorised by them for making payments towards the credit card dues on their websites and billing statements. Further, card issuers must advise cardholders to exercise due caution and refrain from making payments through modes other than those authorised by them.

(g) Card issuers must follow Standard Operating Procedure for deactivating/blocking/suspending debit or credit cards

The card issuers must follow a standard operating procedure as approved by their board, in case they decide, at their discretion, to block/deactivate/suspend a debit or credit card. Further, it must be ensured that blocking/suspending/deactivating a card or withdrawal of benefits available on any card is immediately intimated to the cardholder along with reasons via electronic means (SMS, email etc.) and other available modes.

(h) Debit to credit card account must be done as per the RBI-prescribed framework

Any debit to the credit card account must be done as per the authentication framework prescribed by the RBI from time to time and not through any other mode or instrument.

Click Here To Read The Full Circular