RBI extends the timeline for card tokenization by another 3 months till Sept 30, 2022

Circular no. RBI/2022-23/77 CO.DPSS.POLC.No.S-567/02-14-003/2022-23, Dated: 24.06.2022

The RBI has observed that an alternate system in respect of transactions where cardholders decide to enter the card details manually at the time of undertaking the transaction has not been implemented by the industry stakeholders, so far. Accordingly, the RBI has decided to extend the timeline for storing of Card-on-File (CoF) data by three months, i.e., till 30.09.2022, after which such data shall be purged. Earlier, the timeline was extended to 30.06.2022.

RBI directed that No entity in the card transaction/payment chain, other than the card issuers and/or card networks, shall store the CoF data, and any such data stored previously shall be purged.

“To create a token under the CoFT framework, the cardholder has to undergo a one-time registration process for each card at every online or e-commerce merchant’s website or mobile application, by entering the card details and giving consent for creating a token. This consent is validated by way of authentication through an AFA. Thereafter, a token is created which is specific to the card and online / e-commerce merchant, i.e., the token cannot be used for payment at any other merchant. For future transactions performed at the same merchant website / mobile application, the cardholder can identify the card with the last four digits during the checkout process.

Till date, about 19.5 crore tokens have been created. Opting for CoFT (i.e., creating tokens) is voluntary for the cardholders. Those who do not wish to create a token can continue to transact as before by entering card details manually at the time of undertaking the transaction (commonly referred to as “guest checkout transaction”). Said RBI

Click Here To Read The Full Circular