The recent Reserve Bank of India (RBI) norms on tokenisation services, which will be offered by card networks, are likely to result in merchants and payment aggregators incurring a cost as they have to pay a fee to the networks.
The merchants and the payment aggregators, in turn, may pass on the cost to the customers.
The norms, which were issued by the banking regulator released on September 7, allow card networks like Visa and Mastercard to offer the tokenisation service.
Tokenisation is the process in which card credentials are de-identified by converting into randomly generated numbers called tokens.
The RBI circular further said from January 1, 2022, no entity in the card transaction or the payment chain, other than the card issuers and / or card networks, are allowed to store the actual card data.
Any such data stored previously will have to be purged.
The tokenisation service will be provided by the card networks.
The payment networks will do the back-to-back tokenisation with the card issuing the bank.
Once the issuing banks and the network are ready and come out with the solution then the merchants will start integrating their system with the process.
Tokenisation is currently done by payment aggregators free of cost.
According to payment industry sources, the card networks plan to charge one time set up fee of $700, then there is record retrieval fee of $0.007 (that is every time the token is send for transaction) and also monthly storage fee of $6,000 for one million cards, $10,000 for 5 million cards and so on.
There are over 63 million credit cards in India and over 906 million debit cards in India as of end of July 2021.
“As PCI, we are confident of meeting the deadline after the networks come out with the solution.
"The only issue is what kind of pricing mechanism – for every token generated – they [card network] are going to charge,” said Vishwas Patel, chairman Payment Council of India - an apex body representing companies in payments and settlement system.
“If they charge heavily the entire system will fail. They have to make it cost effective to help RBI to make this possible,” Patel told Business Standard.
Patel also said that the merchants and payment aggregators are likely to ask for user consent for tokenisation.
National Payment Council of India (NPCI), which operates Rupay payment network, is yet to provide tokenisation service.
Mastercard has said they are an early adopter of card-on-file tokenization and will work with all the stakeholders for a seamless rollout of the facility.
“Mastercard welcomes the Reserve Bank of India’s decision to permit card-on-file tokenisation services.
"By replacing sensitive payment credentials with digital tokens, a superior ecommerce experience is created which provides increased security and a frictionless consumer experience.
"Globally, Mastercard is an early adopter of card-on-file tokenization and continuously focuses on introducing technology that brings simplicity and safety to cardholders, every time they pay,” said Ravi Datla, vice president, Digital Products, South Asia, Mastercard.
“We will continue to work with our partner banks, merchants, payment aggregators, and other stakeholders towards the seamless rollout of card-on-file tokenisation services.
"If implemented well, this can prove as a game-changer towards strengthening the consumer trust and safety of the entire card-based payments ecosystem,” Datla added.
Mastercard and Visa, however, have not responded to a query on the pricing aspect.
Tokensisation by Visa is done by a solution called Cybersource while for Mastercard, there is Mastercard Payment Gateway Service (MPGS).
