MANU/RPRL/0130/2021

Ministry : Reserve Bank of India

Department/Board : RBI

Press Release No. : 2021-2022/823

Date : 07.09.2021

Notification/ Circulars Referred : RBI circular CO.DPSS.POLC.No.S33/02-14-008/2020-2021 dated March 31, 2021 MANU/RMIC/0036/2021

Citing Reference:
RBI circular CO.DPSS.POLC.No.S33/02-14-008/2020-2021 dated March 31, 2021 MANU/RMIC/0036/2021  Referred

Enhancement to tokenisation of card transactions

The Reserve Bank of India (RBI) has today announced the following enhancements to the extant framework on card tokenisation services:

a. the device-based tokenisation framework advised vide circulars of January 2019 and August 2021 has been extended to Card-on-File Tokenisation (CoFT) services as well, and

b. card issuers have been permitted to offer card tokenisation services as Token Service Providers (TSPs). The tokenisation of card data shall be done with explicit customer consent requiring Additional Factor of Authentication (AFA).

The above enhancements are expected to reinforce the safety and security of card data while continuing the convenience in card transactions.

Citing the convenience and comfort factor for users while undertaking card transactions online, many entities involved in the card payment transaction chain store actual card details [also known as Card-on-File (CoF)]. In fact, some merchants force their customers to store card details. Availability of such details with a large number of merchants substantially increases the risk of card data being stolen. In the recent past, there were incidents where card data stored by some merchants have been compromised / leaked. Any leakage of CoF data can have serious repercussions because many jurisdictions do not require an AFA for card transactions. Stolen card data can also be used to perpetrate frauds within India through social engineering techniques.

........