The Reserve Bank of India (RBI) on Thursday released guidelines to ease the transition to new norms on card-on-file (CoF) tokenisation and licensing of payment aggregators (PAs) in two separate notifications.
While reiterating that with effect from October 1, no entity in the card transaction chain, other than card issuers and card networks, shall store CoF data, the central bank notified two interim measures. Other than the card issuer and the card network, the merchant or its PA involved in settlement can save the CoF data for a maximum period of four days after the transaction date or till the settlement date, whichever is earlier. This data shall be used only for settlement of such transactions, and must be purged thereafter, the RBI said.
Also, for handling other post-transaction activities, acquiring banks can continue to store CoF data until January 31, 2023. “Appropriate penal action, including imposition of business restrictions, shall be considered by the RBI in case of any non-compliance,” the central bank said.
On guidelines for PAs and payment gateways, the RBI took note of the disruption caused by the pandemic and allowed a fresh window for all PAs existing as on March 17, 2020 to apply for authorisation. They will now be allowed to apply by September 30, 2022 and shall have a net worth of Rs 15 crore as on March 31, 2022.
They will also be permitted to continue their operations till they receive communication from the RBI regarding the fate of their application. The timeline of March 31, 2023 for achieving a net worth of Rs 25 crore will remain.
The RBI said applications received from some PAs had to be returned as they had not complied with the eligibility criteria, including the minimum net worth criterion of Rs 15 crore by March 31, 2021.
“This also implied that they have to discontinue their operations within a period of six months from the date of return of application. Though they have the option to apply afresh on meeting the prescribed criteria, ceasing operations may lead to disruption in payment systems,” the regulator said, adding that some PAs may not have applied due to non-fulfilment of eligibility criteria.