Last week Apple informed its customers in India that it will no longer store their card information and will no longer accept debit card and credit card payments for purchases or subscriptions on the App Store or other Apple services in light of the upcoming changes to RBI regulations. It will continue to accept payments through UPI.
The US giant’s decision surprised many. But not those scrambling to meet the RBI deadline for card tokenization, which is June 30, 2022.
As of July 1st, merchants, payment aggregators, payment gateways and acquiring banks will no longer be able to store customers’ card details. Only card-issuing banks and card networks can store the actual card data.
As businesses still grapple with the disruptions caused by the RBI’s rules for card-based recurring payments, which went into effect on January 1 this year, another storm is brewing for them.
Companies and other entities that have stored such data must delete it and apply tokenization.
Tokenization is the replacement of a card number with an alternative code called a “token”. Once created, the tokenized card details are used in place of the actual card number for online purchases initiated or directed by the cardholder.
A tokenized card transaction is considered more secure as the actual card details are not shared with the merchant during transaction processing. It will reduce the chance of card information leakage.
Businesses may store the last four digits of the card number and card issuer name for transaction tracking and reconciliation purposes. Customer consent and OTP-based authentication are required to create a token.
However, a customer can still choose not to tokenize their card. In such a case, customers must enter full card details for each payment.
This could result in a drop in sales for merchants as a significant number of conversions come from saved cards.
The first RBI deadline to tokenize the card data was June 30, 2021. However, at the request of merchants and payment aggregators as well as card companies and banks, it has been extended to December 31, 2021. And the deadline was again extended by six months.
Earlier this month, Paytm announced that it has tokenized 2.8 million cards from Visa, Mastercard, and Rupay, accounting for 80% of the monthly active cards on the app. Other companies are also urging users to tokenize their cards to enjoy a seamless experience starting July 1st.
For example, every time a user opens the Swiggy app, they are greeted with a message at the bottom of the screen to secure their cards before June 30th.
PayU, Razorpay, PhonePe, Worldline and Pine Labs are among the companies that have developed tokenization solutions to help companies transition to the new framework.
Khilan Haria, VP and Head of Payments Product, Razorpay, told Business Standard that Visa, Mastercard, Rupay and Diners Club have gone live on its tokenization platform, and American Express is expected to go live soon. However, not only card networks but also card-issuing banks have to get on board.
Where is the payments ecosystem in terms of readiness in just about five weeks?
Speak with business standardKhilan Haria, VP and Head of Payments Product, Razorpay says we don’t expect any major disruptions from July 1st. 100% of Razorpay merchants use the tokenization solution, and after tokenization, the card networks are ready to process transactions at scale
4. The majority of banks are also expected to be ready
Meanwhile, banks’ failure to comply with RBI’s rules on recurring payments is already leading to a large number of recurring transaction failures.
Razorpay’s Khilan Haria said it would take about 6-9 more months to reach the stabilization phase where coverage is almost complete.
Several banks have yet to integrate with mandate hubs like BillDesk’s SiHub or Razorpay’s MandateHQ, affecting publishers, B2B SaaS companies, as well as small businesses and startups that mostly depend on subscriptions for revenue.
While recurring payments still make up only a small fraction of total payments, the magnitude of the impact of card tokenization will be huge, affecting merchants of all sizes, including large e-commerce companies and grocery delivery companies.
The Merchants Payments Alliance of India, whose members include Netflix, BookMyShow, Disney+Hotstar, Microsoft and Zoom, said it had determined the back-end infrastructure needed was not ready.
Unless the back-end infrastructure for processing tokenized payments is ready by June 30, data sanitization by merchants and payment aggregators would result in a collapse of settlements, reconciliations, and services such as refunds, cashbacks, and chargebacks.
The alliance said that without demonstrated ecosystem readiness at scale for all use cases, data cleansing would result in business continuity challenges for merchants of all sizes.
Vivan Sharan, Secretary, The Merchants Payments Alliance of India (MPAI), says we have limited insight into the readiness state of the payments ecosystem. We still don’t have definitive APIs that will allow consumers to transact, he says, adding that there is good progress on the token generation side. Token processing solutions are still under development/early testing.
As some banks, especially smaller ones, will not be compliant from day one, customers can expect some friction when making online payments.
Conclusion: The transition to the new payment regime will certainly not go smoothly. Small traders and consumers will have problems. The next five weeks will be critical in this transition. Banks and other players in the payments ecosystem need to work together to ensure everything is in alignment.
