On September 7, 2021, the Reserve Bank of India
(RBI) issued a directive with an objective to
enhance the regulatory framework on card tokenisation (2021
Directive).
BACKGROUND
The RBI prescribed certain restrictions on storage of cards data
under the Guidelines on Regulation of Payment Aggregators and
Payment Gateways issued on March 17, 2020 (PA-PG
Guidelines) and the clarifications issued in connection
with the PA-PG Guidelines on March 31, 2021.
In terms of the PA-PG Guidelines, neither the authorised
'payment aggregators' nor merchants (onboarded by payment
aggregators) are permitted to store customer card credentials.
These restrictions have severe repercussions for entities that
offer 'Card-on-File' services by storing card data for
future transactions. In view of the representations from the
industry, the RBI, on March 31, 2021, granted an extension till
December 31, 2021, to enable the payment system providers and
participants to put in place
