Skip to main content

What is tokenisation of card transactions?

Reserve Bank of India (RBI) has issued guidelines on tokenisation of card transactions. 

What is tokenisation?

Tokenisation refers to replacement of actual card details with an alternate code called the “token”, which shall be unique for a combination of card, token requestor and device.

What is de-tokenisation?

Conversion of the token back to actual card details is known as de-tokenisation.

What is the benefit of tokenisation?

As the actual card details are not shared with the merchant during a transaction, it is expected to make card transactions more safe, secure and convenient for the users. 

Which devices or use cases are covered for tokenisation?

Authorised card payment networks are allowed to offer card tokenisation services to any token requestor (i.e., third party app provider), through mobile phones, tablets, laptops, desktops, wearables (wrist watches, bands, etc.), Internet of Things (IoT) devices, etc. for all use cases / channels (e.g., contactless card transactions, payments through QR codes, apps etc.)

What are the conditions for offering tokenisation facility?

  • Registration of card on token requestor’s app shall be done only with explicit customer consent through Additional Factor of Authentication (AFA). It shall not be mandatory for the customers to tokenise their cards.
  • Customers shall have option to register / de-register their card for a particular use case, i.e., contactless, QR code based, in-app payments, etc.
  • Customers shall be given option to set and modify per transaction and daily transaction limits for tokenised card transactions.
  • A customer shall have option to request for tokenisation of any number of cards. For performing any transaction, the customer shall be free to use any of the cards registered with the token requestor app.
  • Customers shall be given option to tokenise their cards on any number of devices.
  • No charges should be recovered from the customer for availing tokenisation service.
  • All extant instructions of Reserve Bank of India (RBI) on safety and security of card transactions, including the mandate for Additional Factor of Authentication (AFA) / PIN entry shall be applicable for tokenised card transactions as well.
  • Before providing card tokenisation services, authorised card payment networks shall put in place a mechanism for periodic system audit at frequent intervals, of all entities involved in providing card tokenisation services to customers. This system audit shall be undertaken by empanelled auditors of Indian Computer Emergency Response Team (CERT-In).

What is the deadline for tokenisation of cards?

  • With effect from October 01, 2022, no entity in the card transaction / payment chain, other than the card issuers and / or card networks, shall store the actual card data. Any such data stored previously shall be purged.
  • For transaction tracking and / or reconciliation purposes, entities can store limited data – last four digits of actual card number and card issuer’s name – in compliance with the applicable standards.

How to get card tokenised?

The card holder can get the card tokenised by initiating a request on the app provided by the token requestor. The token requestor will forward the request to the card network which, with the consent of the card issuer, will issue a token corresponding to the combination of the card, the token requestor, and the device.

(Updated on January 06, 2024)

The tokenisation facility will also be offered directly through card issuing banks / institutions enabling cardholders to tokenise their cards for multiple merchant sites through a single process. 

  • Generation of CoF Tokens for a card, through the card issuer, can be enabled through mobile banking and internet banking channels.
  • CoFT generation shall be done only on explicit customer consent, and with AFA validation. If the cardholder selects multiple merchants for which to tokenise his / her card, AFA validation may be combined for all these merchants.
  • The tokens thus generated shall be made available on the merchant’s payment page, in the cardholder’s account with the merchant.
  • The cardholder may tokenise the card either on receipt of the new card or later.
  • The card issuer shall provide a complete list of merchants for whom it can provide tokenisation services and the cardholder can make his selection from the list.
  • The card token may be so issued either by the card network or the issuer or both.

Whom to approach in case of issues with tokenisation?

In case of any issues with regard to the tokenisation or loss of device, it shall be reported to / raised with the card issuer.


References

Reserve Bank of India. (2019, January 08). 'Tokenisation – Card transactions. Retrieved from https://rbi.org.in/Scripts/NotificationUser.aspx?Id=11449&Mode=0

Reserve Bank of India. (2021, August 25). 'Tokenisation – Card Transactions : Extending the Scope of Permitted Devices'. Retrieved from https://rbi.org.in/Scripts/NotificationUser.aspx?Id=12152&Mode=0

Reserve Bank of India. (2021, September 07). 'Tokenisation – Card Transactions: Permitting Card-on-File Tokenisation (CoFT) Services'. Retrieved from https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12159&Mode=0

Reserve Bank of India. (2022, September 26). 'FAQ-Device based Tokenisation – Card Transactions'. Retrieved from https://rbi.org.in/Scripts/FAQView.aspx?Id=129

Reserve Bank of India. (2022, July 28). 'Restriction on Storage of Actual Card Data [i.e. Card-on-File (CoF)]'. Retrieved from https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12363&Mode=0

Reserve Bank of India. (2023, December 20). 'Card-on-File Tokenisation (CoFT) – Enabling Tokenisation through Card Issuing Banks'. Retrieved from https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12573&Mode=0


Follow at - Telegram   Instagram   LinkedIn   Twitter

Labels:

Comments

Post a Comment

Popular Posts

Highlights of RBI Annual Report 2023-24 – Chapter 7 to 12

Reserve Bank of India (RBI) has published its annual report for the financial year 2023-24. In a series of articles, we will go through the highlights of the report. This is the fifth and last article in the series.  Chapter 7 – Public Debt Management Ways And Means Advances (WMA) limit for the Government of India (GoI) for H1:2023-24 (April to September 2023) was fixed at ₹1,50,000 crore and for H2:2023-24 (October 2023 to March 2024) was fixed at ₹50,000 crore. RBI issued an ultra-long security of 50-year tenor aggregating ₹30,000 crore to cater to the growing needs of long-term institutional players. Issuance of Sovereign Green Bonds (SGrBs) for an aggregate amount of ₹20,000 crore included maiden issuance of 30-year (₹10,000 crore) SGrB in addition to 5-year (₹5,000 crore) and 10-year (₹5,000 crore) SGrBs. A new 3-year benchmark security was introduced as part of government market borrowing programme during H1:2023-24.  The basket of products offered through the ‘Retail ...
Post a Comment
Read more

Lending against Gold and Silver collateral

Reserve Bank of India (RBI) has issued directions on lending against the collateral of gold and silver. To whom are the directions applicable? The directions are applicable to the following regulated entities (REs) – Commercial Banks (including Small Finance Banks, Local Area Banks and Regional Rural Banks, but excluding Payments Banks). Primary (Urban) Co-operative Banks (UCBs) & Rural Co-operative Banks (RCBs), i.e., State Co-operative Banks (StCBs) and Central Co-operative Banks (CCBs). Non-Banking Financial Companies (NBFCs), including Housing Finance Companies (HFCs). Which loans are covered under the directions? The directions shall apply to all loans offered by an RE for the purpose of consumption or income generation (including farm credit) where eligible gold or silver collateral is accepted as a collateral security. What is eligible collateral? Eligible collateral means the collateral of jewellery, ornaments or coins made of gold or silver. A lender shall not grant any ad...
Post a Comment
Read more

Prior approvals from or intimations / reporting to RBI by NBFC-BL

Non-Banking Financial Companies (NBFCs) are required to obtain prior approvals from Reserve Bank of India (RBI) or intimate / report to RBI various events. This article lists out some of such important events where prior approvals or intimations / reporting is required for Base Layer NBFCs (NBFC-BL). Events requiring prior approval from RBI  Master Direction – Reserve Bank of India (Non-Banking Financial Company – Scale Based Regulation) Directions, 2023 dated October 19, 2023 Para 30 – NBFCs shall prepare its balance sheet and profit and loss account as on March 31 every year. Whenever an NBFC intends to extend the date of its balance sheet as per provisions of the Companies Act, 2013, it shall take prior approval of RBI before approaching the Registrar of Companies for this purpose. Even in cases where RBI and the Registrar of Companies grant extension of time, the NBFC shall furnish to RBI a proforma balance sheet (unaudited) as on March 31 of the year and the statutory returns ...
Post a Comment
Read more

RBI’s Monetary Policy (June 06, 2025): In A Nutshell

The bi-monthly monetary policy of Reserve Bank of India (RBI) was announced on June 06, 2025. Here are some of the highlights of the monetary policy announcement. Rates   Change Rate Policy repo rate Reduced by 0.50% 5.50% Standing deposit facility (SDF) rate 5.25% Marginal standing facility (MSF) rate 5.75% Bank rate 5.75% Monetary policy stance Monetary policy stance was changed from ‘accommodative’ to ‘neutral’. Domestic Economy  The Indian economy presents a picture of strength, stability, and opportunity. The 5x3x3 matrix of fundamentals provides the necessary core strength to cushion the Indian economy against global spillovers and propel it to grow at a faster pace.  First, strength comes from the strong balance sheets of the 5 major sectors - corporates, banks, households, government, and the external sector.  Second, there is stability on all 3 fronts – price, financial, and political – providing policy and economic certainty.  Third, the Indian ec...
Post a Comment
Read more

What is KYC?

Be it opening a new bank account, applying for a new credit card, registering for new e-wallet, or any other account or facility involving financial matters, the application process is incomplete until KYC is done.  What is KYC? KYC or Know Your Customer is a process of customer identification and verification while opening an account or undertaking a financial transaction. Why is KYC process needed? To prevent money laundering To combat financing of terrorism What is verified under KYC? The banks / financial institutions collect the relevant documents from the customers to verify the following – Proof of identity Proof of address Which documents can be collected for KYC? As per RBI’s Master Direction - Know Your Customer (KYC) Direction, 2016 (Updated as on May 10, 2021), “Officially Valid Document” (OVD) means – Passport Driving licence Proof of possession of Aadhaar number Voter's Identity Card issued by the Election Commission of India Job card issued by NREGA duly signed by an...
Post a Comment
Read more