Skip to main content

What is tokenisation of card transactions?

Reserve Bank of India (RBI) has issued guidelines on tokenisation of card transactions. 

What is tokenisation?

Tokenisation refers to replacement of actual card details with an alternate code called the “token”, which shall be unique for a combination of card, token requestor and device.

What is de-tokenisation?

Conversion of the token back to actual card details is known as de-tokenisation.

What is the benefit of tokenisation?

As the actual card details are not shared with the merchant during a transaction, it is expected to make card transactions more safe, secure and convenient for the users. 

Which devices or use cases are covered for tokenisation?

Authorised card payment networks are allowed to offer card tokenisation services to any token requestor (i.e., third party app provider), through mobile phones, tablets, laptops, desktops, wearables (wrist watches, bands, etc.), Internet of Things (IoT) devices, etc. for all use cases / channels (e.g., contactless card transactions, payments through QR codes, apps etc.)

What are the conditions for offering tokenisation facility?

  • Registration of card on token requestor’s app shall be done only with explicit customer consent through Additional Factor of Authentication (AFA). It shall not be mandatory for the customers to tokenise their cards.
  • Customers shall have option to register / de-register their card for a particular use case, i.e., contactless, QR code based, in-app payments, etc.
  • Customers shall be given option to set and modify per transaction and daily transaction limits for tokenised card transactions.
  • A customer shall have option to request for tokenisation of any number of cards. For performing any transaction, the customer shall be free to use any of the cards registered with the token requestor app.
  • Customers shall be given option to tokenise their cards on any number of devices.
  • No charges should be recovered from the customer for availing tokenisation service.
  • All extant instructions of Reserve Bank of India (RBI) on safety and security of card transactions, including the mandate for Additional Factor of Authentication (AFA) / PIN entry shall be applicable for tokenised card transactions as well.
  • Before providing card tokenisation services, authorised card payment networks shall put in place a mechanism for periodic system audit at frequent intervals, of all entities involved in providing card tokenisation services to customers. This system audit shall be undertaken by empanelled auditors of Indian Computer Emergency Response Team (CERT-In).

What is the deadline for tokenisation of cards?

  • With effect from October 01, 2022, no entity in the card transaction / payment chain, other than the card issuers and / or card networks, shall store the actual card data. Any such data stored previously shall be purged.
  • For transaction tracking and / or reconciliation purposes, entities can store limited data – last four digits of actual card number and card issuer’s name – in compliance with the applicable standards.

How to get card tokenised?

The card holder can get the card tokenised by initiating a request on the app provided by the token requestor. The token requestor will forward the request to the card network which, with the consent of the card issuer, will issue a token corresponding to the combination of the card, the token requestor, and the device.

(Updated on January 06, 2024)

The tokenisation facility will also be offered directly through card issuing banks / institutions enabling cardholders to tokenise their cards for multiple merchant sites through a single process. 

  • Generation of CoF Tokens for a card, through the card issuer, can be enabled through mobile banking and internet banking channels.
  • CoFT generation shall be done only on explicit customer consent, and with AFA validation. If the cardholder selects multiple merchants for which to tokenise his / her card, AFA validation may be combined for all these merchants.
  • The tokens thus generated shall be made available on the merchant’s payment page, in the cardholder’s account with the merchant.
  • The cardholder may tokenise the card either on receipt of the new card or later.
  • The card issuer shall provide a complete list of merchants for whom it can provide tokenisation services and the cardholder can make his selection from the list.
  • The card token may be so issued either by the card network or the issuer or both.

Whom to approach in case of issues with tokenisation?

In case of any issues with regard to the tokenisation or loss of device, it shall be reported to / raised with the card issuer.


References

Reserve Bank of India. (2019, January 08). 'Tokenisation – Card transactions. Retrieved from https://rbi.org.in/Scripts/NotificationUser.aspx?Id=11449&Mode=0

Reserve Bank of India. (2021, August 25). 'Tokenisation – Card Transactions : Extending the Scope of Permitted Devices'. Retrieved from https://rbi.org.in/Scripts/NotificationUser.aspx?Id=12152&Mode=0

Reserve Bank of India. (2021, September 07). 'Tokenisation – Card Transactions: Permitting Card-on-File Tokenisation (CoFT) Services'. Retrieved from https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12159&Mode=0

Reserve Bank of India. (2022, September 26). 'FAQ-Device based Tokenisation – Card Transactions'. Retrieved from https://rbi.org.in/Scripts/FAQView.aspx?Id=129

Reserve Bank of India. (2022, July 28). 'Restriction on Storage of Actual Card Data [i.e. Card-on-File (CoF)]'. Retrieved from https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12363&Mode=0

Reserve Bank of India. (2023, December 20). 'Card-on-File Tokenisation (CoFT) – Enabling Tokenisation through Card Issuing Banks'. Retrieved from https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12573&Mode=0


Follow at - Telegram   Instagram   LinkedIn   Twitter

Labels:

Comments

Post a Comment

Popular Posts

Payment of Agency Commission to Agency Banks (ABs) and Disbursement of Government Pension by ABs

Reserve Bank of India (RBI) has issued guidelines on the conduct of Government business by Agency Banks (ABs), payment of agency commission to ABs and disbursement of Government pension by ABs. Who are ABs? ABs mean all Public Sector Banks (PSBs), scheduled Private Sector Banks (PVBs), scheduled Payments Banks (PBs), and scheduled Small Finance Banks (SFBs) appointed by the RBI under Section 45 of the RBI Act, 1934, by mutual agreement, to carry out Government banking business of the Central Government (CG) / State Governments (SGs). What is agency commission? Agency commission means the remuneration paid by the RBI to an AB in consideration of it acting as an agent of the RBI in the conduct of general banking business of the CG and the SGs at the places and in the manner specified in the agreement between the RBI and the bank, with the exception of the functions relating to the management of the public debt. What are the guidelines on appointment of ABs? Any eligible bank which intend...
Post a Comment
Read more

Kisan Credit Card (KCC) Scheme

Reserve Bank of India (RBI) has issued directions on Kisan Credit Card (KCC) Scheme. To whom are the directions applicable? The directions are applicable to the following entities – Commercial Banks (excluding overseas branches of Indian banks) Small Finance Banks (SFBs) Regional Rural Banks (RRBs) Rural Co-operative Banks – State Co-operative Banks (StCBs) Central Co-operative Banks (CCBs) To which loans shall the directions be applicable? The directions shall be applicable to loans sanctioned under the KCC Scheme with effect from January 01, 2027.  What are the crop seasons? Crop season means the period up to harvesting and marketing of the crops raised. Short duration crops shall mean crops with anticipated period from sowing to marketing up to 12 months. Long duration crops mean crops which are not short duration crops. The crop season for long duration crops i.e., anticipated period from sowing to marketing is more than 12 months and up to 18 months. For the purpose of the KCC...
Post a Comment
Read more

Credit Derivatives

Reserve Bank of India (RBI) has issued directions on credit derivatives. What is Credit Derivative? Credit derivative means a derivative contract whose value is derived from the credit risk of an underlying debt instrument or an index of underlying debt instruments. What is Credit Default Swap (CDS) and Total Return Swap (TRS)? Credit Default Swap (CDS) means a credit derivative contract in which one counterparty (protection seller) commits to pay to the other counterparty (protection buyer) in the case of a credit event with respect to a reference entity and in return, the protection buyer makes periodic payments (premium) to the protection seller until the maturity of the contract or the credit event, whichever is earlier. Total Return Swap (TRS) means a credit derivative contract under which one counterparty (total return payer) commits to transfer the entire economic performance of a reference asset to the other counterparty (total return receiver), and, in return, receives a pre-d...
Post a Comment
Read more

Deposits between a person resident in India and a person resident outside India

Reserve Bank of India (RBI) has updated the regulations on deposits between a person resident in India and a person resident outside India. What are the restrictions on deposits between a person resident in India and a person resident outside India? No person resident in India shall accept any deposit from, or make any deposit with, a person resident outside India. However, the following deposits are exempted – Deposits held in rupee accounts maintained by foreign diplomatic missions and diplomatic personnel and their family members in India with an authorised dealer. Deposits held by diplomatic missions and diplomatic personnel in special rupee accounts namely Diplomatic Bond Stores Account to facilitate purchases of bonded stocks from firms and companies who have been granted special facilities by customs authorities for import of stores into bond. The funds in the account may be repatriated outside India without the approval of the RBI. Deposits held in accounts maintained in foreig...
Post a Comment
Read more

Lead Bank Scheme (LBS)

Reserve Bank of India (RBI) has issued guidelines on the Lead Bank Scheme (LBS). Who is a Lead Bank? RBI designates a commercial bank as Lead Bank in each district, to coordinate the efforts of the banks, Government, National Bank for Agriculture and Rural Development (NABARD) and other stakeholders at the district level to improve credit flow to the priority sectors and promote financial inclusion in the district. 12 public sector banks and 2 private sector banks (Jammu & Kashmir Bank and ICICI Bank) have been assigned lead bank responsibilities, covering 778 districts across the country. What appointments are made under the LBS? Every lead bank shall appoint a Lead District Manager (LDM) in each district where it has the lead bank responsibility, to exclusively oversee and coordinate the implementation of the LBS in the district. NABARD shall appoint a District Development Manager (DDM) for each district to act as a liaison between NABARD and the district-level banking and financ...
Post a Comment
Read more