India’s payment gateways seek exemption from data storage clause under new RBI guidelines

• Follow

The Reserve Bank of India (RBI) has reportedly refused to accept the demands raised by India’s payment gateways seeking exemptions on a few of the new regulatory norms including the one which does not allow merchants to store details of credit and debit cards.

As per the new guidelines the payment operations will have to offer a one-click checkout option to users starting January next year. The online payment platforms are also seeking an exemption under this provision, according to a report in the Economic Times.

As per the new norms, millions of debit and credit cardholders in India now will need to enter their 16-digit card number every time they transact online as opposed to simply entering their CVV numbers and the OTP to authenticate their payments. Under the new Payment Aggregator/Payment Gateways rules, every online merchant processing the transactions will now have access to a tokenised key lined with the customer’s cards as opposed to the entire card file.

Authorised card operators will still have the permission to store debit and credit card details for processing redressals and chargebacks seamlessly. However, under the new rules, they won’t be allowed to use this data for auto-checkouts.

Consumer’s security is paramount

The new rules have been framed by the country’s apex bank to keep matters of security of the consumers on priority, as per the media report. The existing system is susceptible to cybercrimes and data breaches as the card details of the customers are stored on the merchant’s servers which are not under the direct supervision of the RBI.

The Payments Council of India (PCI) has proposed secure reference on file as an alternative solution to encryption through tokenisation. The industry group argues that authorised operators are storing card data on isolated servers and they may be used for allowing single-click checkouts with the consent of the customer.

Industry groups demanded the deadlines of implementation of the new guidelines should be extended and the storage conditions struck off in a recent meeting with the RBI. The meeting was held to assess the developments of the process of implementation of the new guidelines. But RBI is said to have declined the request.