Directive on Tokenisation – Card Transactions – permitting Car-on-File Tokenisation (COFT) services (dated – 07.09.2021) – RBI
View PdfDirective on Tokenisation – Card Transactions – permitting Car-on-File Tokenisation (COFT) services (dated – 07.09.2021) – RBI
- On a review of the tokenisation framework and to enable cardholders to benefit from the security of tokenised card transactions as also the convenience of CoF, it has been decided to effect the following enhancements:
- Extend the device-based tokenisation1 framework referred to at paragraph 1 above to CoF Tokenisation (CoFT) as well.
- Permit card issuers to offer card tokenisation services as Token Service Providers2 (TSPs).
- The facility of tokenisation shall be offered by the TSPs only for the cards issued by / affiliated to them.
- The ability to tokenise3 and de-tokenise card data shall be with the same TSP.
- Tokenisation of card data shall be done with explicit customer consent requiring Additional Factor of Authentication (AFA) validation by card issuer.
- Additional requirements relating to CoFT are listed in the Annex.
- Further, in the interest of clarity, the following points may be noted – With effect from January 1, 2022, no entity in the card transaction / payment chain, other than the card issuers and / or card networks, shall store the actual card data. Any such data stored previously shall be purged.
- For transaction tracking and / or reconciliation purposes, entities can store limited data – last four digits of actual card number and card issuer’s name – in compliance with the applicable standards.
- Complete and ongoing compliance with the above by all entities involved, shall be the responsibility of the card networks. This directive is issued under Section 10 (2) read with Section 18 of Payment and Settlement Systems Act, 2007 (Act 51 of 2007).
