Now tokenise debit, credit cards via Internet, mobile banking for online transactions: RBI issues new rules (2024)

The Reserve Bank of India (RBI) has issued rules on how individuals can tokenise their debit and credit cards via their banks. The central bank issued the new rules via a circular issued on December 20, 2023.

In October 2023, the RBI announced that tokenisation of debit and/or credit cards can be done via banks as well as card issuing networks. This was done to enhance customer convenience. Before this announcement, a customer has two options to complete online transactions done via debit and/or credit cards. These were - i) Enter the card details every time an online transaction is done via debit and/or credit card or ii) Tokenise the card details on the merchant’s website without saving the actual card details on the merchant’s website. This would have saved customers from entering card details every time an online transaction is done.

The new rules offer third method to customers to tokenise their debit and credit cards.

How to tokenise debit, credit cards via banks

As per the latest tokenisation rules issued by the RBI, an individual can tokenise their debit and credit cards through mobile banking and internet banking channels. To generate the tokens for cards, explicit consent from the customer must be taken. The tokenisation of cards must be done with Additional Factor Authentication (AFA) - also known as two-factor authentication, said RBI. The tokenisation of debit and credit cards will be done for the merchants selected by an individual. An individual can select multiple merchants while tokenising their cards and two-factor authentication can be combined for all the merchants.

Once the card is tokenised, the generated tokens will be available on the merchant’s payment page in the cardholder account of the merchant.

There is no time limit to tokenise the cards. A debit and/or credit card can be tokenised at any time as per the individual’s convenience. This means that tokens for debit and/or credit cards can be generated either when a new card is received by an individual or at a later date.

Also Read: New RBI rule to make debit card, credit card online transactions faster, secure

The bank or the card issuer is required to provide the complete list of merchants for whom it can provide tokenisation services. An individual can select the merchants with whom he/she wishes to maintain tokens.

The RBI rules further clarify that tokens for debit and/or credit cards can be issued either by a bank or card network issuer (Visa, MasterCard etc.) or both. With the new rules, an individual can tokenise their debit and credit cards for all the selected merchants available on the bank’s mobile or internet banking.

What is tokenisation of debit and credit cards?

According to the tokenisation FAQs issued by the RBI, “Tokenisation refers to replacement of actual card details with an alternate code called the “token”, which shall be unique for a combination of card, token requestor (i.e. the entity which accepts request from the customer for tokenisation of a card and passes it on to the card network to issue a corresponding token) and device (referred hereafter as “identified device”).”

Also Read: RBI takes another step to make debit, credit cards safer

A tokenised card transaction is considered safer as the actual card details are not shared with the merchant during transaction processing, as per RBI.

There are no charges to be paid for generating tokens of debit and credit cards. A customer will have the option to set and modify per-transaction and daily transaction limits for tokenised card transactions.

At the time of the announcement in October, the RBI governor said, “RBI introduced Card-on-File Tokenisation (CoFT) in September 2021 and began implementation from October 1, 2022. So far, over 56 crore tokens have been created on which transactions with value of over Rs 5 lakh crore have been undertaken. Tokenisation has improved transaction security and transaction approval rate. At present, Card-on-File(CoF) token can only be created through merchant’s application or webpage. It is now proposed to introduce CoF token creation facilities directly at the issuer bank level. This measure will enhance convenience for cardholders to get tokens created and linked to their existing accounts with various e-commerce applications. Instructions in this regard will be issued separately.”

...moreless

...moreless