Tokenisation

As per RBI’s Guidelines on Regulation of Payment Aggregators and Payment Gateways, neither the authorised Payment Aggregators (PAs) nor the merchants can store customer card credentials within their database or server after 30th June 2022. Read more on: Reserve bank of India’s website

After 30th June 2022, the actual card data would be deleted from the database of the merchants & the payment aggregators.

To continue faster checkout experience while ensuring security, kindly provide online merchants with the consent to save the cards in a form of a token.

With respect to online merchants, a token is a 16-digit number unique for a combination of card, token requestor and merchant. Through tokenization your actual card details are replaced with token credentials which can be used only with the intended merchant. Also, each token requestor is certified for safety & security as per international best practices / globally accepted standards.

The customers can provide the consent while:

1. Performing a transaction: Select to give customer consent to save the card credentials securely with the online merchant
3. Adding card with the online merchant:

Step 1: Add the card details [like card number, Expiry and CVV] and Give consent to save the card securely

Step 2: Enter the OTP received on the registered number with the bank

Apart from safety & security, tokenization provides the following other benefits to the cardholder:

1. Greater control of the card data:

Cardholders can view the list of merchants with whom they have saved the cards in a tokenised manner and delete any such token if required through one or more of the following bank’s channels – mobile application, internet banking, Interactive Voice Response (IVR) or at branches / offices.

2. Option to link renewed / replaced cards with existing merchants to ensure the checkout experience is not disrupted with card lifecycle changes.

There are two options to perform this action:

1. Manage existing payment information directly on the merchant website/ Application
2. Through one or more of the following bank’s channels – mobile application, internet banking, Interactive Voice Response (IVR) or at branches / offices.

In this case different tokens shall be created with the merchant and any action on one token would not impact the other.

With both, suspend or delete, a cardholder will not be able to perform any purchase transaction. However, when the token is suspended, it can be moved back to the active status to reinitiate purchases, while deleting a token is permanent and the cardholder would need to tokenise again to save payment credentials with the respective merchant. .

At the merchant website/Application, the cardholder would continue to see the last 4 digits of the actual card number along with the card art and/or name of the bank to differentiate the respective cards. Kindly note the token number saved with the merchant would not be visible to the end user.