RBI bars American Express, Diners Club from adding new customers over non-compliance of data storage norms

American Express Banking Corp and Diners Club International Ltd are Payment System Operators authorised to operate Card Networks in the country under the Payment and Settlement Systems Act, 2007 (PSS Act).

The supervisory action has been taken in exercise of powers vested in RBI under Section 17 of the PSS Act," the statement read.

RBI had issued a circular in April 2018 on Storage of Payment System Data, directing all payment system providers to ensure that within a period of six months the entire data (end-to-end transaction details/information collected/carried/processed as part of the message/payment instruction) relating to payment systems operated by them is stored in a system only in India.

They were required to report compliance to RBI and submit a board-approved System Audit Report (SAR) conducted by a CERT-in empanelled auditor within the specified timeline.

American Express issued a statement saying, "We have been in regular dialogue with the Reserve Bank of India about data localization requirements and have demonstrated our progress towards complying with the regulation. While we’re disappointed that the RBI has taken this course of action, we are working with them to resolve their concerns as quickly as possible. This does not impact the services that we offer to our existing customers in India, and our customers can continue to use and accept our cards as normal."