The Reserve Bank of India (RBI) in a circular on Thursday notified that all entities, with the exception of card issuers and card networks, are required to purge the Card-On-File (CoF) data stored previously by October 1, 2022.
The following interim measures have been approved by the RBI to make the transition to an alternative system for transactions easier.
In addition to the card issuer and the card network, the merchant or its Payment Aggregator (PA) participating in transaction settlement may keep CoF data for a maximum of T+4 days (where "T" denotes the transaction date) or until the settlement date, whichever comes first.
These records must be deleted after use and must only be utilised for the settlement of such transactions.
The acquiring banks may keep CoF data on file until January 31, 2023, for use in handling any post-transaction activities.
In the event of any non-compliance, the RBI will take the appropriate disciplinary action, including the imposition of business restrictions.
(Edited by : Anand Singha, Priyanka Deshpande)
