Tokenisation norms to come into effect from October 1 — is the industry ready?

After multiple extensions, the Reserve Bank of India's tokenisation norms are finally coming into effect from October 1.

The central bank believes that the tokenisation transition will prevent misuse of sensitive information that is shared with merchant websites while making a transaction using debit or credit cards.

As per the Reserve Bank of India’s (RBI's) mandate, tokenisation will replace the sensitive payment credentials with a unique id called a token. The token can be used to make online payments without actually filling in card details every time.

The RBI norms also mandate that merchant websites can no longer save card information, only banks and authorised card networks can do so. For customers, the benefits are two pronged — first a quicker checkout experience and an extra layer of security for the card details.

In an interview with CNBC-TV18, Vishal Mehta, Chairman of Merchant Payments Alliance, said the ecosystem is not ready for the change. He said they are seeing only about 60-70 percent success rate with the token system.

“When it comes to tokens, there are two aspects — one is provisioning of the token and second is processing of the transaction. While the provisioning seems to be working fine, the processing of transaction on tokens is still not to the level at which the earlier system was. Right now we are only seeing about 60-70 percent success rate. So tokenisation is definitely going to impact business especially for transactions which have shorter span of time to complete the purchase.

“When it comes to recurring transactions, we are even further not ready. There is no clarity for any subscription-based merchants on what is the readiness of the eco-system for the recurring based transactions”, Mehta added.

Harsh Vardhan Masta, Head of Digital Payments at Policybazaar believes that the regulator should implement tokenisation in a phased manner.

Masta said, “The direction in which we are moving with respect to digital payments is a good one. However we want the regulator to enforce a graded action plan with new guidelines. Graded plan would ensure phase-wise compliance at every level and would enable all the key players to be ready.”