New Delhi: There is a lot of anxiety among merchants and consumers about making a smooth transition to the Card-on-File Tokenisation (CoFT) regime starting 1st of July 2022, a panel found during a webinar held in partnership with The Quantum Hub (TQH) under ThePrint ValueAd initiative.
The token system is being enabled after the Reserve Bank of India issued guidelines in March 2020 to prohibit merchants, acquirers payment aggregators from storing customer card information. This is being done to reduce fraud and enhance security of card payments by limiting the number of players who can save card information.
The discussion, held between consulting firm The Quantum Hub’s founding partner Rohit Kumar and Microsoft’s Asia Pacific payments head Vishal Mehta, tried to unpack the different elements of ecosystem readiness to understand if India was truly ready to migrate to the tokenisation regime. Explaining what tokenisation was, Kumar said: “This will basically allow card details to be replaced by an alphanumeric code that is unique to every combination of card and merchant and these generated tokens will then be used for actioning payments.”
In response to the question on implications, Vishal Mehta – who is also the Chairperson of the Governing Council of the Merchants Payments Alliance of India – said that all e-commerce transactions would be impacted by tokenisation. “All transactions which we do regularly or when we buy on Flipkart or Amazon, or, order food on Swiggy, Zomato — all day-to-day transactions will be impacted.’’
Kumar asked “But isn’t the data that is being released in the public suggesting that we are getting ready? For instance, Visa and Mastercard have said that tokenisation solutions are ready at their end and ~90% of cards in circulation can be used with the new system. Even Paytm announced in May that it had already tokenised 28 million cards. We have been getting some request to tokenise emails from merchants like Facebook as well. What does this mean and are the worries unfounded?”
Mehta replied that the numbers being shared do not reflect “end-to-end readiness”; instead they reflect only the provisioning or generation of tokens. Today, while provisioning of tokens is not a problem, processing of tokens is likely to pose a challenge.” Very few merchants have so far tested processing; the latest numbers we have are from a few weeks ago and these are much lower than the volumes that are needed for smooth functioning.
Mehta felt the time period of execution is too tight and there has not been enough opportunity for merchants to test and ensure that tokenisation was working. “Can we go ahead and purge the cards confidently because this is an irreversible step? Once we purge the cards — which is mandatory as part of the regulation – there’s no looking back. We lose those customers forever,” he said.
Mehta also cautioned that “There’s a significant chance of all the bills which we are paying on a regular basis, whether it’s utility bills or telephone bills, internet bills, all these can also be impacted.”
To understand readiness of the payments ecosystem holistically, one has unpack tokenisation to examine different workflows. Mehta added that this includes not just vanilla processing but also other services that a customer is used to, such as EMIs, offers, refunds, guest checkouts and cross-border payments.
Kumar concluded by saying that, “Ultimately, the one that stands to lose the most in this uncertainty is the customer”. The regulator should build more “trust in the ecosystem” and calm nerves by releasing the necessary information before the deadline kicks in.
(ThePrint ValueAd Initiative content is a paid-for, sponsored article.)