Apathy may cost merchants dear as tokenization deadline nears

Payment companies in India may have started rolling out solutions in full swing to help merchants speed up tokenization in a bid in accordance with the Reserve Bank of India (RBI) mandate but they fear that merchants may not meet the deadline, resulting in another massive disruption of services similar to the one seen in October when RBI rules on recurring payments were enforced.

The Reserve Bank of India (RBI) said in a notification, published in September, that with effect from January 1, 2022, no entity in the card transaction or payment chain, other than the card issuers and/or card networks, shall store actual card data. Any such data stored previously shall be purged, RBI added.

Following the notification, Razorpay, PayU, PhonePe and the National Payments Council of India (NPCI) have launched solutions in partnership with card providers to help merchant partners to create and modify tokens for card payments.

On November 2, PhonePe announced PhonePe SafeCard, a tokenized solution for card-based transactions. Likewise, on October 28, PayU launched PayU Token Hub in collaboration with Wibmo to help businesses tokenize card details. Razorpay launched RazorPay Token HQ on October 23 and has been working with its partner merchants to ensure its entire base of 5 million users is ready to implement tokenization.

However, a lot more needs to be done, according to payment companies. India had 920 million debit cards and 65 million credit cards in use as of September 2021, according to RBI. The central bank reasons that a tokenized card transaction is safer as the actual card details are not shared with the merchant during the processing of a transaction. However, payment companies fear many merchants may not meet this deadline.

Harshil Mathur, CEO and co-founder Razorpay, is concerned about the lack of awareness among many merchants about the new mandate. “We are trying to make merchants aware that this rule is coming and if you are doing card savings, you need to tokenize them. A lot of merchants don't understand how serious this is and still believe that RBI will extend the deadline, which may or may not happen,” explains Mathur.

Mathur also insists that merchants have been given enough time to implement tokenization. “Our solution has been built keeping in mind that RBI will not extend the deadline. Our solution is plug and play and with all the testing, merchants can go live in a week’s time. The only challenge is that the ecosystem needs to take it seriously,” he adds.

Not everyone agrees, though. There are those who agree that the timely rollout of the tokenization solutions is a positive move, but believe that the time left to implement tokenization at a pan India level is short.

Sijo Kuruvilla George, executive director, Alliance of Digital India Foundation (ADIF) hopes the deadline will be extended by a few months to ensure that businesses have more options at their disposal and aren’t forced to hurry through the switch. “Even if it is extended by 3 months, it will definitely serve as both a relief and a confidence-building measure,” said George.

“When the window of change is small, larger players tend to be at an advantage. It is not about some companies adapting to the service, but rather about the majority of startups also being able to do so. It is important that every player is given a fair chance to complete their transitions properly and that it doesn't turn into an access game,” he elaborated.

Mathur, on his part, points out that tokenization may affect larger merchants and businesses more as compared to small merchants who typically do not save card details as they are not PCI-DSS (Payment Card Industry - Data Security Standard) compliant.

Manya Madan, the founder of Zoconut, a B2B nutrition tech startup, agrees that the tokenization process might not have a major impact on small businesses, adding, “We are in process of adhering to the January 1, 2022 deadline for adopting tokenization on our platform. However, I don’t believe that tokenization will help businesses encourage consumers to set up recurring payments with different platforms.”

She added, though, "While the logic behind RBI’s move can be seen, it would have been a better idea for the regulators to have banks and card issuers adopt features that enhance safety and cut down on cyber frauds."