RBI issues notification on Restriction on Storage of Actual Card Data; re-iterates that w.e.f 01.10.2022 , no entity in the card transaction / payment chain, other than the card issuers and / or card networks, should store CoF data

The Reserve Bank of India has issued a notification on “Restriction on Storage of Actual Card Data [i.e. Card-on-File (CoF)]”

Background:

In previous circulars (please refer to the trailing e-mails for a detailed read), RBI had informed that with effect from October 1, 2022, no entity in the card transaction / payment chain, other than the card issuers and / or card networks, should store CoF data, and any such data stored previously has to be purged.

On a review of the issues involved and after detailed discussions thereon with all stakeholders, as also keeping in view that sufficient time has elapsed since the requirements were specified, the following are advised –

• There will be no change in the effective date of implementation of the requirements – all entities, except card issuers and card networks, shall purge the CoF data before October 1, 2022.
• For ease of transition to an alternate system in respect of transactions where cardholders decide to enter the card details manually at the time of undertaking the transaction (commonly referred to as “guest checkout transactions”), the following are being permitted as an interim measure –

1. 1. Other than the card issuer and the card network, the merchant or its Payment Aggregator (PA) involved in settlement of such transactions, can save the CoF data for a maximum period of T+4 days (“T” being the transaction date) or till the settlement date, whichever is earlier. This data shall be used only for settlement of such transactions, and must be purged thereafter
   2. For handling other post-transaction activities, acquiring banks can continue to store CoF data until January 31, 2023.

Please note, appropriate penal action, including imposition of business restrictions, shall be considered by the RBI in case of any non-compliance.

Source: Reserve Bank of India