Card-on-File (CoF) Tokenisation: RBI Directive & Impacts
Introduction
Card-on-File (CoF) tokenisation is a security measure that replaces sensitive card details with a unique digital identifier known as a token. This process enhances the security of online transactions by preventing the exposure of actual card information, thereby reducing the risk of fraud and data breaches. The Reserve Bank of India (RBI) and other global financial institutions have adopted CoF tokenisation to safeguard consumer data and streamline online payments.
What is Card-on-File Tokenisation?
- Definition and Purpose
- Card-on-File tokenisation is the process of substituting sensitive card information, like the 16-digit card number, with a unique token.
- The primary goal is to enhance security during online transactions and reduce the risk of card data theft.
- How It Works
- When a cardholder enters their card details on a website or app, the information is sent to the token service provider.
- The provider generates a token that represents the card details and sends it back to the merchant.
- The merchant stores this token for future transactions instead of the actual card details.
- Benefits for Consumers
- Offers a more secure way to store card details on merchant sites, reducing the risk of data breaches.
- Simplifies the checkout process by eliminating the need to enter card details for every transaction.
- Provides consumers with greater control over their card information.
- Benefits for Merchants
- Helps merchants comply with data security standards like PCI DSS, as they no longer store sensitive card data.
- Reduces the risk of data breaches and the associated costs and reputational damage.
- Enables merchants to offer a seamless payment experience, potentially increasing customer loyalty.
- Regulatory Compliance
- The RBI mandates that merchants should not store actual card data and should instead use tokenisation.
- Payment Card Industry Data Security Standard (PCI DSS) compliance is easier to achieve as the actual cardholder data is not stored.
- Technology and Providers
- Tokenisation technology is provided by payment processors and token service providers.
- Major card networks like Visa and Mastercard offer tokenisation services to merchants.
- Security Aspects
- Tokens are designed to be useless if intercepted, as they do not contain any recoverable cardholder information.
- Each token is unique to the merchant or transaction, making it nearly impossible to use fraudulently elsewhere.
- Customer Experience
- Tokenisation can enable one-click payments, making the online shopping experience faster and more convenient.
- Customers can manage their tokens, deciding where their card information is tokenised and stored.
- Global Adoption
- While the RBI has been a strong proponent in India, tokenisation is a global standard adopted by many countries to secure online transactions.
- Payment networks have created standards like EMV Tokenisation to secure and enhance CoF payments worldwide.
Technical Aspects of CoF Tokenisation
- Token Generation Process
- The token generation process begins when a cardholder enters their card details on a website or app.
- These details are sent to the token service provider, who generates a unique token that represents the card details.
- This token is then sent back to the merchant, who stores it for future transactions.
- The token is unique for a combination of card, token requester, and device.
- Role of Payment Gateways
- Payment gateways play a crucial role in the tokenisation process.
- They facilitate the transmission of card details from the merchant to the token service provider and the return of the token to the merchant.
- Payment gateways also ensure the secure transmission of this data, protecting it from potential breaches.
- Security Protocols
- Tokenisation employs several layers of security to protect cardholder data.
- The token itself does not contain any recoverable cardholder information, making it useless if intercepted.
- Additionally, each token is unique to the merchant or transaction, making it nearly impossible to use fraudulently elsewhere.
- Tokenisation vs Encryption
- While both tokenisation and encryption are used to protect sensitive data, they work in different ways.
- Encryption transforms data into a coded form that can be decoded with a key, while tokenisation replaces data with a token that has no intrinsic value.
- Unlike encrypted data, tokenised data cannot be reversed to its original form without access to the tokenisation system.
- Integration with Payment Infrastructures
- Tokenisation integrates seamlessly with existing payment infrastructures.
- It supports various payment methods beyond just credit and debit cards, including e-wallets, UPI, and mobile banking solutions.
- This flexibility allows businesses to attract a broader range of customers and cater to their diverse payment preferences.
Challenges and Future of CoF Tokenisation
- Challenges in CoF Tokenisation
- Regulatory Challenges: The absence of regulation that ensures safety, security, stability, transparency, and accountability contributes to a lack of trust in tokenisation.
- Integration with Existing Infrastructure: Implementing tokenisation may require modifications to existing applications and infrastructure.
- Adoption by Small Merchants: The preparedness level of small merchants and consumers for tokenisation is a concern. Any change of this nature is likely to cause some disruptions in the ecosystem.
- Cross-Border/Jurisdiction Issues: Tokenised offerings may be regulated differently in various jurisdictions. Issuers and intermediaries must adapt to the varying regulatory landscapes.
- Future of CoF Tokenisation
- Growth and Innovation: Tokenised assets represent a new wave of innovation in finance and asset management. By 2030, it’s estimated that 1 in every 4 publicly listed securities worldwide could be tokenised.
- Market Expansion: The tokenisation market is expected to grow from $2.3 billion in 2021 to $5.6 billion by 2025, with an average annual growth rate of 19%.
- Integration with Blockchain: Tokenisation is continually advancing alongside blockchain technology, offering potential for further growth and innovation.
- Increased Adoption: The number of merchants who have integrated tokenisation has increased significantly across industries. Large-scale operators, in particular, have shown readiness for this change.
- Convenience for Consumers: The Reserve Bank of India (RBI) has introduced a Card-on-File (CoF) token facility at the bank level, making it more convenient for cardholders to create and link tokens to their accounts.
RBI Directive on CoF Tokenisation
- Introduction of CoF Tokenisation by RBI
- The Reserve Bank of India (RBI) introduced tokenisation in September 2021 to enhance the security of digital payments.
- A unique token is generated for each transaction, replacing the need to store actual card details.
- Implementation and Expansion
- The implementation of Card-on-File tokenisation (CoFT) from October 1, 2022, has further strengthened security measures.
- RBI has expanded the scope of tokenisation to include card-issuing banks and institutions, allowing individuals to tokenise their cards via internet and mobile banking services.
- Requirements for Tokenisation
- The RBI mandates that tokenisation should be done through card networks and requires explicit user consent and Additional Factor of Authentication (AFA) before generating a token.
- Merchants are required to give customers the option to de-register their token from the merchant platform.
- Scope and Limitations
- The scope of tokenisation has been extended to allow cardholders to tokenise their cards for multiple merchant sites through a single process.
- The card issuer must provide a complete list of merchants for whom it can provide tokenisation services.
- Security and Compliance
- To mitigate the risk of data breaches and leaks, the RBI implemented the rule of tokenisation, ensuring that a unique token is securely saved with the merchant for each transaction.
- This directive aims to make digital payments more secure, safe, and sound.
Impact of RBI’s CoF Tokenisation on the Payment Ecosystem
- Impact on Consumers
- Consumers benefit from enhanced security, increased trust in digital payments, and improved payment experiences.
- The RBI’s directive allows consumers to create tokens for their cards directly from their banks, offering a more secure way to manage their card tokens.
- However, the tokenisation process requires explicit user consent and Additional Factor of Authentication (AFA) before generating a token, which may add an extra step for consumers.
- Impact on Merchants
- Merchants are required to give customers the option to de-register their token from the merchant platform.
- While many merchants have implemented the tokenisation infrastructure, there are concerns about the effect of card tokenisation on mandates for recurring payments.
- Small and medium-sized merchants, in particular, may face challenges in adopting tokenisation due to a lack of infrastructure and potential disruption to their operations.
- Impact on Banks and Payment Networks
- Banks and payment networks play a crucial role in the tokenisation process, as they are responsible for generating and managing tokens.
- More than 95% of banks are ready for tokens on the Visa, Mastercard, and Rupay platform, but medium and small payment aggregators are yet to catch up.
- The RBI’s directive has led to significant growth in the number of tokens created, with over 56 crore tokens created for transactions with a value of over ₹5 lakh crore.
- Impact on the Overall Payment Ecosystem
- The introduction of CoF tokenisation has led to a more secure digital payment environment, with a significant reduction in the risk of data breaches.
- However, the transition to tokenisation has also presented challenges, particularly for smaller merchants and payment aggregators who may struggle to adapt to the new system.
- Despite these challenges, the overall impact of CoF tokenisation on the payment ecosystem has been positive, with increased security and trust in digital payments.
Conclusion
Card-on-File (CoF) tokenisation is a transformative technology that enhances the security of digital payments by replacing sensitive card details with a unique token. Despite challenges in implementation and adoption, particularly among small merchants, it has significantly reduced the risk of data breaches and increased trust in digital payments. The RBI’s directive on CoF tokenisation has further strengthened this trust, leading to a more secure and efficient payment ecosystem.
Practice Question
Analyze the impact of the Reserve Bank of India’s directive on Card-on-File (CoF) tokenisation on the payment ecosystem in India. Discuss the benefits and challenges it presents for consumers, merchants, and banks. (250 words)
If you like this post, please share your feedback in the comments section below so that we will upload more posts like this.
