RBI issues guidelines for tokenisation of card transactions

MUMBAI: The central bank has permitted card networks to offer card tokenisation services to all third-party mobile appproviders in a bid to make digital transactions more secure and less prone to hacking-related frauds.

Tokenisation refers to the replacement of actual card details with a unique alternate code called the “token”, for a combination of card, token requestor and device. The use of the technology will be subject to consent of both the user and the card-scheme provider.

“If you’re using an e-commerce app and want to make a credit card transaction, we currently share all card details, being stored and during the exchange... After tokenisation, the card details would be replaced by a randomly generated token by the card-scheme operator,” said Vivek Belgavi, Fintech consultant, PwC.


“If someone tries to hack your network and misuse it, they won’t be able to access your card details. It’s a global best practice and falls in compliance with guidelines such as Payment Card Industry Data Security Standard (PCIDSS) and is another step toward improving payments security,” he added. The guidelines issued by the apex bank for safety and security of card transactions will be extended to the tokenised card transactions as well.

“All extant instructions of Reserve Bank on safety and security of card transactions, including the mandate for Additional Factor of Authentication (AFA) / PIN entry shall be applicable for tokenised card transactions also,” the central bank said. “…Adequate safeguards shall be put in place to ensure that PAN cannot be found out from the token and vice versa, by anyone except the card network.”

The Reserve Bank of India has also instructed the card service networks to put in place a mechanism for periodic system checks and have at least one security audit of all third-party token service providers every year.

“This system audit shall be undertaken by empanelled auditors of Indian Computer Emergency Response Team (CERTIn) and all related instructions of Reserve Bank in respect of system audits shall also be adhered to,” the RBI said.