Central Idea

The Reserve Bank of India (RBI) has expanded the scope of card-on-file tokenisation (CoFT) services to include card-issuing banks and institutions, enhancing the security of digital payments.
Previously, tokenisation services were primarily provided through merchants. The RBI’s recent notification marks a significant shift in this approach.

Understanding CoFT and Its Importance

Card-on-File (CoF) Concept: Traditionally, merchants stored customer card details (CoF) on their platforms, posing risks to financial data security.
Tokenisation Solution: To mitigate data breach risks, the RBI introduced tokenisation, where a unique token replaces actual card details at the merchant’s end.
Regulatory Measures: In March 2020, RBI mandated that payment aggregators and merchants should not store actual card data, aiming to minimize system vulnerabilities. The deadline for compliance was extended to December 2021 following industry requests.

Channels for Token Generation: Customers can generate CoFT tokens through mobile and internet banking, offering a convenient and secure method for digital transactions.
Consent and Authentication: Token generation requires explicit customer consent and Additional Factor of Authentication (AFA) validation, ensuring user control and security.
Flexibility for Cardholders: Cardholders have the flexibility to tokenise their cards at any time and select specific merchants for maintaining tokens.
Token Issuance: The tokens can be issued either by the card network, the issuer, or both, providing multiple layers of security.

Impact and Adotion of CoFT

Enhancing Safety and Convenience: CoFT aims to secure card data without compromising the convenience of card transactions.
Implementation Timeline: The RBI introduced CoFT in 2021, with full rollout from October 1, 2022.
Usage Statistics: Since its implementation, over 56 crore tokens have been created, facilitating transactions worth over ₹5 lakh crore.