Reserve Bank of India (RBI) has issued guidelines on tokenisation of debit, credit and prepaid card transactions in a bid to ensure secure payment systems across the country.

The central bank has allowed authorised card payment networks, such as Visa and Mastercard, to provide card tokenisation services to any token requestor.

Go deeper with GlobalData

Data Insights

The gold standard of business intelligence.

Find out more

Tokenisation replaces sensitive card information with a unique alternate code called ‘token’.

Instead of actual card details, this token can be used to make card payment in contactless mode at point of sale (POS) terminals and quick response (QR) code payments.

RBI has given permission to offer tokenised card transaction services to all channels, including near field communication (NFC), magnetic secure transmission (MST) based contactless transactions and in-app payments.

Initially, tokenised card transaction will be available through mobile phones or tablets, with plans to potentially extend to additional devices in the future.

How well do you really know your competitors?

Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.

Company Profile – free sample

Thank you!

Your download email will arrive shortly

Not ready to buy yet? Download a free sample

We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form

By GlobalData
Visit our Privacy Policy for more information about our services, how we may use, process and share your personal data, including information of your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.

The central bank in its statement noted: “Tokenisation and de-tokenisation shall be performed only by the authorised card network and recovery of original Primary Account Number (PAN) should be feasible for the authorised card network only.

“Adequate safeguards shall be put in place to ensure that PAN cannot be found out from the token and vice versa, by anyone except the card network. Integrity of token generation process shall be ensured at all times.”

RBI added that tokenisation and de-tokenisation requests should be logged by the card network and available for retrieval.

Cardholders will be able to avail the services by registering their card on the token requestor’s app. These services will be free of charge.

RBI asked the card issuers to ensure easy access for customers to report loss of ‘identified device’ or any other such event, which may expose tokens to unauthorised usage.