Why international payment companies are finding it tough to comply with RBI’s data localisation directive

Along with data, global giants like Visa and Mastercard will have to also shift their processing engines, which were till now centralised to achieve economies of scale.

With the D-day for data localisation here, the spotlight is on the entire digital payments economy.

Over the past few months, the action seems to be concentrated on US payment players who have reached out to the Ministry of Finance and the Ministry of Electronics and Information Technology (MeitY) at multiple occasions, and have been lobbying to seek dilution of the RBI directive.

However, the efforts don’t seem to have worked as the RBI has taken a strong stance, indicating that it doesn’t intend to give an extension or relief. This has put global players in a soup.

But while there will be short-term impact of RBI’s decision, the industry remains optimistic that things will even out in the long run.

Vivek Belgavi, fintech leader at PwC India, says,

“Data is the new oil. Just like a lot of industries flourished around oil, bringing data back to India will do the same. Now, multiple economies will be allowed to flourish in the country as the data will be here. Data localisation is a great move in the long run.”

Electronic payments companies need to submit a report to the Reserve Bank of India (RBI) on its directive to store payments data pertaining to Indian users within the country. They must also get their systems audited by an external auditor and submit a compliance report by December this year.

It’s not just data

So, why are global behemoths creating such a hue and cry about shifting data of Indian users to the country?

That’s because the issue being raised by these multinationals is not just about data, Vivek explains. He says,

“It’s not just data. Along with data, these companies will have to also shift their processing engines (for Indian data), which otherwise operate in a centralised way to achieve economies of scale. The complexity is that these systems are interconnected, and these capabilities will have to be built separately for India now.”

Processing engines further include a cluster of systems and applications, including fraud, risk management amongst other things. All these capabilities will have to be built ground up now.

Samir Shah, Associate Partner, Cyber Security at Ernst & Young, says, “When these behemoths came to India, they built their IT infrastructure and teams big enough to connect to the global infrastructure. However, now they might have to invest more in their IT infrastructure to replicate this global infrastructure.”

Rise in costs

Global companies, especially card network biggies like Visa and Mastercard, will see spikes in costs when it comes to processing transactions. However, the bigger challenge will be access to technology, which now needs to be built up.

For internet giants like Google and Facebook-owned WhatsApp, which got into digital payments last year, the challenges will differ. Apart from building fraud management systems, the major issue centres on decentralising their operations.

Vivek says:

“As these internet giants enter newer geographies, their business and the offerings in these regions are similar, and so are the system configurations. So, with 50-70 percent of the system configuration being similar, when any of these companies releases an update, 50-70 percent of the job is already done. Only 30 percent needs to be configured according to the geography. But with localisation these systems will become completely decentralised, hence requiring more resources.”

While local agility can improve, global synchronisation will become a lot more complex with this directive.

So, how expensive is it for these multinationals to shift data?

While there is a significant cost involved in shifting this data and buying more storage, an executive at a large-scale data centre provider, seeking anonymity, said,

“The cost will actually be one-third when it comes to managing infrastructure. An American resource charges anywhere close to $90,000 annually, while in India the same labour is available at Rs 20 lakh annually. So, cost of human resources is cheaper.”

The way ahead

Recent media reports also state that RBI will not buy technology challenges as a reason for non-compliance.

What is surprising is that global players like Amazon Google and Alibaba have launched their data centres in India.

However, the executive adds, “The problem lies in planning as well. When Google opened its data centre in the country, it would have never thought that Google Pay India’s data would also have to be hosted. So, there could be an infrastructure bottleneck.”

An industry expert, who did not want to be named, said,

“The six-month window given by the RBI was long enough for all firms to comply. However, most firms woke up only in September and are now struggling to meet the deadline.”

With RBI holding discussions on a case-by-case basis before deciding the fate of players, it will be interesting to watch what these players put on the table to get short-term exemptions from the central bank.