Why RBI’s new tokenisation norms will attract Apple Pay, other global players to India

Tokenisation will level the playing field for global players and make it attractive for them to operate in India. Payment companies say the RBI move will also make digital payments safer and more consumer friendly.

The Reserve Bank of India's latest directive on tokenisation of card payments will result in a level playing field for global behemoths like Apple Pay and Google Pay that offer digital payments services, say industry experts.

While this may mean an entry into the Indian market for companies like Apple Pay, others like Google Pay, which have so far been riding on Unified Payments Interface (UPI), can look at adding additional features like card payments to their offerings in India, experts say.

Earlier this week, the central bank introduced tokenisation for debit, credit, and prepaid card payments to ensure further security on digital transactions.

TR Ramachandran, Group Country Manager, India and South Asia, Visa, says, “We welcome this significant step by the RBI to encourage safe and secure digital payments for the country. The world over, tokenisation has evolved to enable payments through connected devices and risk-based authentication. We are confident of India soon embarking in this direction to truly propel digital payments for the masses.”

While card tokenisation has been in practice for some time in markets such as the US, Indian payment experts have been expecting this move ever since the RBI allowed card tokenisation for Samsung Pay as a one-off during its India launch in 2017.

Harshil Mathur, CEO and Co-founder of Tiger Global-backed payment processing startup Razorpay, says,

“Tokenisation provides a level playing field for global players like Apple to come to India. They already have been using tokenisation in geographies like the US; now it becomes easier for them to enter India and execute the strategy.”

No need to block cards, just revoke tokens!

Card tokenisation is an additional boon for users of Apple Pay and other global payment players as it will allow customers to pay across their payment universe in different geographies.

Further, payment engines and other online payment gateways like CC Avenue, BillDesk, and Razorpay, are most likely to start support for tokenisation on their respective networks.

Card tokenisation masks transactions through tokens, securing them from phishing, and saving them the hassle of saving/entering their card details on merchant sites they don’t trust.

Harshil explains, “Instead of entering card details at merchant sites, [customers] can save their cards at a platform like Google Pay or others that support tokenisation and choose that payment player as the option while checking out. Also, the tokenisation of a card can be revoked if a consumer sees suspicious activity, rather than blocking the card and waiting for it to be reissued.”

Payment processing giant Mastercard, which also welcomed the RBI move, says the move will make digital payments safer and more consumer friendly.

A Mastercard spokesperson told YourStory, “The move is also in line with the Digital India agenda and exemplifies efforts by the regulator to decrease fraud. We expect this move to increase the share of digital payments in everyday use-cases, e.g. grocery, fuel, and transit. It will spur the adoption of newer devices like low-cost Near Field Communication (NFC)-enabled phones and terminals with wearables and other connected devices for payments to follow in due course of time.”

At the other end, not much will change for online merchants like Ola and Swiggy, considering they already work with payment processing partners, who will soon add tokenisation support to their respective networks.

Tokenisation a win-win situation

The move is also a win-win for merchants and customers as it will decrease the risk of sensitive payment credentials being leaked from merchant sites.

An industry expert says,

“Life is much easier for merchants with tokens as they can be less worried about sensitive card details being leaked from the backend. The job of third-party intermediaries and merchants is not to look after a customer’s payment credentials, but to provide goods and services.”

Vinay Kalantri, Founder and Managing Director of tmw Pvt Ltd. (The Mobile Wallet), says in tokenisation, sensitive data, including bank transactions, loan applications, and stock trading, is substituted with non-sensitive or symbolic elements known as tokens, and “mapping back can be done only through a secured tokenisation system”.

However, industry experts believe consumers of digital payments across the board will have to be educated about the benefits of tokenisation. The mantle will also fall on Indian digital payment majors like Paytm, MobiKwik, and PhonePe, who are expected to start tokenisation support on their platforms.

This is important since these payment companies also have consumers storing their card and bank details for various payments and recharges performed on their platform, acting as payment processors.

Industry players and payment experts claim no infrastructure upgrade is needed following RBI’s new directive. There will be a miniscule technology cost, in terms of team and servers, to offer the tokenisation service. But that cost will be well worth the benefits, say analysts.

Fintech analysts predict that with the success of tokenisation, RBI might also waive off two-factor authentication, and allow users to set standing instructions for automatic payment mandates.

Harshil explains,

“In the future, if successful, the RBI can also allow tokenised cards to do away with two-factor authentication since they are inherently more secure. That will be a logical move. This is will open certain used cases like setting mandates for tokenised cards allowing individuals to auto-recharge for daily services like Uber. Customers can anyway just click a button and revoke tokenisation on their cards.”

Automatic mandates were a big miss in the newer version of UPI launched last year.

However, the RBI has presently mandated Additional Factor of Authentication (AFA) and PIN entry on tokenised cards. But a larger use case for tokenisation will still lie in the contactless offline world, including technologies like NFC for devices or contactless cards.