Card networks may raise tokenisation service rates

The recent Reserve Bank of India (RBI) norms on tokenisation services, which will be offered by card networks, are likely to result in merchants and payment aggregators incurring a cost since they have to pay a fee to the networks. And they may, in turn, pass on this cost to customers.

The norms, issued by the banking regulator on September 7, allow card networks like Visa and Mastercard to offer tokenisation service. Tokenisation is the process by which card credentials are de-identified by converting them into randomly generated numbers called tokens. The RBI circular added that from January 1, 2022, no entity in the card transaction or payment chain, other than the card issuer and/or card network, is allowed to store the card data. Any such data stored previously will have to be purged.

While card networks will provide the tokenisation service, payment networks will do the back-to-back tokenisation with the card-issuing bank. Once the issuing bank and the network are ready with a solution, merchants will start integrating their system with the process. Tokenisation is currently done by payment aggregators free of cost.

According to sources in the payment industry, card networks plan to charge a one-time setup fee of $700; then there is a record retrieval fee of $0.007 (that is, every time the token is sent for transaction); and also monthly storage fee of $6,000 for one million cards, $10,000 for 5 million cards, and so on. There were over 63 million credit cards and over 906 million debit cards in India as of end of July 2021.

“At PCI (Payment Council of India), we are confident of meeting the deadline once the networks come out with a solution. The only issue is, what kind of pricing mechanism — for every token generated — will they (card networks) work out,” said Vishwas Patel, chairman of PCI, the apex body representing companies in the payments and settlement system. “If they charge heavily, the entire system will fail. They have to make it cost effective to help the RBI make this possible,” Patel said. He added that the merchants and payment aggregators are likely to ask for user consent for tokenisation.

National Payment Council of India (NPCI), which operates the Rupay payment network, is yet to provide tokenisation service. Mastercard has said it is an early adopter of cardon-file tokenisation and will work with all stakeholders for a seamless rollout of the facility. Mastercard and Visa did not respond to a query on the pricing aspect. Tokensisation by Visa is done by a solution called Cybersource, while for Mastercard, there is Mastercard Payment Gateway Service (MPGS).