RBI - Tokenisation - Card Transactions (Circular, 2019)
AI / PRIVACY / CYBER RELEVANCE
Foundational payment-data security control that keeps actual card numbers away from merchants and apps, including AI-driven and in-app payment flows.
AI: ContextualPrivacy: HighCybersecurity: Very High
READ FIRST
- Paragraph 2 - permitted use cases and token storage mechanisms
- Annex 1 - consent via AFA, registration of token requestors, de-tokenisation only by the card network
- Paragraph 6 - annual CERT-In empanelled audit and monthly reporting
- Paragraph 7 - legal basis under Sections 10(2) and 18 PSS Act
PURVIEW
Permits authorised card payment networks to offer card tokenisation to any token requestor across use cases - NFC/MST contactless, in-app, QR - and storage mechanisms, initially on mobile phones and tablets, replacing actual card details with a unique token. Annex 1 sets the conditions: explicit customer consent through Additional Factor of Authentication, no charge to the customer, registration of token requestors, tokenisation and de-tokenisation only by the card network, secure storage of card data with the network, and the customer's right to choose and to delete tokens. Networks must have an annual system and security audit by CERT-In empanelled auditors and submit monthly reports. Tokenisation is a data-minimisation and security safeguard for payment data; read with the DPDP Act's reasonable security safeguards duty and the RBI cyber-resilience directions for PSOs.
Classification and legal status. Binding direction RBI/2018-19/103, DPSS.CO.PD No.1463/02.14.003/2018-19 dated 8 January 2019 to authorised card payment networks; later extended by subsequent RBI circulars.