{"id":6753,"date":"2021-10-12T15:45:23","date_gmt":"2021-10-12T10:15:23","guid":{"rendered":"https:\/\/razorpay.com\/blog\/?p=6753"},"modified":"2025-03-21T15:09:30","modified_gmt":"2025-03-21T09:39:30","slug":"card-on-file-tokenisation-all-you-need-to-know","status":"publish","type":"post","link":"https:\/\/razorpay.com\/blog\/card-on-file-tokenisation-all-you-need-to-know\/","title":{"rendered":"Decoding Card-on-File Tokenisation: All You Need to Know"},"content":{"rendered":"

In the wake of businesses moving online and adapting to the digital payments ecosystem, the Reserve Bank of India (RBI)<\/strong> has issued a circular (dated September 7, 2021) that prohibits <\/span>businesses<\/b>, <\/span>payment aggregators<\/b>, <\/span>payment gateways<\/b><\/a> and <\/span>acquiring banks<\/b> from saving customer card details on their servers from July 1, 2022.\u00a0<\/span><\/p>\n

The circular states that the only entities allowed to store card information will be <\/span>issuing banks <\/b>(the bank which issues the card) and <\/span>card networks<\/b><\/a> (Visa, Mastercard, Rupay, etc.).<\/span>
\n<\/span><\/p>\n

The main aim of this move is to prevent online fraud by helping keep the critical financial information of customers secure from card data breaches, which allow malicious actors to steal funds from unsuspecting individuals and organisations.\u00a0<\/span><\/p>\n

While it is true that the RBI now prohibits you from saving your customers\u2019 card details when accepting digital payments, the apex body also provides a workaround – \u2018Card-on-File Tokenisation\u2019.\u00a0<\/strong><\/p><\/blockquote>\n

Understanding Card-on-File Tokenisation\u00a0<\/b><\/h2>\n

What is tokenisation?<\/h3>\n

Tokenisation<\/a> is the process by which the original card number or Primary Account Number is replaced with a surrogate value called a \u2018token\u2019.\u00a0<\/span><\/p>\n

Card-on-File Tokenisation<\/h3>\n

In this process, tokens are created for customer cards to secure them from online frauds. These tokens are managed between the token requestor and the network, thereby allowing customers to store their card details in a secure and compliant fashion. <\/span><\/p>\n

The relationship between token and card-related data is saved in a vault owned by the card networks. As a result, customer card details will be safer than ever before.\u00a0<\/span><\/p>\n

The apex body has recommended that businesses, payment aggregators<\/a>, payment gateways and acquiring banks in the payment ecosystem – particularly payment service providers – use and store \u2018tokens\u2019 instead of card information through tokenisation.\u00a0<\/span><\/p>\n

Check out the RBI circular here<\/strong><\/a><\/p>\n

What does tokenisation mean for digital payments?<\/h2>\n

Most businesses adopted the online-first model post the outbreak of the COVID-19 pandemic, making digital payments<\/a> a necessity.<\/span><\/p>\n

\"digital-payments-using-debit-and-credit-cards\"<\/p>\n

The new regulation by the RBI implies your customers will have to bear the inconvenience of entering their credit or debit card details every time they make an online payment. Besides customer experience, this change can also impact your business in other ways. <\/span>\u00a0<\/b><\/p>\n