RBI Introduces Card-on-File Tokenisation Facility Through Banks

December 21, 2023

The Reserve Bank of India (RBI) has introduced a Card-on-File (CoF) tokenisation facility through banks, enabling cardholders to conveniently create and link tokens to their existing accounts with various e-commerce applications. The move allows CoF tokens to be generated directly through card-issuing banks and institutions, offering cardholders an additional choice for tokenising their cards across multiple merchant sites through a single process.

Key Points

Objective: The RBI aims to enhance the convenience for cardholders by allowing the generation of Card-on-File Tokenisation (CoFT) directly through banks and financial institutions.
Tokenisation Benefits: Tokenisation replaces actual card details with token credentials, providing an additional layer of security. The 16-digit token is unique for a combination of card, token requestor, and merchant.
Implementation Through Banks: The RBI’s circular allows the generation of CoF tokens for a card through mobile banking and internet banking channels provided by the card issuer.
Customer Consent and AFA Validation: CoFT generation should be done only with explicit customer consent and with Additional Factor of Authentication (AFA) validation. If a cardholder selects multiple merchants for tokenisation, AFA validation may be combined for all these merchants.
Flexibility for Cardholders: Cardholders can tokenise their cards at their convenience, either at the time of receiving a new card or later. The circular emphasizes that the process should be initiated only with customer consent.
List of Merchants for Tokenisation Services: Card issuers are required to provide a complete list of merchants for whom they can offer tokenisation services to ensure transparency.
Evolution of Tokenisation: Tokenisation has been recognized as a security-enhancing measure, and its implementation has contributed to improved transaction security and approval rates.
Previous Introduction of CoFT: The RBI had introduced Card-on-File Tokenisation in September 2021, with implementation starting from October 1, 2021.