Card-on-File Tokenisation: RBI Rules for Merchants and Apps

In short

Since 1 October 2022 only card issuers and card networks may store actual card numbers; merchants use per-merchant tokens created with customer consent and AFA (RBI circulars 2021 to 2023).

1. What changed for anyone who takes card payments

Before these rules, many apps and merchants kept a customer's card number so the next purchase needed one tap. The RBI replaced that with card-on-file tokenisation (CoFT). A token is an alternate code that stands in for the real card details. The merchant keeps the token, and the real card data stays with the card network or the card issuer.

If your app has a "saved cards" screen, this page tells you what the RBI allows behind it. It does not cover recurring-payment mandates, which sit under separate RBI rules.

2. The timeline

Date	RBI circular	What it did
7 September 2021	RBI/2021-22/96	Allowed CoFT; let card issuers act as Token Service Providers; said from 1 January 2022 no one except card issuers and card networks may store actual card data
28 July 2022	RBI/2022-2023/95	Kept the effective date: all entities except issuers and networks purge card-on-file data before 1 October 2022
20 December 2023	RBI/2023-24/91	Let card issuing banks enable CoFT directly through mobile and internet banking

The July 2022 circular allowed a short exception for guest checkout, where the customer types the card number by hand. A merchant or its payment aggregator could keep the data for a maximum of T+4 days, or until the settlement date if that comes first. The data could be used only for settlement and had to be purged after. Acquiring banks could keep data until 31 January 2023 for other post-transaction work. The RBI called both an interim measure, so check whether anything has changed since.

3. What a token is

For CoFT the token is unique for a combination of card, token requestor and merchant. So the same card gets a different token at each merchant. The token requestor is the entity that takes the customer's request to tokenise a card and passes it to the card network to issue a token.

The RBI's FAQ says the actual card data, the token and related details are held securely by the token service provider, which is the card network or the card issuer. A token requestor cannot store the card number or any other card detail.

4. What you may still store

For tracking and reconciliation, an entity may store limited data: the last four digits of the card number and the card issuer's name. Use these two for your saved-card display.

5. What the customer controls

Consent. Tokenisation of card data needs explicit customer consent, validated by the card issuer through an Additional Factor of Authentication (AFA). It cannot be a forced or pre-ticked box. If the customer pays for a purchase and registers for CoFT in one flow, the AFA may be combined.
Removal. The merchant must give the cardholder an option to de-register the token. The card issuer must also let the cardholder see the list of merchants holding tokens and de-register any of them, through a mobile app, internet banking, IVR or a branch.
Issuer-led setup. Since December 2023 a cardholder can pick merchants from a list provided by the card issuer and create tokens for several at once, with one AFA for all of them. The tokens then show up on each merchant's payment page.
Card renewal. When a card is renewed or replaced, the issuer asks the cardholder for explicit consent to link it again to the merchants registered earlier.
Choice. Tokenisation is not mandatory for a customer.

6. Who is answerable

The September 2021 circular puts responsibility for complete and ongoing compliance on the card networks. The July 2022 circular adds that the RBI will consider appropriate penal action, including business restrictions, for non-compliance.

7. Checklist for a product team

[ ] No card numbers in your database, logs, analytics events, support tickets or screenshots.
[ ] Saved cards show only the last four digits and the issuer's name.
[ ] Tokens are created only after a clear opt-in and AFA, never by a pre-ticked box.
[ ] A visible way for the customer to remove a saved card at your end.
[ ] Guest checkout does not keep the card number after the payment is settled.
[ ] Your payment aggregator or gateway confirms in writing which party holds the tokens.
[ ] A plan for when a card is renewed or replaced.

Questions people ask

Can we store card numbers if we want to?

No. Since 1 October 2022, no entity in the payment chain other than card issuers and card networks may store actual card data, according to the RBI circular of 28 July 2022.

Does the customer need AFA to save a card?

Creating the token needs explicit customer consent with AFA validation by the card issuer. The rules in this page say nothing about later payments, so ask your payment partner how each charge is authenticated.

Is one token valid across merchants?

No. For CoFT, the token is unique for the combination of card, token requestor and merchant.

Can the customer's bank set up the tokens?

Yes, since the December 2023 circular, through mobile banking or internet banking, on the customer's explicit consent and with AFA.

This is a plain summary of RBI circulars, so check with your payment partner or a compliance professional before you change how your product handles cards.

Sources

Nine stories, every morning at 09:15 IST.

Get the brief free →