Key regulatory guidelines

issued by RBI in Cards

and Digital Payment Space

Subir Saha
  • Enhancing Security of Cards Transactions

Payment and settlement systems are the backbone of any economy. The last decade has witnessed substantial developments in this area of activity across the country. Reserve Bank of India (RBI), under powers from the Payment and Settlement Systems Act, 2007, has endeavored to ensure that India has ‘state-of-the-art’ payment and settlement systems that are not just safe and secure, but are also efficient, fast and affordable. Following table shows the glimpse of the manifold increase in the volume and value of transactions made through Cards as well as some of the other Retail Payment Systems in the country:

Data Source: RBI - Payment System Indicators – Annual Turnover (April-March)
Sr. No Payment System Volume (Lakh) Value (₹ billion)
2017-2018 2018-2019 2019-2020 2017-2018 2018-2019 2019-2020
1. UPI 9,152 53,915 1,25,186 1,09,832 8,76,971 21,31,730
2. IMPS 10,098 17,529 25,792 8,92,498 15,90,257 23,37,541
3. Credit Cards 14,052 17,626 21,773 4,58,965 6,03,413 7,30,895
4. Debit Cards 33,434 44,143 51,239 4,60,070 5,93,475 8,04,870
5. PPIs 34,591 46,072 53,318 1,41,634 2,13,323 2,15,558

Considering above aspects, RBI through its circular on Enhancing Security on Card Transactions dated January 15, 2020 has issued certain measures to improve user convenience and increase the security of card transactions.

Key features

  1. New cards
    • To be enabled only for use at ATMs and POS at the time of issuance
    • Issuers to provide cardholders a facility for enabling the card for use through other modes i.e. online, contactless and for international transactions {hereinafter referred to as ‘Other Usage’}
    • Facility to be provided for switch on/off for all usage types (i.e. ATM. PoS, online, contactless, international) and set/modify transaction limits to be provided on 24x7 basis across all channels (Mobile, Internet, ATMs, IVRs, Branches)
    • Alerts through SMS/e-mail to be sent as and when there is a change in status in terms of transaction limit or switch on/off of the card usage
  2. Existing cards
    • Issuers based on their risk perception may decide on disabling the cards for Other Usage
    • Cards never transacted for Other Usage to be mandatorily disabled
  3. Provisions not mandatory for prepaid gift cards and cards used at mass transit systems.
    • Provisions effective from October 01, 2020.
  • Master Directions on Digital Payment Security Controls
    • RBI through its circular dated February 18, 2021 had issued Master Directions on Digital Payment Security Controls, which provides necessary guidelines for the regulated entities to set up a robust governance structure and implement common minimum standards of security controls for channels like internet, mobile banking, card payments, among others. While the guidelines will be technology and platform agnostic, it will create an enhanced and enabling environment for customers to use digital payment products in more safe and secure manner. Banks are also instructed to formulate a Board approved policy for digital payment products and services which shall be reviewed at least on yearly basis. The guidelines shall be effective from August 18, 2021, however, in respect of instructions already issued by RBI through various circulars or advisories, the timeline would be with immediate effect or as per the timelines already prescribed.

Key themes outlined in the circular are as mentioned below:

    • Robust Governance and Control Framework
    • Embed ‘Security by Design’ Application development lifecycle
    • Risk based adaptive & multi factor authentication
    • Fraud Risk Management focused on detection and reporting
    • Implementation of risk-based controls for detection and prevention of cyber threats
    • A real time / near real time reconciliation for detection of suspicious transactions
    • Security controls for Internet, Mobile and Card Payments
    • Customer awareness supported by robust communication and grievance redressal mechanism

Amit Gawde,

Compliance Group, Mumbai