The Reserve Bank of India will ease certain guidelines relating to the storage of card data by entities other than card issuers and networks, on an interim basis.
In a circular issued on Thursday, the regulator specified that the Sept. 30 deadline to purge card data from databases outside the issuers and networks stays. However, to enable a smoother transition to an alternative system, the regulator will allow temporary card storage in cases where customers manually enter their card data to complete a transaction:
Merchants or their payment aggregators will be allowed to store the card data for T+4 days, or till settlement of the transaction is complete, whichever is earlier. Data must be purged after the settlement.
For other post-transaction activities, the acquiring banks will be allowed to store card data till Jan. 31, 2023.
The RBI reiterated that non-compliance with these guidelines will invite penal action, including imposition of business restrictions.
The implementation of card storage guidelines has already seen considerable delay. The guidelines, which were introduced in March 2020, have seen three deadline extensions, with the latest deadline set for Sept. 30.
