This is only for settlement of transactions where cardholders decide to enter the card details manually
The Reserve Bank of India ) has temporarily permitted merchants or their payment aggregators (PAs) involved in settlement of transactions where cardholders decide to enter the card details manually to save the Card-on-File (CoF) data for a maximum period of “Transaction Date + 4 days” or till the settlement date, whichever is earlier.
This data shall be used only for settlement of such transactions, and must be purged thereafter, RBI said in a notification.
Currently, the card issuer and the card network are allowed the aforementioned dispensation.
For handling other post-transaction activities, acquiring banks can continue to store CoF data (customer card credentials) until January 31, 2023, RBI said.
The central bank emphasised that there shall be no change in the effective date of implementation of the requirements relating to “Restriction on Storage of Actual Card Data (CoF) – all entities, except card issuers and card networks, shall purge the CoF data before October 1, 2022.
With effect from October 1, 2022, no entity in the card transaction / payment chain, other than the card issuers and / or card networks, shall store CoF data, and any such data stored previously shall be purged, it added.
RBI cautioned all payment system providers and payment system participants that appropriate penal action, including imposition of business restrictions, will be considered in case of any non-compliance.