The Reserve Bank of India (RBI) on Saturday said that it will take steps to further intensify the oversight process for the card payment networks and cross-border money transfer (in-bound service) operators by way of on-site inspections, if required.

Card payment networks include MasterCard, Visa, American Express, Diners Club International and the National Payments Corporation of India (NPCI). Cross-border money transfer (in-bound service) operators include Western Union, MoneyGram and UAE Exchange.

Continuous engagement

Presently, the card payment networks, except NPCI, and Cross-border money transfer (in-bound service) operators are regulated and overseen by way of off-site surveillance, only as they are incorporated in foreign jurisdictions.

These entities are required to submit System Audit Report of their entire systems, including the domestic infrastructure, on an annual basis, the central bank said in its Document on Oversight Framework for Financial Market Infrastructures (FMIs) and Retail Payment Systems (RPSs).

Continuous engagements are made with these entities to understand any gaps in their risk assessments and customer grievance redressal mechanism and also mandate them to make further improvements, if considered necessary, it added.

“Steps will be taken to conduct on-site inspection of the card networks and cross-border money transfer (in-bound service) operators and to start with, the need for an on-site visit will be examined by RBI for the purpose of interaction with the executives of the entities as well as the overseas regulators,” the document said.

Storing payment system data

To ensure better monitoring and to have unfettered supervisory access to the data stored with the system providers, as also with their service providers/intermediaries/third-party vendors and other entities in the payment ecosystem, the RBI underscored that all system providers are required to ensure that the entire data relating to payment systems operated by them is stored in a system only in India.

This data should include the full end-to-end transaction details, information collected, carried/ processed as part of the message/payment instruction.

For the foreign leg of the transaction, if any, the dcoument said the data can also be stored in the foreign country, if required.

comment COMMENT NOW