With the Reserve Bank of India’s deadline to comply with storing of data relating to payment systems within India set to expire on October 15, at least 15 payment firms, including Visa and Mastercard, are yet to fall in line and build a data storage system in the country.
According to top-level government sources, out of about 78 payment firms, around 62 have complied with the RBI directive and set up local data storage systems in India. These include Amazon, WhatsApp and Alibaba. However, credit and card firms with global operations have been resisting the move, citing costs, security risk, lack of clarity, timeline and possibility of data localisation demand from other countries.
Many global firms including Visa, Mastercard and American Express took up the issue with the finance ministry which called a meeting of all the parties to settle the issue. “The RBI is unlikely to extend the deadline or ease the guidelines. Payment companies have been given sufficient time of six months. There’s no question of going back on the data localisation plan,” said a government source.
On April 6, 2018, the RBI issued a notification, saying, “all system providers shall ensure that the entire data relating to payment systems operated by them are stored in a system only in India. This data should include the full end-to-end transaction details, information collected, carried, processed as part of the message and payment instruction. For the foreign leg of the transaction, if any, the data can also be stored in the foreign country, if required.”
“System providers shall ensure compliance within a period of six months and report compliance of the same to the Reserve Bank latest by October 15, 2018,” the RBI said. “It is observed that not all system providers store the payments data in India. In order to ensure better monitoring, it is important to have unfettered supervisory access to data stored with these system providers as also with their service providers, intermediaries, third party vendors and other entities in the payment ecosystem,” the RBI said.
Payment firms like Visa and Mastercard which currently store and process Indian transactions outside the country also fear that shifting the data storage to India will cost them millions of dollars. Besides, once it happens in India, there could be similar demands from other countries, upsetting their plans. While the finance ministry has suggested some easing of norms in shifting the data, the RBI has refused to budge, stating that the payment systems need closer monitoring in the wake of the rising use of digital mode of transactions.
“The regulator is not willing to accept data mirroring…. which is real-time operation of copying data, as an exact copy, from one location to a local or remote storage medium. Domestic payment companies were wholeheartedly supporting the RBI stipulation for their own reasons, mainly competition, which are understandable,” said a banking source.
There are 980.19 million debit cards and 41.03 million credit cards in India as of August 2018. There were 13,258.62 million debit and credit card transactions valued at Rs 38.21 lakh crore in FY18, up from 10,038 million transactions valued at Rs 29.39 lakh crore in FY16. In FY18, debit card transactions accounted for Rs 33.58 lakh crore, RBI said.
The $35 billion e-commerce market in India is expected to grow at 25 per cent in the next five years and exceed $ 100 billion by 2022, said a report by PwC India and the National Association of Software & Services Companies.