Date: 2016-12-06Category: Not ApplicableState: Union GovernmentCountry: India
Card Not Present transactions – Relaxation in Additional Factor of Authentication for payments upto ₹ 2000/- for card network provided authentication solutions
Executive Summary:
This document from the Reserve Bank of India (RBI) relaxes the Additional Factor of Authentication (AFA) requirement for low-value online Card Not Present (CNP) transactions up to ₹2000. This relaxation applies specifically to payment authentication solutions provided by authorized card networks, aiming to enhance customer convenience while maintaining security. The directive is issued under Section 10(2) read with Section 18 of the Payment and Settlement Systems Act 2007.
Key Points / Main Content:
* **AFA Relaxation:**
* AFA is relaxed for CNP transactions up to ₹2000 using authorized card network payment authentication solutions.
* This relaxation requires the participation of both card-issuing and acquiring banks.
* **Customer Enrollment and Usage:**
* Card issuing banks offer optional payment authentication solutions to customers.
* Customers undergo a one-time registration process with AFA.
* Registered customers avoid re-entering card details for each transaction at participating merchants.
* **Transaction Limits and Velocity Checks:**
* The AFA relaxation applies to a maximum transaction value of ₹2000.
* Transactions exceeding ₹2000 require mandatory AFA.
* Customers can still choose to use other AFA methods even for transactions below ₹2000.
* Banks/card networks must implement velocity checks (daily/weekly/monthly limits) on these small-value transactions.
* **Chargebacks and Liability:**
* The existing chargeback process remains unchanged.
* Card networks bear full liability in case of any security breach.
* **Customer Awareness:**
* Banks and card networks must inform customers that the solution is optional and limited to ₹2000.
* Customers should be educated on usage, risks, and grievance redressal mechanisms.
* Maximum customer liability, if any, should be indicated during enrollment.
* Customers are responsible for reporting fraud.
* **Network Participation:**
* Authorized card networks can facilitate participation from cardholders of other authorized networks.
Impact Analysis:
* **Scheduled Commercial Banks (including RRBs), Urban Cooperative Banks, State Cooperative Banks, District Central Cooperative Banks, Authorised Card Payment Networks, Payment Banks, and Small Finance Banks:**
* *Impact:* Need to implement the revised AFA guidelines and offer payment authentication solutions.
* *Action Required:* Develop and deploy card network-based authentication solutions, establish transaction limits and velocity checks, ensure customer consent, and educate customers on the new system.
* **Customers:**
* *Impact:* Experience potentially more convenient online transactions for low-value purchases.
* *Action Required:* Understand the optional registration process, be aware of transaction limits and security measures, and report any fraudulent activity.
* **Authorised Card Networks:**
* *Impact:* Opportunity to offer their payment authentication solutions and expand their network.
* *Action Required:* Provide payment authentication solutions, ensure customer data security, bear liability for security breaches, and establish network agreements for wider participation.
* **Merchants:**
* *Impact:* Potential for increased sales and improved customer experience.
* *Action Required:* Offer the card network payment authentication solutions to customers.
Key Entities Referenced
Reserve Bank of India: The central bank of India, responsible for regulating the banking system and monetary policy.
Scheduled Commercial Banks: Banks in India that are listed in the Second Schedule to the Reserve Bank of India Act, 1934.
Regional Rural Banks: Government-sponsored regional banks in India focused on rural areas.
Urban Cooperative Banks: Primary cooperative banks located in urban and semi-urban areas in India.
State Cooperative Banks: Cooperative banks operating at the state level in India.
District Central Cooperative Banks: Cooperative banks operating at the district level in India.
Payment Banks: A type of bank in India allowed to accept deposits, offer payment services, and distribute financial products, but cannot lend money.
Small Finance Banks: A type of bank in India focused on providing basic banking services to underserved populations.
Additional Factor of Authentication: A security measure that requires users to provide more than one verification factor to authenticate a transaction.
Payment and Settlement Systems Act 2007: An act of the Indian Parliament that provides for the regulation and supervision of payment systems in India.
Mumbai, Maharashtra: City in India where the central office of the Department of Payment and Settlement Systems is located.
Card Not Present: A type of transaction where the cardholder does not physically present the card to the merchant, typically used for online or phone transactions.
RBI/2016-17/172
DPSS.CO.PDNo.1431/02.14.003/2016-17 December 6, 2016
The Chairman and Managing Director / Chief Executive Officer
All Scheduled Commercial Banks including RRBs/
Urban Co-operative Banks / State Co-operative Banks/
District Central Co-operative Banks/ Authorised Card Payment Networks
Payment Banks and Small Finance Banks
Madam/Sir,
Card Not Present transactions – Relaxation in Additional Factor of Authentication for
payments upto ` 2000/- for card network provided authentication solutions
Reserve Bank of India has been taking a number of initiatives with the involvement of all
stake holders to enhance safety and efficiency of the retail payment systems. In this regard,
various instructions have been issued from time to time on security and risk mitigation
measures involving card transactions, including directions on online alerts and additional
factor of authentication. These measures have contributed to increased customer confidence
in using card payments.
2. The Reserve Bank has been receiving requests from certain segments of the industry for
reviewing the requirement of AFA for low value online card not present (CNP) transactions.
As most of the requests were for merchant specific relaxations on AFA requirements, they
were not appropriate at the system level. An alternate solution, provided by authorised card
networks is expected to meet the objective of customer convenience with sufficient security
for low value transactions. In this model, the card issuing banks will offer the “payment
authentication solutions” of the respective card networks to their customers on an optional
basis. Customers opting for this facility will go through a one-time registration process
requiring entry of card details, etc. and AFA by the issuing bank. Thereafter, the registered
customers will not be required to re-enter the card details for every transaction at merchant
locations that offer this solution and thereby save time and effort. In this model, the card
details already registered would be the first factor while the credentials used to login to the
solution (as confirmed by the card network providing the solution) would be the additional
factor of authentication.
3. Accordingly, the AFA requirement for transactions upto ` 2000/- for online CNP
transactions for the ‘payment authentication solutions’ provided by authorised card networks
with the participation of respective card issuing and acquiring banks is being relaxed, subject
to:
i. Only authorised card networks shall provide such payment authentication solutions
with participation of card issuing and acquiring banks,
-2-
भगु तान और िनपटान �णाली िवभाग, क��ीय कायार्लय, 14वी मंिजल, क��ीय कायार्लय भवन,शहीद भगत �सह माग,र् फोटर्, मुम्बई - 400001
फोन Tel: (91-22) 2260 1000; फैक् स Fax: (91-22) 2265 9566; ई मेल-e-mail : cgmdpssco@rbi.org.in
Department of Payment and Settlement Systems, Central Office, 14th Floor, Central Office Building, Shahid Bhagat Singh Road, Fort, Mumbai -
400001
�हदी आसान ह,ै इसका �योग बढ़ाइएii. Customer consent shall be taken while making this solution available to them,
iii. The relaxation for AFA under such solutions shall be applicable for card not present
transactions for a maximum value of ` 2,000/- per transaction across all merchant
categories. Banks and card networks are free to facilitate their customers to set lower
per transaction limits,
iv. Beyond the transaction limit of ` 2000/-, the card not present transaction has to
necessarily be processed as per the extant instructions with mandatory AFA; even
for transaction values below this limit, the customer may choose to make payment
using other forms of AFA as hitherto,
v. Suitable velocity checks (i.e., how many such small value transactions will be allowed
in a day / week / month) may be put in place by banks/card networks as considered
appropriate,
vi. No change in the existing chargeback process.
4. Further, in the interest of customer awareness and protection, the banks and authorised
card networks offering such solutions are also advised to:
i. Make customers aware that the solution is an optional facility for card-not-present
transactions for values upto ` 2000/- only and that they are free to make payments
using other forms of AFA as hitherto,
ii. Educate the customers about its use, risk and the mechanism for customer grievance
redressal and reporting of complaints through multiple channels (website, phone
banking, SMS, IVR etc.),
iii. Indicate the maximum liability devolving on the customer, if any, at the time of
enrolling/registering customers and the responsibility of the customer to report any
frauds while transacting,
iv. Bear the full liability in the event of any security breach or compromise in the
authorised card network.
5. The authorised card network operators, may also facilitate participation of cardholders
from other authorised card networks, through appropriate network level arrangements /
agreements.
6. This directive is issued under Section 10(2) read with Section 18 of Payment and
Settlement Systems Act 2007 (Act 51 of 2007).
Yours faithfully,
(Nanda S. Dave)
Chief General Manager