**Policy Summary: RBI/2022-23/95: Restriction on Storage of Actual Card Data (Card-on-File - CoF)**
This circular, issued by the Reserve Bank of India (RBI) on July 28, 2022, under Section 10(2) read with Section 18 of the Payment and Settlement Systems Act, 2007, addresses the restriction on the storage of actual card data, also known as Card-on-File (CoF). It references earlier circulars including DPSS.CO.PD.No.1810/02.14.008/2019-20 dated March 17, 2020, CO.DPSS.POLC.No.S33/02.14.008/2020-2021 dated March 31, 2021, CO.DPSS.POLC.No.S/516/02.14.003/2021-22 dated September 07, 2021, CO.DPSS.POLC.No.S/1211/02.14.003/2021-22 dated December 23, 2021, and CO.DPSS.POLC.No.S/567/02.14.003/2022-23 dated June 24, 2022.
Effective October 1, 2022, entities in the card transaction payment chain, excluding card issuers and card networks, are prohibited from storing CoF data, and any previously stored data must be purged.
As an interim measure to facilitate guest checkout transactions, merchants or their Payment Aggregators (PAs) involved in settlement can save CoF data for a maximum period of "T+4" days, where "T" is the transaction date, or until the settlement date, whichever is earlier. This data is solely for settlement purposes and must be purged afterward.
Acquiring banks are permitted to store CoF data for handling post-transaction activities until January 31, 2023.
Non-compliance with this directive may result in penal action, including business restrictions, as deemed appropriate by the RBI.
For further information, contact P. Vasudevan, Chief General Manager, Department of Payment and Settlement Systems, Central Office, 14th Floor, Central Office Building, Shahid Bhagat Singh Road, Fort, Mumbai – 400001. Tel: 91-22-2264 4995; Fax: 91-22-22691557; email: cgmdpsscorbi.org.in.
Key Entities Referenced
Reserve Bank of India: The central bank of India, referred to as RBI.
Payment System Providers: Entities that provide payment systems.
Payment System Participants: Entities that participate in payment systems.
Card-on-File (CoF): Storage of actual card data.
Payment Aggregator (PA): An entity that facilitates payments for merchants.
Mumbai, Maharashtra: City in India where the central office of RBI is located.
Payment and Settlement Systems Act, 2007: The act under which the directive is issued. Act 51 of 2007.
P. Vasudevan: Chief General Manager at RBI.
RBI/2022-23/95
CO.DPSS.POLC.No.S-760/02-14-003/2022-23 July 28, 2022
All Payment System Providers and Payment System Participants
Madam / Dear Sir,
Restriction on Storage of Actual Card Data [i.e. Card-on-File (CoF)]
Reference is invited to Reserve Bank of India (RBI) circulars
DPSS.CO.PD.No.1810/02.14.008/2019-20 dated March 17, 2020 and
CO.DPSS.POLC.No.S33/02-14-008/2020-2021 dated March 31, 2021 on “Guidelines on
Regulation of Payment Aggregators and Payment Gateways”, circular CO.DPSS.POLC.No.S-
516/02-14-003/2021-22 dated September 07, 2021 on “Tokenisation – Card Transactions:
Permitting Card-on-File Tokenisation (CoFT) Services” and, circulars CO.DPSS.POLC.No.S-
1211/02-14-003/2021-22 dated December 23, 2021 and CO.DPSS.POLC.No.S-567/02-14-
003/2022-23 dated June 24, 2022 on “Restriction on Storage of Actual Card Data [i.e. Card-on-
File (CoF)]”.
2. In terms of the above circulars, with effect from October 1, 2022, no entity in the card
transaction / payment chain, other than the card issuers and / or card networks, shall store CoF
data, and any such data stored previously shall be purged.
3. On a review of the issues involved and after detailed discussions thereon with all
stakeholders, as also keeping in view that sufficient time has elapsed since the requirements were
specified, the following are advised –
a) There shall be no change in the effective date of implementation of the requirements – all
entities, except card issuers and card networks, shall purge the CoF data before October 1,
2022.
b) For ease of transition to an alternate system in respect of transactions where cardholders
decide to enter the card details manually at the time of undertaking the transaction (commonly
referred to as “guest checkout transactions”), the following are being permitted as an interim
measure –
भुगतान और िनपटान �णाली िवभाग, क��ीय कायार्लय, 14वीमंिजल, क��ीयकायार्लयभवन,शहीदभगत�संहमाग,र् फोटर्, मम्ुबई - 400001
फोनTel: (91-22) 2264 4995; फैक्स Fax: (91-22) 22691557; ई-मेलe-mail : cgmdpssco@rbi.org.in
Department of Payment and Settlement Systems, Central Office, 14th Floor, Central Office Building, Shahid Bhagat Singh Road, Fort, Mumbai -
400001
�हदं ी आसान ह,ै इसका �योग बढ़ाइएi) Other than the card issuer and the card network, the merchant or its Payment Aggregator
(PA) involved in settlement of such transactions, can save the CoF data for a maximum
period of T+4 days (“T” being the transaction date) or till the settlement date, whichever is
earlier. This data shall be used only for settlement of such transactions, and must be
purged thereafter.
ii) For handling other post-transaction activities, acquiring banks can continue to store CoF
data until January 31, 2023.
4. Appropriate penal action, including imposition of business restrictions, shall be considered
by the RBI in case of any non-compliance.
5. This directive is issued under Section 10 (2) read with Section 18 of the Payment and
Settlement Systems Act, 2007 (Act 51 of 2007).
Yours faithfully,
(P. Vasudevan)
Chief General Manager