RBI issues new rules for credit, debit cards meant for business accounts
Under the new norms, the RBI said that card-issuers cannot share data of customers with outsourcing partners, unless it is “essential to discharge the functions” of the outsourcing partners.
The Reserve Bank of India (RBI) on Thursday tweaked the rules for credit and debit cards used for business accounts. Under the new rules, the central bank asked business card issuers to put in place an effective mechanism to monitor the end use of funds. The new provisions will come into effect immediately, the RBI said.
In February, the RBI had ordered Visa to stop using an unauthorised route to make business-to-business card payments, which used fintech companies as an intermediary. The regulator said that card-issuers cannot share data of customers with outsourcing partners, unless it is “essential to discharge the functions” of the outsourcing partners.
The RBI said if data needs to be shared, explicit consent from the cardholder will need to be obtained. It added the storage and ownership of card data should remain with the card-issuer.
In exercise of the powers conferred by Section 35A of the Banking Regulation Act, 1949 and Chapter IIIB of the Reserve Bank of India Act, 1934, the Reserve Bank of India being satisfied that it is necessary and expedient in the public interest to do so, hereby, amends certain provisions issued vide Master Direction DoR.AUT.REC.No.27/24.01.041/2022-23 dated April 21, 2022 on ‘Credit Card and Debit Card – Issuance and Conduct Directions, 2022’,” the RBI said.
“The information displayed through the CBP’s platform shall be visible only to the cardholder and shall neither be accessed nor be stored by the CBP,” the RBI said.
The RBI said that for the purpose of cardholder’s convenience, card transaction-related data may be drawn directly from the card issuer’s system in an encrypted form and displayed in the co-branding partner (CBP) platform with robust security.
