While Visa partially complied with the RBI mandate in 2018, it is now the first global financial services company to start storing user data only in India.
The Visa payment card network has met the requirements of the Reserve Bank of India in 2018 circular for the localization of payment data, The Hindu Business Line reported. The company has not made any public announcements regarding compliance with this circular, which obliges payment industry players to store all user data in India, and only In India, circumstances suggest that Visa is unlikely to have met the requirements. Earlier this month, RBI stopped banks from issuing new Mastercard payment cards, but did not signal that it would likely do the same for Visa.
Why it matters: While Mastercard and Visa are a practical duopoly in many parts of the world, payment localization requirements seem to have thrown them off. Mastercard grumbled in 2018 that no other country in the world has such strict data localization standards that prohibit mirroring, the practice of locating user data and storing it on servers around the world. As long as Mastercard is not compliant, the Indian market for card payment networks is still a duopoly; But this time the other player is RuPay, the National Payments Corporation of India’s native alternative.
All system providers ensure that all data on the payment systems they operate are stored in one system only in India. This data should include the full end-to-end transaction details / information collected / carried / processed as part of the message / payment order. For the international part of the transaction, the data can also be saved abroad if required. – RBI circular 2018 (emphasis added)
The RBI said on July 14th that, despite three years since its circular, Mastercard had not proven that it only stores data in India. “Although a lot of time has passed and reasonable opportunities have been given, it has been determined that the company is not following the instructions for storing payment system data,” said RBI. This forced RBL Bank and YES Bank to find alternatives to credit cards – these banks only issued cards on the Mastercard network. But this process can take months.
While RBL Bank said it signed a deal with Visa in the days leading up to the Mastercard ban, it will take at least two months for Visa cards to be issued. YES bank supposedly said it would sign such an agreement this week and it would be at least three months before Visa credit card issuance began.
Compliance with the RBI circular
The circular set the compliance period at six months, and some companies said they adhered to it themselves in 2018. However, global payment companies resisted or took time to comply with the RBI’s order. PhonePe said in 2018 that big tech companies like Google and Facebook are resisting the order because complying with the regulations could potentially increase their tax burden.
In October 2018, the following companies complied with the circular:
- October 9, 2018: Whatsapp confirmed its compliance with the circular.
- October 24, 2018: Alfred Kelly, CEO of Visa says that Visa will store data locally from October 15th.
- October 30, 2018: Amazon India says It has started to store payment details locally without being mirrored on overseas servers.
The circular has also caused some international setbacks: The US Trade Representative cited data localization requirements as burdensome for American companies, partly because of these restrictions, which sanctionsed Indian imports into the US (but were immediately suspended).