8 September 2021
Introduction:
With the pandemic acting as a tailwind for the digital payments industry in India, the fintech industry represents a key opportunity for the Reserve Bank of India (“RBI”) for its financial inclusion push in the country. A key driver in this regard is the burgeoning prepaid payment instruments (“PPI”) industry. PPIs have been widely used in the country for many years, but have seen significant commercial changes in recent times to reach a wider consumer base, given the high market penetration of mobile internet in India.
Keeping these changes in mind, the RBI has taken a proactive regulatory role to effectively harness the potential of PPIs, in the form of its recent master direction on PPIs, issued on August 27, 2021 (“2021 PPI Master Direction”).
New classification:
The 2021 PPI Master Direction simplifies the categories of PPIs to be regulated by the RBI from the erstwhile position of ‘closed system PPIs’, ‘semi-closed system PPIs’ and ‘open system PPIs’ to the newer classification of ‘small PPIs’ and ‘full-know your customer (“KYC”) PPIs’.
‘Small PPIs’ are instruments issued after receiving minimum details of the PPI holder, to be utilised only for the purchase of goods and services with a group of pre-identified merchants, whereas ‘full-KYC PPIs’ are instruments that are not restricted to an identified group of merchants, require the KYC process of PPI holders to be completed, and support fund transfers and cash withdrawals.
The RBI’s intent to regulate ‘full-KYC PPIs’ could be seen in its May 2021 circular, which mandated interoperability for full-KYC PPIs, i.e., ensuring technical compatibility with other digital payment systems to enable cross-platform usage. The RBI has also taken pointed steps to simplify the KYC process by introducing video-based KYC for both the issuance of a full-KYC PPI and converting a small PPI to a full-KYC PPI.
With the new classification, the RBI has narrowed its focus to small PPIs and full-KYC PPIs. Hence, we may now expect closer scrutiny from the RBI on PPI operations in the Indian digital economy.
Interoperability:
The RBI has stressed on the need for PPI interoperability for many years now, and the 2017 master direction on PPIs laid down a phased roadmap to achieve this goal. With the 2021 PPI Master Direction, interoperability has been mandated for all full-KYC PPIs (notably including digital wallets), as well as on the acceptance side by March 31, 2022. An exception is created for PPIs issued in mass transit systems (“MTS”) and gift PPI issuers have an option to offer interoperability.
The 2021 PPI Master Direction specifies that interoperability is to be achieved using the standards set by card networks (for card-based PPIs) and the unified payments interface (for wallets). Going forward, interoperability will be significant as it levels the playing field between banks and non-banks, in addition to reducing the need to hold physical cash.
Scrutinising the deployment of money collected and information security measures:
The money pooled together by non-bank PPI issuers is required to be maintained in an escrow account with any scheduled commercial bank. The RBI takes strict measures to protect PPI holder funds, such as restricting the permissible debits and credits in the escrow account.
The RBI has also introduced new security measures that must be followed by PPI issuers. It has made two factor authentication compulsory for all PPI transactions, except for gift PPIs and PPIs used in MTS. Transaction alerts have been mandated for both online and offline transactions. The RBI also requires PPI issuers to comply with its circulars on enhancing the security of card transactions, e-mandates for recurring card transactions and enhancing public awareness in the face of increasing fraud.
On both fronts, the RBI has followed an approach consistent with its approach in other fintech sectors, most notably, in its guidelines on payment aggregators and payment gateways (“PA/PG Guidelines”), which mandate a similar escrow mechanism that safeguards the collected pool of money. Similar information security measures were also imposed in the PA/PG Guidelines, which highlights the RBI’s concern about the baseline technology standards required to be met by payment system operators.
Conclusion:
With the changes introduced in the 2021 PPI Master Direction, the RBI has sought to balance the need to mitigate risks with its push to adopt fintech solutions in the burgeoning digital economy. The simplified categorisation of PPIs potentially indicates closer regulatory scrutiny over the PPI industry in India in the future. Overall, the RBI has taken a similar regulatory approach in both the 2021 PPI Master Direction and the PA/PG Guidelines.
For further information, please contact:
Anu Tiwari – Partner (Co-Head – Fintech)
anu.tiwari@cyrilshroff.com
