RBI to issue norms for payment security, raises contactless cap to Rs 5,000

The Reserve Bank of India (RBI) on Friday said that it will issue guidelines on digital payment security controls in view of the pre-eminent role being played by digital payment systems in India. The announcement comes at a time when a large bank has been served growth restrictions on account of repeated payment system outages and the overall rate of transaction failures in the UPI system has surged. The central bank also raised the ceiling for contactless card transactions and e-mandates for card and UPI-based transactions to Rs 5,000 from Rs 2,000.

In a rare instance of a central bank governor referring to a regulated entity by name, Shaktikanta Das said the decision to take supervisory action against HDFC Bank stemmed from repeated episodes of outages and the bank’s overwhelming presence in the digital payments segment. “We have some concerns about different deficiencies and, therefore, we felt that it is necessary that HDFC Bank strengthens its IT systems before expanding further,” Das said, adding, “We cannot put thousands or lakhs of customers who are using digital banking into any kind of difficulty for hours together and especially when we are ourselves giving so much emphasis on digital banking. The public confidence in digital banking needs to be maintained.” He also said that the RBI’s teams are studying the incidence of a data centre outage at State Bank of India (SBI) that took place on Thursday.

The governor emphasised the general need for all banks and all financial entities to invest more in IT systems and technology if they wished to retain public confidence in the system. The RBI is constantly engaged with the management of various banks and non-bank lenders where it sees deficiencies in systems and procedures. It tries to work with them internally and nudge them to improve their systems. “In certain situations, certain actions become unavoidable and inevitable and as the custodian of the digital payment segment in the country, the central bank has to act and that is precisely what we have done,” Das said.

Industry executives said that in an environment of increased adoption of digital processes, there are numerous threats that could hamper the process. Bharat Panchal, chief risk officer for India, Middle East & Africa, FIS, said, “In the proposed draft by the central bank, one can expect measures like increasing payment speed and reducing the infrastructure complexity, real-time fraud detection and prevention, improving the precision of risk scoring and accuracy of transaction blocking, and continuously screening for known fraud patterns.”

Payment firms also welcomed the higher cap on contactless payments and e-mandates, adding that it would encourage smaller businesses to accept digital payments. “Be it a monthly kirana bill, spa service or a course fee, the spectrum of products and service that can be paid through contactless payments will definitely expand with this new move,” said Manish Patel, founder and CEO, Mswipe. The increase in limit would enable faster checkouts and increased transaction volumes, thereby enabling merchants to reduce cash handling costs, Pine Labs said in a statement.

In addition to specific norms on digital payments, the central also plans to put in place a comprehensive framework for grievance redressal at banks. The framework will include enhanced disclosures on customer complaints by the banks, a monetary disincentive in the form of recovery of cost of redress of complaints from banks when maintainable complaints are comparatively high, and undertaking intensive review of grievance redress mechanism and supervisory action against banks that fail to improve their redress mechanism in a time-bound manner. The framework would be put in place during January 2021.