Global payment tech company Mastercard has submitted a new audit report to the RBI, seeking an overturn of the ban imposed by the RBI on 14th July 2021 citing non-compliance with the storage of payments data rules. RBI has restricted Mastercard from acquiring new domestic customers onto its card network.
Card issuer vs. Card network
Before going deep into what has happened it is important to understand the difference between these two terms. A credit/debit card issuer is the bank or NBFC that issues you the credit/debit card. HDFC Bank, ICICI Bank, SBI, Axis Bank are a few examples of card issuers in India.
On the other hand, the card network acts as the bridge between the card issuer and the merchants. Visa, Mastercard, and Rupay are examples of card networks.
Why did the RBI penalise Mastercard?
The RBI has barred Mastercard Asia Pacific from onboarding new credit/debit and prepaid card customers. This was because it failed to comply with data storage norms. The rules enforced in 2018 mandate that Payment system providers store the entire data in systems located only in India, except for processing cross-border payments. If a payment provider sends data abroad for processing, it should delete the data it sends abroad within the prescribed timeline and store it in India.
The RBI imposed the ban after deciding a “system audit report” submitted by Mastercard’s auditor Deloitte in April 2021 was unsatisfactory. It is under review by the RBI.
New audit report
After the ban, Mastercard’s auditor Deloitte performed a “supplemental audit” and a new report was submitted on 20th July 2021 to the RBI, Reuters reported.
Furthermore, Mastercard said, “We look forward to continuing our conversations with the RBI and reinforcing how seriously we take our obligations. We are hopeful that this latest filing provides the assurances required to address their concerns.”
Similar bans on other card issuers and card networks
Mastercard is the third card network to be barred by RBI this year. Earlier American Express and Diners club were prohibited from onboarding new customers. This leaves just Visa and Rupay as the only card networks allowed to take in new customers.
The RBI had also prohibited HDFC bank from adding new credit card customers and launching digital businesses in December 2020. The action was taken after HDFC Bank’s digital payment services were hit by a series of technical outages.
Do subscribe to our Telegram channel for more resources and discussions on tech-law. To receive weekly updates, don’t forget to subscribe to our Newsletter.