RBI bars American Express, Diners Club from onboarding new customers

The (RBI) on Friday asked card companies American Express and Diners Club International not to get new domestic customers onboard from May 1 as they did not adhere to the guidelines on local

“These entities have been found non-compliant with the directions on storage of payment system data. This order will not impact existing customers,” the RBI said in a notification on its website.

Reacting to the development, American Express in a statement said: “We have been in regular dialogue with the about data localisation requirements and have demonstrated our progress towards complying with the regulation. While we’re disappointed that the RBI has taken this course of action, we are working with them to resolve their concerns as quickly as possible. This does not impact the services that we offer to our existing customers in India, and our customers can continue to use and accept our cards as normal.”

At the end of February, American Express had credit cards outstanding of 1.56 million and was the seventh-largest issuer in the country. Its cards were used for transactions worth Rs 2,325 crore, according to the RBI data.

The Diners Club data was not separately available; it has a tie-up with in India, the country’s largest card issuer. A spokesperson for was not immediately available for comment, but it is understood that the share of Diners Club in the bank’s total cards portfolio is not much.

Both these cards are premium and are used widely for international travels and high value spending.

“This local obligation is similar to the one proposed under the Personal Data Privacy Bill which suggested very hard data localisation obligation on entities, which were objected to by MNCs,’’ said Salman Waris, Partner – Head TMT and IP Practice at Delhi-based TechLegis Advocates & Solicitors. However, with recent mega data and cyber breaches, it might be worthwhile to have data stored on local servers so as to avoid jurisdiction and governing law and liability issues at a later date in case of such a breach, Waris said.


The central bank, in April 2018, had told all payment system providers to store their entire data in a system only in India. They were also required to report compliance to the RBI and submit a board-approved System Audit Report (SAR), prepared by a CERT-In-empaneled auditor within the timelines specified therein. The data needed to be stored in India included full end-to-end transaction details, information collected, carried and processed as part of the message and payment instruction.

The RBI had given these companies six months for compliance.

That led to a huge hue and cry and the US based companies wanted to engage the US government to pressure India and the RBI to ease rules, Business Standard had reported that time.

Companies like Visa, Mastercard, American Express, PayPal, Google, Facebook, Microsoft, and Amazon, as well as global banks, had planned to form industry-level lobby groups, opposing the RBI’s data localisation guidelines.

A few other powerful lobby groups, such as the Securities Industry and Financial Markets Association (SIFMA), the Global Financial Markets Association (GFMA), and the US-India Business Council (USIBC) were also tapped on behalf of the American companies, according to sources.

But the RBI remained firm in its approach. Following this, almost all payments companies complied with the RBI’s guidelines and stored data locally.

India does not have a specific legislation dealing with user data breach cases or penal actions relating to the same as yet. The Personal Data Protection Bill, which is proposed to deal with such cases of data breaches has been pending in the Lok Sabha since 2019.

Recent cases on data breach have brought the issue centrestage. An alleged data breach at MobiKwik affected the data of 3.5 million of its users, exposing know-your-customer documents such as addresses, phone numbers, Aadhaar card, PAN cards and so on. The size of the data was reported to be 8.2 TB. MobiKwik has denied the breach.

Earlier this month, millions of records of pizza chain Dominos’ customer data were leaked online. Facebook and LinkedIn also saw data leaks of millions of users this month, including the data of Indian users. While both admitted that customer data had been leaked, both said it wasn’t hacked from their systems, but had been scraped. This means using an application to extract valuable information from a website.

Dear Reader,

Business Standard has always strived hard to provide up-to-date information and commentary on developments that are of interest to you and have wider political and economic implications for the country and the world. Your encouragement and constant feedback on how to improve our offering have only made our resolve and commitment to these ideals stronger. Even during these difficult times arising out of Covid-19, we continue to remain committed to keeping you informed and updated with credible news, authoritative views and incisive commentary on topical issues of relevance.

We, however, have a request.

As we battle the economic impact of the pandemic, we need your support even more, so that we can continue to offer you more quality content. Our subscription model has seen an encouraging response from many of you, who have subscribed to our online content. More subscription to our online content can only help us achieve the goals of offering you even better and more relevant content. We believe in free, fair and credible journalism. Your support through more subscriptions can help us practise the journalism to which we are committed.

Support quality journalism and subscribe to Business Standard.

Digital Editor

Source link

Free Course

"Double Your Traffic in 30 days" + Secret Bonus

valued at $299

This amazing course will teach you, step by step, how to double if not triple your traffic over the next 30 days.

100% Privacy. We will never spam you!