Prepaid Payment Instruments – The Future Of Online Payments

Applicability

The New Master Directions are applicable to PPI Issuers, System Participants^[4] and excludes System Providers which were specifically covered within the scope of the Previous Master Directions. Since, System Providers are already included in the definition of System Participants under the Payment and Settlement Systems Act, 2007 ("PSS Act"), it may have been deleted from the New Master Directions. However, it is important for the System Providers to also adhere to the compliances under the New Master Directions and it may be prudent for RBI to clearly specify whether it is applicable to System Providers or not.

Change in classification of PPIs.

• Under the New Master Directions, RBI has classified PPIs into, Small PPI and Full KYC PPI. Small PPIs (which are akin to minimum details Semi-Closed PPIs^[5] in the Previous Master Directions) are e-wallets like Oxigen, Mobikwik and are issued by banks and non-banks after obtaining minimum details of the PPI holder^[6]. Minimum details shall necessarily include such as a mobile number verified with One Time Password (OTP) and a self-declaration of name and unique identity / identification number of any 'mandatory document' or 'Officially Valid Document (OVD)' or any such document as provided under the Master Direction on KYC of RBI^[7]. These PPIs are used for purchase of goods and services from designated third parties which have a specific contract with the issuer to accept the PPI as a payment instrument. Fund transfer and cash withdrawal from such Small PPIs is not permitted. These are further bifurcated into cash loading facility and without cash loading facility. Cash loading facility can be loaded/reloaded through cash at a particular retail location, or through direct deposit such as debit to a bank account, or by credit and debit cards. However, in case of without cash loading facility one can only deposit directly through a debit to a bank account or by credit and debit card.

Further, previously the semi closed PPIs consisted of PPIs up to Rs.10,000/- by accepting minimum details of the PPI holder and PPIs up to Rs.1,00,000/- after completing KYC of the PPI holder. In addition, the semi-closed PPIs up to INR 10,000 were required to be converted into a KYC Compliant semi-closed PPI within 24 months. Now the small PPIs with cash loading (up to INR 10,000) is to be mandatorily converted into a full KYC PPI within 24 months. Further, reissue of such PPIs using the same mobile number and same minimum details is not allowed. Small PPIs with no cash loading are now allowed to be loaded/reloaded from full KYC PPIs in addition to earlier provision of being loaded/reloaded from a bank account and credit card. However, the total amount that can be loaded in a small PPI with cash loading in a financial year has been enhanced to INR 1,20,000 from earlier limit of INR 1,00,000.

To sum up, the major change from the Previous Master Directions is that non-bank PPIs were not allowed to issue Full KYC PPIs (formerly Open Ended PPIs), however under the New Master Directions non-bank PPI issuers have been permitted to issue full KYC PPIs. This effectively opens non-bank issuers, such as NBFCs and big technology players to a plethora of business opportunities and innovation in the digital wallets segment and provides more options for the consumers to choose from.

• Full KYC PPIs (which were earlier referred to as Open Ended PPI^[8] )are issued by banks and non-banks after completing Know Your Customer (KYC) of the PPI holder. The amount outstanding in these PPIs cannot exceed Rs.2,00,000/- at any point of time. The cash loading of PPIs is limited to ₹ 50,000/- per month subject to overall limit of the PPI. PPI issuer must set the limits within this ceiling considering the risk profile of the PPI holders, other operational risks, etc. Funds transfer limits for all other cases have been restricted to Rs.10,000/- per month. These PPIs may be used at any merchant for purchase of goods and services, fund transfer and can also be used for cash withdrawals. A travel card is a type of Full KYC PPI. It can be used for all types of spending and for cash withdrawal from ATMs.

In comparison to the Previous Master Directions, the open system PPIs: (i) Non-banks have now been allowed to issue full KYC PPIs while earlier only banks were allowed to issue open system PPIs;^[9] (ii) The limit on outstanding amount in such PPIs has been enhanced to INR 2,00,000 from earlier limit of INR 1,00,000;^[10] (iii) Fund transfer limit for pre-registered beneficiaries has also been enhanced to INR 2,00,000 per month per beneficiary from earlier limit of INR 1,00,000 per month per beneficiary;^[11] (iv) Moreover, the new directions have specified cash withdrawal limit from full KYC PPIs while the earlier directions were silent on the same. The withdrawal limit issued by banks have a limit of INR 2,000 per transaction with total monthly limit of INR 10,000 across all locations (tier 1 to 6 centres) for cash withdrawal at Point of Sale (PoS) devices.^[12] Whereas, the withdrawal limit for non-bank has a limit of INR 2,000 per transaction with total monthly limit of INR 10,000 across all channels (agents, ATMs, PoS devices etc).

Interoperability

The RBI has been stressing on the requirement for PPI interoperability since a long time and has taken various steps to overcome the challenges in respect of achieving this goal. The New Master Directions has mandated interoperability for all full KYC PPIs ^[13] (including digital wallets) by March 31, 2022. By allowing this, customers can use their PPI card or e-wallet at any payment acceptance point. The New Master Directions provide that the interoperability needs to be achieved by using the standards as set by card networks (in case of card based PPIs) and Unified payments interface (UPI) (in case of wallets). As per the New Master Directions even a payment wallet or a prepaid card falling in the category of full KYC PPIs can be used to withdraw cash at ATMs, micro-ATMs and eligible PoS terminals. Further, in case of digital wallets one may transfer funds from one wallet to another wallet for instance, a customer can transfer their Paytm wallet funds to a Phonepe wallet if they wish. Once enabled the interoperability of PPIs can change the digital payments infrastructure and might also lead to a decline in the utility and presence of banks in the digital payments infrastructure as more and more users will make payments through these digital wallets which have had a greater penetration in the Indian market and are expected to reach every nook and corner of the country. However, offering of interoperability is option for Mass Transit Systems ("MTS") and gift PPI issuers, MTS are those PPI issued by MTS operators like Indian Railways, Mumbai Metro, Delhi Metro and even local buses and can be used to pay fare for public transport;^[14] Gift PPIs on the other hand are a form of prepaid gift voucher which can't be reloaded and are usually targeted to a beneficiary.

RBI has opened a huge market for the Fintech players to expand services that were only available for the traditional banks. There is no doubt that the banks will continue to be relevant for core lending functions. However, a combination of wallet, payments banks and other payment systems will soon be able to offer users a range of services not very different from neo-banking platforms.

Permission to use INR denominated PPIS for cross border outward transaction

In the Previous Master Direction, KYC compliant Semi-closed Systems PPIs and Open System PPIs could be used in cross-border outward transaction. However, under the New Master Direction, only the Full KYC PPIs can be used for such transactions. PPI users can undertake permissible current account transactions under Foreign Exchange Management Act (FEMA) viz. purchase of goods and services, subject to adherence to extant norms governing such transactions subject to a per transaction limit of Rs. 10,000/- and monthly limit of Rs. 50,000/-

Scrutinizing the deployment of money collected and information security measures:

•  The money collected by non-bank PPI issuers is to be held in an escrow account at a scheduled commercial bank^[15]. The RBI has taken stringent steps to protect the funds of the PPI Issuer. Some of these include restricting the permissible debits and credits in the escrow account^[16]. Moreover, the New Master Directions have also introduced security measures for all PPI transactions, where all PPIs (except PPI for MTS and gift PPIs) are now required to put in place 2 factor authentication^[17] for all wallet transactions involving a debit to the wallet including withdrawal of cash. Transaction alerts have also been mandated for both online and offline transactions. The RBI also requires compliance of PPI issuers with its circulars on enhancing the security of card transactions, e-mandates for recurring card transactions and enhancing public awareness in the face of increasing fraud. The RBI has taken a similar approach in other fintech sectors, most notably in its guidelines on payment aggregators and payment gateways^[18] ("PA/PG Guidelines"), which prescribe a similar escrow mechanism and similar information security measures Further, in view of increasing cyber-security risk and cases of unauthorized transactions on PPIs, these enhanced security norms would help towards curbing cases of fraud.

•  A non-bank PPI issuer which happens to be a member of centralized payment systems operated by RBI and covered under Master Directions on Access Criteria for Payment Systems that has been now allowed to access Real Time Gross Settlement ("RTGS") and National Electronic Fund Transfer ("NEFT") systems etc. has to maintain a current account^[19] with RBI This would allow non-bank PPIs to offer their users high-value transaction services through the NEFT and RTGS systems. This facility is expected to minimize settlement risk in the financial system and enhance the reach of digital financial services to all user segments. ^[20]

Perpetual authorization for Non-Banks

Under the New Master Direction, the Certificate of Authorization ("COA") for non-banks is granted in perpetuity^[21] (including for existing ones due for renewal) provided the following conditions^[22] are fulfilled:

• Issuer must comply with terms and conditions subject to which authorization had been granted.
• Issuer must fulfill entry norms (capital and net worth requirements etc.)
• There must be no major regulatory or supervisory concern relating to operations observed during onsite or offsite monitoring.
• The customer grievance redressal forum must be efficient.
• There shouldn't be adverse reports from any department of RBI or other regulator/statutory body.

Earlier, the Previous Master Directions provided that the validity of the CoA will be up to 5 years. This pragmatic step does away with undue burden on the non-bank PPI issuers compliant with the eligibility criteria and opens a way for the ease of doing business in the country. Further, Non-bank PPI issuer whose CoA is revoked or not renewed for any reason; or CoA is voluntarily surrendered for any reason; or application for authorisation has been rejected by RBI; or new entities that are set-up by promoters involved in any of the above categories; will have a one-year cooling period. During the said cooling period, entities shall be prohibited from submission of applications for operating any payment system under the PSS Act^[23].

The New Master Direction are a step forward for the entire payment ecosystem in India. It endeavours to balance the push to adopt Fintech solutions in the digital economy and the foreseeable security risks. The biggest takeaway of the New Master Directions is allowing non-bank PPI issuers, such as NBFCs to issue Full KYC PPI as this will ensure more innovations and technological development in the sector. The New Master Directions also permits co-branded PPIs and provides flexibility to have a co-branding partnership with government department / ministry.

Further, RBI has been pushing interoperability for a long time and making it mandatory will ensure that wallets will be able to compete with Unified Payments Interface (UPI) and other payment mechanisms. However, customers will have to be more careful about digital frauds and the PPI issuers will have to ensure that their technology infrastructure is able to manage these risks. RBI may also provide for grievance mechanism in case of material financial consequences as well as cancellation of license of the PPI issuer in case the PPI issuers are unable to put necessary security processes in place.