RBI Concerns On Data Storage Forced Banks To Shut Down OneCard Deal — Exclusive

RBI has written to Federal Bank and South Indian Bank, asking them to re-evaluate their partnerships with fintechs for co-branded credit cards, according to the first two people quoted above.

To be specific, this communication has to do with both banks' partnership with OneCard, the people said.

According to one of the people quoted above, OneCard was likely provided with access to customer data in the partnership, which goes against the regulator's norms.

Storage and the ownership of card data remains with the card-issuer, RBI has said in its latest Master Circular.

"Further, the card-issuers shall not share card data (including transaction data) of the cardholders with the outsourcing partners unless sharing of such data is essential to discharge the functions assigned to the latter," the circular from March 7 read.

It even states that the co-branding partner shall not have access to information relating to transactions undertaken through the co-branded card.

On Wednesday, both Federal Bank and South Indian Bank stopped onboarding any fresh customers for their co-branded credit cards, according to respective exchange filings. It was done to comply with the regulator's amendments to the above-mentioned master directions.

Federal Bank is also re-evaluating its co-branded credit card partnerships with other fintechs, according to the first person quoted above.

At present, OneCard has co-branded partnerships with BoB Financial (Bank of Baroda's credit card business), CSB Bank, Federal Bank, Indian Bank, SBM Bank and South Indian Bank.

Queries sent to Federal Bank, OneCard and South Indian Bank did not elicit a response till the time of publishing this story.

RBI's concern with data storage are not new. In July 2021, it barred Mastercard from issuing new debit cards, credit cards or prepaid, after violating data storage rules. The embargo was lifted after almost a year, in July 2022.

Even in April 2021, the regulator imposed restrictions on American Express Banking Corp. and Diners Club International Ltd. from on-boarding new domestic customers onto their card networks. This was done as they were found non-compliant with the directions on storage of payment system data. The restrictions on Diners Club was lifted in November 2021, while that on American Express was lifted in August 2022.