MasterCard Ban In India: Key Implications & Intricacies

Background

India has witnessed various financial disruptions around government regulations in recent times. We have witnessed demonetisation, bank-given moratorium, and various other fiscal events due to which there has been volatility in the industry. There have been commercial contracts, which were supposed to have been honoured (but were not). Large incidences of force majeure which have unfolded in the recent past could have been avoided under a carefully crafted compliance structure.

The RBI mandate of 2018 includes ‘data on soil’ which specifies that all data should always be processed in India. This mandate was imposed on all network operators in India like Mastercard, Visa, Amex, and others. The final date to comply with the mandate was December 2019; and was later extended for obvious reasons to make the compliance more efficient.

By the end of December 2019, MasterCard made its submission. The first audit was completed, with a follow-on scheduled for year later. Post the audit, the government asked for supplementary information. This got delayed due to many reasons (the pandemic being one of them). This is when the government decided to take the matter seriously and imposed the restriction.

Current situation

As we speak, the Mastercard team is working closely with the government to comply as quickly as they can. To understand the impact, the companies working directly with Mastercard as their sole network to onboard new customers or provide Mastercard products will not be able to do this anymore. Some of the companies have an exclusivity contract with Mastercard and are at this point in fire-fighting mode. Moving to an alternative network will take time. But most importantly, in the growth phase of a company, this can have negative repurcussions on the business.

In the second category of financial companies working with Mastercard, the ones having multiple networks, meaning having other secondary networks are slightly less affected. But unfortunately, there is an immediate commercial loss to both categories of customers.

Outside of this, there is a perceived fear of working with Mastercard, as there has been a significant dent in the network’s image. From a compliance standpoint, both Mastercard and Visa work on the same technology (transaction switch) called BASE24. Hence, both will have similar infrastructure from the technical perspective because of using the same tech stack. Comparing these parameters, Visa has been ahead in the race to comply with the government mandate.

Let’s address some major concerns:

1/ When can this restriction be revoked? How will Mastercard be back in business?

From a completion standpoint, the supplementary information has been provided to RBI as of 23/7/21. It is cited that within 3 to 4 weeks, Mastercard will be back on, and restriction could be lifted.

2/ How can companies working with these networks secure themselves?

Fintech companies should work with dual banks and dual networks. This makes sure that the company never suffers a loss due to challenges like these. Matter of fact that this element brings in extra cost, compliance, design, and other factors, but also secures the fintech company from future risks. The other option is evaluating and create contract factoring in future risks if you are going in with exclusivity with any single network.

3/ Can Visa be banned, or is it possible to use Ru-pay for the entire country?

This has two sides. Yes! Ru-pay can be used as it is a well-recognized and prominent network but on the same rails. No! Because it has shallow acceptance across the globe. At the same time, some of the companies will have forex products and other foreign services, which can be easily done on major networks. But Ru-pay is highly limited to certain countries due to bilateral agreements. 

4/ What is the readiness of these networks concerning the Indian data privacy bill, which was supposed to be a law in the Monsoon session? 

Both significant networks have a robust data privacy stack, and they comply with similar laws under different countries’ jurisdictions. In some cases, these networks have been involved with lawmakers to drive discussions around what data privacy should look like for transactions in this region.

5/ Since companies have issued cards on the Mastercard platform as an exclusive network, and documented this in contracts, what should be the way forward for them? Is it acceptable to evaluate other networks as per the legal documents?

One should speak with the representatives from the networks and work with them to solve the critical inflection point which can hamper business. Mastercard is helping existing companies to safeguard their business interests and get issuing structures back on track as soon as possible. 

6/ The government also banned Amex in April, and the restriction is still imposed. Could the same thing happen with Mastercard?

There is no clear information on what is happening with Amex at this point. But there are two reasons why Mastercard will not go down the same path. Mastercard has been a big and important network in the Indian ecosystem and shares strong and important relationships within the banking industry. They have committed significant investments in India over a long period in time. Amex, on the contrary, is not so prominent in this region.

7/ Is it just data storage in India, or does RBI ask the networks to store data and process transactions in India?

These networks are also transaction switches, the transactions are switched between the acquirer to the issuer and vice versa. The definition of processing in this context is “switching of transactions”. The RBI mandate says, “All switching and data storage should happen on Indian soil”. Had it been just data storage, it would have been easy for networks to replicate the storage from one region to another.

8/ Out of data security concerns, is it possible that the Indian government will only encourage the Ru-pay only system in India?

No! Since the Ru-pay network is has a relatively weaker coverage compared to other dominant networks. If the relevant networks are compliant enough and well-aligned with the Indian laws, the need for such restrictions will not arise in the future. India is a large open economy and allows multiple networks to thrive and succeed in the Indian market.

9/ How easy is it to transition from one network to another? How should one understand the time required from a compliance and integration standpoint.

The issuers with exclusivity for Mastercard must go through the lengthy process with Visa. Reason being that they are not a previous member of the Visa network. This could be anywhere between 6 to 8 months from becoming a Visa member to integration and issuance of cards. If companies already have a membership with Visa, it can usually take 2 to 4 weeks to roll out a product.

10/ There are more Ru-pay debit than credit products in the ecosystem. Why is this happening and what could be the way forward for NPCI to make it a vastly accepted network.

NPCI  in 2012 acquired NFS (National Finance Switch). NPCI later added IMPS and other products to its portfolio, where Ru-pay was also a part of it. In the beginning, acceptance was not great, but eventually, since NPCI is an entity within the RBI ecosystem, it mandated PSU banks to use the Ru-pay network. The first product launched was the prepaid card, followed by the debit card. After analyzing the commercial benefits of the product, private banks started using the Ru-pay network. This implementation was rolled out in phases. Subsequently, private banks were also mandated to pledge some of the card issuances to Ru-pay, and hence, Ru-pay debit happened.

Ru-pay credit launched in 2019. It arrived late-to-the-game vis-a-vis other players. It debuted in the market that already had international players dominating the industry. NPCI has now set up a separate team for advanced development of Ru-pay as a credit product; they are also working on loyalty programs, contactless payment, and an entire basket of services seen in the leading networks.

Considering the merchant network of Ru-pay (which is a smaller merchant network compared to others), there are two reasons for this. Merchant network depends on acquiring bank — meaning the acquiring bank network selects the issuer bank. Since a significant market portion is using Visa and Mastercard, Ru-pay lags behind presently. But with time, we should see Ru-pay cards gaining ground in both product ranges.