RBA warns Visa, Mastercard on tokenised payments

George Lekakis Payments, mobile & wallets

A new battleground has emerged in the payments war between Eftpos Australia and the dual network debit schemes operated by Visa and Mastercard.

In recent correspondence, the Reserve Bank has warned debit card issuers and the dual network schemes (Visa and Mastercard) that they should not use tokenisation of online transactions to undermine competition in the burgeoning ecommerce payments market.

Tokenisation is the process by which card schemes issue unique reference numbers (tokens) to replace card numbers when cardholders initiate transactions over the internet or via mobile apps.

The process ensures that sensitive customer data, including bank account details, are not exposed when transactions are being processed over the web or through wireless networks.
Tokenisation is being adopted in Australia as part of efforts to combat the high level of  card-not-present(CNP) fraud on ecommerce transactions.

However, the technology also provides debit schemes with the ability to prevent merchants from routing CNP payments through rival processing networks.

Eftpos Australia last year rolled out a new service aiming to compete against Visa and Mastercard for processing card-not-present debit transactions.

The RBA now appears to be monitoring the rollout of new tokenisation programs by the schemes to gauge whether tokens might be designed to lock out competitors.

In an email sent to industry participants in March, the RBA’s head of payments policy Tony Richards said the RBA would be concerned if initiatives to tokenise card-not-present transactions led to a reduction of competition and choice in the processing of CNP payments.

“The Bank(RBA) has been made aware of potential issues regarding the process of tokenisation of dual-network debit cards,” Richards states in the email that was also sent to banks and other debit card issuers.

“Accordingly, the Bank would be concerned if, as plastic cards are supplemented by a variety of other means of accessing a customer’s account, any actions were taken by schemes or scheme participants that had the purpose or effect of diluting or preventing competition between networks, by removing choices previously available to cardholders and merchants.”

The RBA’s messaging to the industry seems clear: don’t design tokens that cannot be recognised or received by rival processors of debit card transactions.

Richards told the schemes in the email that the RBA supported tokenisation programs as part of an industry effort to reduce CNP fraud, but stressed they should not be used to inhibit the routing decisions of merchants.

“Specifically, the Bank would be concerned if scheme rules or policies on tokenisation limited the ability of merchants to choose to route card-not-present transactions through their preferred network,” he told industry participants in the email.

The warning from the regulator follows its efforts over the last two years to stoke competition in the contactless payments market.

Major banks are now rolling out new services that allow merchants to decide whether Eftpos or one of the dual network schemes processes contactless debit transactions made through point-of-sale terminals.

While the RBA had requested the banks to provide an automated routing service to merchants that would seamlessly direct each contactless payment to the cheapest provider, most banks have developed alternative platforms that only allow merchants to select a single network to process all of their transactions.

Tyro is the only bank to introduce least cost routing in line with the RBA’s preferred model.

All comments are posted by subscribers and don't necessarily reflect the views of Banking Day or WorkDay Media.

Banking Day reserves the right to edit or decline to publish any comment for any reason. If you would prefer not to use your real name, type "anonymous" in the name field and we will withhold it from publication. However, using a name that is different to the one recorded in our administration system may result in your comment not being published.

Comments are limited to 200 words.

Contact details