Security Issues and Risk mitigation measures related to Card Present (CP) transactions – Indian

In continuation of report of WORKING GROUP ON SECURING CARD PRESENT TRANSACTIONS, submitted to RBI on 31/05/2011, RBI, DPSS has started to roll out security measures for ‘Card Present Transactions’.

RBI, DPSS has issued a notification on 22/09/2011, and laid down 3 tasks , for adoption by the various players, in the Cards Industry.

The Press Release can be accessed @ RBI 22 Sept

Broadly the points are :

1. Introduce additional security features for CP (Card Present) transactions. It has been observed, that the reported frauds for CP (Card Present) transactions too are on the rise. This is especially for Credit Cards, which are not yet protected by PIN (Personal Identification Number)
2. One of the options, before RBI  was to adopt e  Aadhaar-based biometric authentication as a second factor of authentication for card present transactions. This option would be reviewed towards the end of December, 2012, to assess the need for a complete switch over to EMV Chip and PIN Technology for card based transactions.
3. (Unique Key per terminal- UKPT or Derived Unique Key per transaction- DUKPT/ Terminal line encryption- TLE) to be live by September 30, 2013. UKPT is a data encryption tool, adapted world-wide in the Cards industry.

                                                              i.      UKPT is a method of generating new keys for use in the DES algorithm from an initial key called a generating or derivation key. This method uses a unique key for every encryption operation and is identified for the decryptor by a serial number combined with an encryption cycle counter, enabling the decryptor to calculate the current key.

4. Enablement of all POS terminals to accept debit card transactions with PIN by June 30, 2013
5. Issuers to be  ready from technical perspective to issue EMV Cards by June 30,2013
6. For international transactions, EMV Chip Card and PIN to be issued to customers who have evidenced at least one purchase using their debit/credit card in a foreign location.

EMV stands for Europay, MasterCard and VISA card standard. It is a global standard based on joint effort by Europay, Mastercard and Visa. Hence, the name EMV.

Europay has been absorbed by Mastercard, in 2002.

EMV cards can be contact based or contactless based.

The main advantages of EMV Contact or EMV Contactless Cards are :

01)  EMV Cards are more secure, than normal cards that rely on data encoded in a magnetic stripe on the back of the card.

02)  The EMV card features a micro-processing chip that stores cardholder data securely, helping reduce the number of fraudulent transactions resulting from counterfeit, lost and stolen cards

03)  A transaction-unique digital seal or signature in the chip proves its authenticity in an offline environment and prevents criminals from using fraudulent payment cards. It is almost impossible to replicate an EMV based card.

04)  Can be used to secure online payment transactions and protect cardholders, merchants and issuers against fraud through a transaction-unique online cryptogram. This is an important security feature, as the numbers of online transactions are increasing day by day

05)  Stores considerably more information than magnetic stripe cards

  The latest trend in EMV cards are dual based i.e the same card can be utilized for ‘Contact’ as well as ‘Contactless’ transactions.

Dishonor of electronic funds transfer for insufficiency of funds in the bank account – clarification

Today Reserve Bank of India, DPSS has issued a clarification on Dishonour of electronic funds transfer for insufficiency of funds in the bank account.

The Press Release can be accessed @ RBI Press Release

The clarification was necessary, as the general market opinion was that on ‘Dishonour of electronic funds transfer for insufficiency of funds in the bank account’, equal protection as under penalties stipulated for dishonor of cheques under the Negotiable Instruments Act, 1881, were not available

Through this clarification, RBI has informed that electronic funds transfer are on par with the penalties stipulated for dishonor of cheques under the Negotiable Instruments Act, 1881.

This clarification should now encourage migration of Loan Payments from the paper-mode to electronic mode.  

It is to be noted, in case of electronic funds transfer i.e Electronic Clearing Services-Debit, the Sponsor Bank can generate the requisite reports in case the ECS transaction is ‘returned.’

As everything moves electronically, the data can be exchanged quickly amongst the various participants in the process.

For an interesting article on the dishonor of cheques under the Negotiable Instruments Act, 1881, please refer here  NI ACT - Dishonor of Cheques

RTGS service charges for members – w.e.f 01/oct/2011. Are you aware of it?

RTGS service charges for members – w.e.f  01/oct/2011. Are you aware of it?

Reserve Bank of India, DPSS, vide Notification No.RBI/2011-12/166,DPSS (CO) RTGS No.388/04.04.002/2011-2012, dt.September 05, 2011, has sought to introduce RTGS Service charges for members.

The notification can be accessed @ http://www.rbi.org.in/scripts/NotificationUser.aspx?Id=6698&Mode=0

The main aim for the charges is twofold:-

01)  Recovery of operational costs;

02)  To bring in further efficiency in the operations and the liquidity flows in the RTGS system.

The second one is more important, and the various participants in the RTGS cycle i.e Remitting Banks, Remitting customers, Beneficiary Banks, Beneficiary Banks will take some time to adapt to.

The charges comprise of 3 components,

(i)                 Membership fee,

(ii)               Transaction fee and

(iii)              Time-varying tariff.

Yes, you have read it right, time-varying tariff. Time-varying tariff is common across other service industries, but this is the first of its kind in the banking industry.

  

The time-varying tariff  is as under:-

Block	Time of settlement at the Reserve Bank of India		Charge per transaction
	From	To
1	09:00 hours	12:00 hours	Nil
2	After 12:00 hours	15:30 hours	Rs 1.00
3	After 15:30 hours	17:30 hours	Rs 5.00
4	After 17:30 hours		Rs 10.00

The maximum charges that can be recovered from the customers including the time-varying tariff is,

RTGS Transaction	Maximum customer charges
Inward transactions	Free
Outward transactions
Rs.2 lakh to Rs.5 lakh	Rs.25 + applicable time varying tariff subject to a maximum of Rs.30/-.
Above Rs.5 lakh	Rs.50 + applicable time varying tariff subject to a maximum of Rs.55/-.

In my next post, will discuss in detail about the contents of this notification.

Express Cheque Clearing System - ECCS

Express Cheque Clearing System - ECCS

Reserve Bank of India, DPSS has decided to take the Bulls by its horns, to upgrade the Clearing Infrastructure in our country.

DPSS, vide its Notification No. RBI/2010-11/423, DPSS (CO) CHD No. 2099/03.02.03/2010-11 dt.March 14, 2011 has launched a program for Automation of non-MICR Clearing Houses – Implementation of a new Clearing Software – Express Cheque Clearing System

The relevant circular can be obtained @ http://www.rbi.org.in/scripts/NotificationUser.aspx?Id=6282&Mode=0

It might be noted that the testing of the new package is over and is now ready for commercial launch.

The high lights of the Circular are: -

a)     The package is named as ‘Express Cheque Clearing System’ (ECCS)

b)     ECCS has been developed by M/s Image InfoSystems Pvt. Ltd. (vendor), http://www.imageinfo.in/main.html

c)      

State Bank of India, led the initiative to fine time the package.

d)     

NPCI – National Payments Council of India, has been vested with the roll-out plan, Pan-India.

e)     

The package will be rolled-out in  1,093 non-MICR centers as on date

f)       

The roll-out will commence from 01/04/2011 and be over by 30/09/2011

g)     

Speed Clearing facility to be operationalised and enabled right from day one of implementation of the package.

h)     

As multiple organizations, viz NPCI, NCCs, clearing locations and the member banks, RBI, DPSS will be closely monitoring the progress and will intervene if the project is behind the time-schedule.

Welcome ECCS. By the year end, the Bank customer’s should be able to experience the benefits of ECCS

As this is a standard package, with a committed timeframe for roll-out Banks should not face any difficulties in rolling out at their end.

Review of Service Charges for Cheque Collection – Local, Outstation and Speed Clearing

Review of Service Charges for Cheque Collection – Local, Outstation and Speed Clearing

Reserve Bank of India, DPSS has issued a Notification today, with wide reaching implications for the Cheque Collection Operations of Banks.

The Notification will be effective from 01/04/2011.

The Notification No is RBI/2010-11/377 DPSS.CO.CHD.No. 1671 / 03.06.01 / 2010-11 dt.January 19, 2011

 The complete Notification can be accessed @ http://www.rbi.org.in/scripts/NotificationUser.aspx?Id=6228&Mode=0

The highlights of the Notification are: -

01)                       There are advantages of using electronic payments, especially for large value transactions.

02)                       RBI will continue to protect the interest of Saving Bank account holders by mandating charges for smaller value transactions relating to saving bank accounts.

03)                       Freedom is specified to Banks, to determine charges for larger value transactions i.e. collection of instruments for credit to other types of accounts.

04)                       The charges so levied, should be fair and transparent.

05)                       Board of Directors has to approve the Service Charge Structure.

06)                       The services charges should specify the maximum charges that they would have to pay, including charges if any, payable to other banks.

07)                       Freeing of Service charges will hasten the movement from paper mode to electronic mode.

The Charges Table – Reproduced from Reserve Bank of India website.

(a)  Service (Processing) Charges for Local Clearing (by Clearing Houses from Member Banks) –

System	Existing (Rs.)		Revised (Rs.)
	Presenting Bank	Drawee Bank	Presenting Bank	Drawee Bank
Clearing at MICR-CPCs	1.00	1.00	1.00	1.50
Cheque Truncation	0.50	0.50	0.50	1.00

(b) Service Charges for Outstation Cheque Collection –

Existing (Rs.)		Revised (Rs.)
	Service charge from all customers		Service Charge from Savings a/c customers
Up to and including 10,000	50	Up to and including 5,000	25^
		Above 5,000 and up to and including 10,000	50*^
Above 10,000 and up to and including 1,00,000	100	Above 10,000 and up to and including 1,00,000	100*^
Above 1,00,000	150	Above 1,00,000	Left to the banks to decide

* No change.

^ All inclusive maximum amount chargeable by banks to the customers.

(c)  Service  Charges  for  Cheque  Collection  under  Speed  Clearing  (by  Collecting  Banks  from customers) –

Existing (Rs.)		Revised (Rs.)
	Service charge from all customers		Service charge from Savings a/c customers
Up to and including 1,00,000	Nil	Up to and including 1,00,000	Nil*
Above 1,00,000	150	Above 1,00,000	Left to the banks to decide

* No change.

The implications of this Notification:

A)    Hectic strategic sessions to draw up the new Service Charge Structure.

B)    Minor Programming changes might be required, as almost all Banks are on Core Banking Solutions (CBS)

C)    Frequent revision of Service Charges depending on the competition.

D)   Accelerate the migration from Paper Mode to Electronic Mode.