Prepaid Payment Instruments and the Digital Rupee in Indian Banking

Three things that look alike to a user are entirely different in law. A prepaid payment instrument is a private liability: money has been handed to an issuer, which owes it back. A token is not money at all but a substitute number standing in for a card, so that the card itself need never be stored. And the digital rupee is central bank money in electronic form, a liability of the Reserve Bank and legal tender in its own right. This note takes them in that order, because the legal distance between them is the point.

1. Prepaid payment instruments

A prepaid payment instrument is an instrument that facilitates the purchase of goods and services, the conduct of financial services and the remittance of funds, against the value stored in it. The value is paid by the holder in advance, by cash, by debit to a bank account or by credit card. Wallets, prepaid cards, gift cards and transit cards are all prepaid payment instruments, whatever they are called commercially.

They are issued by banks and by non-banks. A non-bank issuer requires authorisation under the Payment and Settlement Systems Act, 2007, and is governed by the Master Directions on Prepaid Payment Instruments issued on 27 August 2021, which replaced and consolidated the earlier framework and recategorised the instruments.

Figure 1: Four categories, distinguished by diligence and by use

The two principal categories

• A small prepaid payment instrument is issued after obtaining minimum details of the holder, and may be used only at a group of clearly identified merchants who have a contract with the issuer. The amount loaded may not exceed ten thousand rupees in a month and one lakh twenty thousand rupees in a financial year, and the amount outstanding may not exceed ten thousand rupees at any time. Funds may not be transferred out of it.
• A full know your customer prepaid payment instrument is issued after completing customer due diligence, may be used at any merchant, permits fund transfer and permits cash withdrawal. The amount outstanding may not exceed two lakh rupees at any time.
• A gift instrument may be issued for up to ten thousand rupees each, is not reloadable, permits no cash withdrawal or fund transfer, and interoperability is at the issuer's option.
• An instrument for mass transit systems may carry an outstanding balance of up to three thousand rupees, is reloadable, is used for transit and allied services, and stands outside the interoperability mandate.

Figure 2: The five ceilings worth remembering

Cash withdrawal, interoperability and escrow

• Cash withdrawal from a full instrument is permitted up to two thousand rupees per transaction, with an overall limit of ten thousand rupees per month per instrument, and the permission extends to non-bank issuers, which was a significant liberalisation.
• Interoperability was made mandatory for all full know your customer instruments and on the acceptance side, including quick response codes, by 31 March 2022. Card based instruments achieve it through the card networks and wallets through the unified payments interface. Instruments for mass transit systems are excepted and gift instruments may opt in.
• A non-bank issuer must maintain the money collected from holders in an escrow account with a scheduled commercial bank, with the permissible credits and debits to that account specified by the Reserve Bank. The escrow balance may not fall below the value of outstanding instruments at the end of any day, so that the float cannot be applied to the issuer's own purposes and is protected if the issuer fails.

2. Tokenisation

A merchant that stores a customer's card details to make repeat purchases convenient becomes, by that act, a repository of card data, and every such repository is a target. Tokenisation removes the data rather than defending it. The actual card number is replaced by a token, a substitute number that is unique to the combination of the card, the token requestor and the merchant or device for which it is created, and that only the card network can map back to the real card.

• Card on file tokenisation became mandatory from 1 October 2022, from which date no entity in the card transaction chain other than the card issuer and the card network may store the actual card number. Merchants, payment aggregators and gateways store only the token.
• Tokenisation is done only with the explicit consent of the cardholder, with additional factor authentication, and the customer may set and change limits on a token and may delete it.
• The service is offered free of charge to the cardholder.
• Only the last four digits of the card and the issuer's name may be stored by others, for transaction tracking and reconciliation.
• The facility was later extended so that tokens may also be generated directly by the card issuer, through its own internet or mobile banking channel, rather than only at the merchant's checkout page.

3. The digital rupee

A central bank digital currency is the currency of a country in electronic form, issued by its central bank. It is not a cryptocurrency, because it is not decentralised and its value is not determined by a market. It is not a bank deposit, because it is a liability of the central bank rather than of a commercial bank. And it is not a prepaid instrument, because it is money rather than a claim to money.

The legal basis

The enabling amendment was made by the Finance Act, 2022, notified on 30 March 2022, which amended the Reserve Bank of India Act, 1934 in three connected ways.

1. The definition of a bank note in Section 2 was expanded to include a note issued in digital form.
2. The Reserve Bank's sole right to issue bank notes under Section 22 was extended to currency in digital form, so that no one else may issue it.
3. The provisions that by their nature apply only to physical currency were made inapplicable to the digital form.

The consequence is that Section 26(1), which makes every bank note legal tender for the amount expressed in it at any place in India, applies to the digital rupee. It is legal tender, guaranteed by the Central Government, and a person tendering it discharges a debt.

The design and the pilots

• The wholesale pilot began on 1 November 2022, for settlement of secondary market transactions in government securities between banks, where the digital rupee replaces the settlement leg.
• The retail pilot began on 1 December 2022, in a first group of cities and through a first group of banks, and has since been extended to many more participants.
• The retail form is token based, which means it behaves like a bearer instrument: the holder possesses the token, and the transaction does not require the identity of each party to be checked against an account. The wholesale form is account based, with the balance tied to an identified holder.
• Distribution is through intermediary banks, which obtain the digital rupee from the Reserve Bank and issue it to users through wallets. The holding is not a deposit with the intermediary and earns no interest.

The open questions

1. Privacy. Cash is anonymous; an electronic record is not. The retail design uses a model in which small transactions are private and larger ones are traceable, but the threshold is a matter of policy rather than of statute, and after K. S. Puttaswamy the question of proportionality in the collection of financial data is a live one. The Digital Personal Data Protection Act, 2023 applies to the intermediaries as data fiduciaries, but there is no instrument specific to this currency.
2. Programmability. The ability to restrict what a unit of digital currency may be spent on is attractive for subsidy delivery and uncomfortable against the idea of legal tender, which by definition discharges any debt. The tension has not been resolved in law.
3. Disintermediation. If the public may hold central bank money directly and in quantity, deposits may move out of banks in a crisis faster than ever before. Holding limits and the absence of interest are the present answers.
4. Liability for failure. Where a wallet fails or a token is lost, it is not settled whether the loss falls on the intermediary, on the holder or on the issuer, because the ordinary framework for unauthorised electronic transactions was written for bank accounts.

4. The three instruments distinguished

5. Quick Revision

1. A prepaid balance is not a deposit and is not insured; the escrow is the protection.
2. A small instrument is confined to identified merchants and permits no fund transfer.
3. Interoperability for wallets runs through the unified payments interface.
4. A token is bound to the card, the requestor and the merchant or device, and is useless elsewhere.
5. Tokenisation requires explicit consent with additional factor authentication and is free.
6. The digital rupee is legal tender because the definition of a bank note now includes the digital form.
7. The retail form is token based and the wholesale form account based.
8. A digital rupee holding is not a deposit with the intermediary and earns no interest.

6. Frequently Asked Questions

Is money in a wallet as safe as money in a bank?

No, and the difference is structural rather than a matter of degree. A bank deposit is insured by the Deposit Insurance and Credit Guarantee Corporation up to the limit in force, and the bank is subject to capital, liquidity and resolution requirements designed around the possibility of failure. A prepaid balance is not a deposit, carries no insurance, and makes the holder an ordinary creditor of the issuer. What protects the holder is the requirement that a non-bank issuer keep the collected money in an escrow account with a scheduled commercial bank, from which only specified debits may be made. That keeps the float out of the issuer's own business, but it is a segregation of assets, not a guarantee.

If tokenisation is mandatory, why do merchants still ask for card details?

They ask for the card details once, at the point of the first transaction, because the token has to be generated from a real card. What they may not do is store the card number afterwards. From 1 October 2022 the only entities permitted to store the actual number are the card issuer and the card network; everyone else keeps only the token and, for reconciliation, the last four digits and the issuer's name. The facility has since been extended so that a cardholder may create tokens directly through the issuer's own banking channel, which removes the need to present the card to the merchant at all.

How is the digital rupee different from money in a bank account?

By whose liability it is. Money in a bank account is a claim on the bank: the bank owes it to the customer, and if the bank fails the customer is a depositor with an insured claim up to the limit and an unsecured one beyond it. A digital rupee is a liability of the Reserve Bank, held through an intermediary but not owed by it, so the intermediary's failure does not affect the holding. It is also legal tender, which a bank balance is not; a creditor must accept the digital rupee in discharge of a debt, whereas he may decline a transfer. The practical trade-off is that it earns no interest, which a deposit does.

Is the digital rupee a cryptocurrency?

No, and the two are near opposites in every respect that matters. A cryptocurrency is issued by no one, has no issuer's liability behind it, derives its value entirely from what others will pay, and operates on a decentralised ledger that no authority controls. The digital rupee is issued by the Reserve Bank, is a liability on its balance sheet, is denominated in and equal to the rupee, is legal tender by statute, and runs on infrastructure the Reserve Bank controls. The only feature they share is that both are held and transferred electronically, which is also true of a bank transfer.

Why does the retail digital rupee use a token based design?

To behave like cash. In a token based system the holder possesses the token itself, and a transfer is a transfer of the token rather than an instruction to debit one identified account and credit another. That allows small value transactions to take place without each party being identified at every step, which is what makes physical cash private, and it also allows offline functionality, since no central account needs to be consulted. The wholesale form is account based because the opposite considerations apply there: the participants are a small set of identified institutions and the amounts are large, so traceability is a feature rather than a cost.

Why may only the issuer and the card network store the actual card number?

Because those two already possess it and cannot function without it, while everyone else in the chain can work from a substitute. The issuer must hold the number to maintain the account, and the network must hold it to map a token back to a card at the moment of authorisation. A merchant, an aggregator or a gateway needs only to identify a returning customer and route a transaction, and a token does both. Restricting storage to the two entities that cannot avoid it reduces the number of databases worth attacking from thousands to a handful, and those few are regulated and supervised. It is a straightforward application of the principle that the safest way to protect data is not to hold it. The same reasoning explains why the token is bound to the merchant or device for which it was created as well as to the card and the requestor: a token stolen from one merchant is useless at another, and a device token stolen from one device is useless on a second, so a breach yields nothing that can be spent anywhere else.

Can a prepaid instrument holder recover money if the issuer fails?

The design of the framework is meant to make that question rare. Non-bank issuers must keep the entire outstanding balance in an escrow account with a scheduled commercial bank, reconciled daily, so customer money never mixes with the issuer's own funds, and the authorisation conditions include net worth and systems requirements meant to keep issuers sound. The escrow bank's obligations and the certificate the issuer's auditors must give the Reserve Bank are the holder's practical protection. A holder also has the Integrated Ombudsman Scheme route against a non-bank issuer for failures to refund, redeem or reverse a transaction, and the ordinary civil remedies remain.

7. Related Topics and Provisions

• The Payment and Settlement Systems Act, 2007
• Retail payment systems and the National Payments Corporation of India
• Electronic banking and customer liability for unauthorised transactions
• Reserve Bank note issue, legal tender and currency management
• Small finance banks and payments banks
• Opening of accounts and Know Your Customer requirements