RBI Card Tokenisation Rules: What Users Must Know in 2026

If you shop online, pay on apps, or keep your card “saved” on your favourite platforms, RBI’s card tokenisation rules are the reason your card experience looks different today than it did a few years ago. In simple terms, RBI pushed the system away from websites storing your real card number and towards a safer substitute called a token. That change is already in effect.

So why talk about this in 2026? Because tokenisation is only one part of safer card payments. The next big layer is how payments get authenticated (how the system confirms it’s really you), and RBI’s newer directions require the ecosystem to be compliant by April 1, 2026.

This guide explains what tokenisation is, what it changed for “saved cards,” what you can control as a user, and what to expect as authentication rules tighten in 2026.

Why do “saved cards” still feel confusing in 2026?

This is because the idea of a saved card stayed the same, but what information gets saved has changed.

Earlier, many apps and websites stored your card details (called “Card-on-File or CoF”). RBI’s direction was clear. Starting from October 1, 2022, no entity in the card payment chain other than card issuers and/or card networks should store Card-on-File data, and any previously stored data should be purged or removed.

That’s why, on many platforms, you had to “save” your card again, or re-confirm it. What you saved after that was usually a token of your actual card.

What is RBI's card tokenisation?

RBI’s card tokenisation means your actual card details are replaced with an alternate code called a token. That token is not random in a loose way. Token is a unique code generated from a combination of:

• your card
• the token requestor (the app/website asking to tokenise)
• and your device

Think of it like this. You didn’t “save your card number” on a shopping app. You saved a safe substitute that works for that specific setup.

Is Card Tokenisation Compulsory for Users?

The Reserve Bank of India (RBI) has clearly stated that tokenisation is not mandatory for customers. And, customers will not incur any charges associated with the tokenisation process.

However, many platforms will strongly encourage tokenisation because it makes repeat payments smoother without storing your real card number.

Who Can Store What, and What Exactly Got Banned?

This is the heart of the RBI change. RBI’s directions around “Card-on-File” storage state that no entity in the card transaction/payment chain (other than the card issuer and/or card network) shall store CoF data, and any previously stored data should be purged.

RBI also clarified that for tracking/reconciliation, entities can store limited info like last four digits and the card issuer’s name.

So, when you see a saved card displayed as “XXXX-XXXX-XXXX-1234”, that’s the kind of limited reference that can exist without storing your full card details.

How Does RBI's Card Tokenisation Happen When You “save” a Card?

Card tokenisation typically happens when you tap “save card” or “securely save card” during checkout.

Tokenisation happens when the cardholder initiates a request on the token requester's app, and the request is forwarded to the card network (with issuer consent) to issue the token.

Another important part: registration for tokenisation must be done only with explicit customer consent, and it requires Additional Factor of Authentication (AFA) validation by the card issuer.
That’s why you may see an OTP prompt when saving a card—even if it feels like “I’m not paying yet.”

Why Do Users Still Get OTP Sometimes If the Card is Tokenised?

It is because card tokenisation and authentication are two different safety locks.

• Tokenisation reduces exposure of your card number to merchants
• Authentication is the system proving it’s really you approving the payment (often via OTP, PIN, etc.). RBI’s newer directions continue to require two-factor authentication for digital payments, with a compliance deadline of April 1, 2026.

So tokenisation doesn’t mean “no OTP forever.” It mainly means “your card number is not sitting in merchant databases.”

Tokenisation vs Authentication

What Happens When You Change Your Phone or Your Card Gets Replaced?

This is where tokenisation feels “annoying,” but it’s actually expected. RBI’s own framing explains tokenisation can be device-linked (card + token requestor + device). So a new device can mean you need to tokenise again.

Also, RBI’s CoFT circular notes that when a card is renewed or replaced, the issuer should seek explicit consent for linking it with merchants where the card was earlier registered. So if a platform asks you to re-confirm a saved card after a card reissue, that’s consistent with how RBI designed the flow.

Which Myths Should Users Stop Believing?

1. Myth 1: “Tokenisation means no OTP”

   Not true. Tokenisation reduces where your card number is stored; authentication still protects the approval step

2. Myth 2: “Merchants still have my full card number anyway”

   RBI requires that merchants/PAs should not store actual CoF data (other than issuer/network)

3. Myth 3: “One saved card works everywhere the same way”

   Tokens are issued in a specific context (card + token requestor + device, and for CoFT also merchant combinations)