91����ԭ��

The Reserve Bank of Australia (RBA) will continue to allow card issuers to set a default network on co-badged debit cards and has committed to developing standards on tokenisation.

In a conclusions paper published on September 28, the RBA responded to an earlier consultation aimed at increasing the safety, efficiency and competitiveness of Australia’s debit card market.

Opened in June this year, the  looked at the practice of default routing on dual-network debit cards (DNDCs), and considered the need for tokenisation standards across the payments industry.

Writing in the conclusions paper, the RBA’s Payments System Board said it will no longer consider prohibiting card issuers from selecting a default network on DNDCs.

“Stakeholders’ feedback indicated that any benefits from such a prohibition would likely be outweighed by the costs and risks involved,” the board wrote.

“Prohibiting the setting of a priority network would be costly as it would require all DNDCs to be reissued.”

“There would also be the risk of failed transactions, particularly for overseas transactions and for certain types of transactions in Australia, including those made at legacy terminals.”

On the other hand, the board said there was “broad support” among stakeholders for the idea of introducing “more standardisation” for tokenisation of card payments.

Seeking feedback by October 13, the board tabled several standardisation proposals, and said it will publish “high-level expectations” for the industry by the end of 2023.

Lack of support for default network ban

The RBA said that default routing of contactless DNDC transactions to Visa and Mastercard has “been a concern” for a number of years.

Without the ability for merchants to route these transactions via eftpos, Australia’s low-cost domestic scheme, the RBA believes that upward pressure is put on merchants’ debit card costs.

In 2022, as covered by 91����ԭ��, the RBA Payments System Board  that debit card transactions routed via eftpos are on average 23 basis points cheaper than those routed via Visa or Mastercard.

Least-cost routing, the RBA’s first solution to this problem, has not progressed at the pace the bank would have liked to see.

As of June 2023, least-cost routing for card-present transactions has been  for little more than half of all merchants.

In the consultation, the RBA considered whether scrapping default network settings on DNDCs could ensure that all merchants get the benefits of least-cost routing.

However, based on industry feedback, the RBA has come to the view that this is not a practicable solution.

Risks too high

Although it is technically feasible to go without default network settings, stakeholders agreed that doing so would provide no more benefit to merchants than that which is currently offered by least-cost routing.

Moreover, there is also the risk that removing default network settings could result in more failed transactions and little increase in volume for eftpos.

Under EMVCo standards, if there is no default network set at issuance, and the merchant is not using a least-cost routing-enabled terminal, then the transaction is routed to the network whose application is listed first.

This is likely to be the international network, stakeholders said, to ensure that cards still work when used overseas.

Prohibiting a priority network would also be costly, they said, as it would require all DNDCs to be reissued with new EMV chips without a default network selected.

“If the change were to be implemented as soon as possible, the cost to industry would be significant,” the board said.

“Alternatively, if left to natural card reissuance cycles to reduce these costs, the implementation could take three years or more."

On balance, the board concluded that continuing to pursue least-cost routing initiatives was preferred to removing default network settings.

RBA sees value in card tokenisation

The second question put forward in the consultation is whether Australia could benefit from introducing unified standards for tokenisation.

Tokenisation is when a cardholder’s primary account number (PAN) is converted into a unique token that carries less sensitive information, and use can be restricted to a particular device or merchant.

The consultation sought stakeholder views on expectations the RBA could set to reduce the amount of sensitive card details being held across the payments industry.

In particular, views were sought on the relative importance of addressing token portability, token synchronisation and token visibility issues.

The RBA said that most stakeholders agreed that card schemes were “best placed” to develop token portability solutions under an industry framework.

Stakeholders suggested three models for how this could work, namely:

1. A network-agnostic token that is compatible across all networks.
2. Requiring schemes to offer token migration services (e.g. via an API).
3. Requiring schemes to share data to support token migration.

Most stakeholders were supportive of the RBA setting some high-level expectations for the industry, with AusPayNet playing a central role in coordinating the industry’s work to meet those expectations.

The RBA suggested the end of 2024 as a target for achieving token portability and making “substantial progress” on removing PANs, but stakeholders were divided as to whether this is feasible.

“Some stakeholders were concerned about their systems’ deep reliance on PANs and suggested that there could be a staged timeline for the reduction of PAN storage to provide a smooth transition towards full tokenisation,” the board said.

As such, a target of mid-to-late 2025 was seen as more feasible.

The RBA also noted that, given the relevance of token portability to the wider payments industry, the expectations should be met for all cards, including debit cards and credit cards.