IBSPECIAL

There have been thirteen days without Mastercard adding new business in India. This is not what the global payments system operator anticipated going through in a marketplace where it was strongly entrenched and had promised to invest another $1 billion to fast-push its growth.

For Mastercard and Visa, India was an oligopoly market. Together, they enjoyed nearly 85% market share, with Visa marginally ahead. RuPay, a homegrown payment network backed by the National Payments Corporation of India (NPCI), was growing but was low in the value chain. American Express and Diners Club International, much smaller players, were shunted out of India’s growing market this May when they could not comply with the local-data storage rules prescribed by the Reserve Bank of India (RBI).

Even as the market opened up, there were many who were bullish about Mastercard’s business opportunity. In India’s growing digital payments ecosystem, Mastercard was poised to play a pivotal role along with Visa. Many banks had lined up their credit card expansion plans with Mastercard in mind. RBL Bank had gone exclusive with them, so had Yes Bank and Federal Bank.

But inside the Mastercard organisation, there were moments of nervousness and anxiety even as business leapt. An extreme fear lurking on the horizon was that things could go wrong, as in the case of American Express. In April, the RBI had sought additional clarifications about the US-based payments technology major’s data localisation framework. The dialogue continued from May through June. As July neared, the RBI was pressing for a quick compliance on local data storage rules, and time was running out. A ban from the regulator would leave open wide space for Visa to have a near-monopoly run.

At the heart of the problem is a rule introduced by the RBI in April 2018 that made it mandatory for all foreign payments operators to store card and customer-related data on servers exclusively in India so that the regulator can have ‘unfettered supervisory access’ to transaction details. They could transfer this data for smoothing the flow, but it had to be deleted within 24 hours.

Mastercard, the world’s second-largest payments processor, has already started storing data in India but is possibly failing to comply with the part of erosion of transaction data within 24 hours. It is also possibly not able to provide the complete audit trail to the RBI’s satisfaction.

“RBI regulations mandate that the card network’s system audit is done by a domestic auditor certified by Indian Computer Emergency Response Team (CERT-in), the country’s nodal cyber security agency. It is here that a lacuna has crept in. The regulator wants a complete audit trail. The compliance to the second level of auditing is where Mastercard needs to fully convince the regulator,” said a source familiar with the development.

Yes Bank managing director and CEO Prashant Kumar had no inkling of what was happening inside Mastercard. Deeply engaged in the turnaround script of the bailed-out bank, he had planned to have a credit card scale-up in his business strategy for the current financial year. As on 31 March, Yes Bank’s credit card base stood at 947,000 cards, with total spend at Rs 2,288 crore. The two-year ambition was to grow the book four times and move to a much higher monthly run rate of card issuances in line with many of the bigger banks.

Yes Bank’s credit card scheme was entirely aligned with Mastercard. Kumar had other problems to worry about: How to grow the bank in Covid times and trim the legacy loans he had inherited due to shady lending practices which had put the bank’s foundation under threat before the RBI brought in the State Bank of India (SBI) as the main rescuer. The bank’s gross non-performing asset (NPA) as a percentage of total advances was still high and stood at 15.6% at the end of the June quarter. Mastercard was not on Kumar’s worry list at all.

Federal Bank managing director and CEO Shyam Srinivasan had launched credit cards only in June and was looking to tap initially the bank’s existing customers. He had a build-up plan in the current financial year, and like Kumar, he had tied up only with Mastercard.

During this period, a disruption was taking place in the credit card market. Rivals like ICICI Bank, SBI and Axis Bank were trying to gain business as HDFC Bank, the largest player, had been banned by the RBI from adding new credit card customers in early December of 2020 due to a series of technology outages over the previous couple of years. HDFC Bank lost almost 5.3 lakh customers as per RBI data, its credit card outstanding falling to 14.85 million as of 31 May 2021 from 15.38 million until 30 November 2020. While ICICI Bank gained 1.16 million customers during this period, SBI Card added 6.6 lakh cards, Axis Bank 2.4 lakh and RBL Bank 1.8 lakh.

Even as the credit card players other than HDFC Bank were drawing up their expansion plans, one development escaped notice. The governments in many countries were beginning to impose data to be stored exclusively on local servers in varying degrees, with China specifying a broader spectrum, Russia to personal data of its citizens and the United States restricting it to all defence-related data. The Indian government was also beginning to emphasize that data be stored in a system only in India.

On 14 July, the axe finally fell on Mastercard. The RBI said that, after a lapse of considerable time and providing adequate opportunities, it decided to indefinitely bar Mastercard from issuing new debit, credit or prepaid cards to domestic customers for violating local data storage rules. The ban would come into effect from 22 June but not impact its existing customers in India.

Six days after the RBI’s communication, Mastercard, taking the help of the government empanelled Deloitte, performed a supplemental audit and submitted the report to the regulator showing its compliance with the local data storage norms. The details of this submission could not be obtained, but Mastercard is hopeful that it would address the regulator’s concerns and permission would soon be granted to restart its operations.

In response to Indianbankingnews.com’s questionnaire, Mastercard said that they would provide whatever details are needed to address the regulator’s concerns so that the matter is brought to a close expeditiously.

“Since the issuance of the 2018 directive requiring on-soil storage of domestic payment transaction data, we have worked closely with the RBI to ensure that we comply with the requirements. While we are disappointed with the stance taken by the RBI (on 14 July), we will continue to work with them and provide any additional details needed to resolve their concerns. This is consistent with our considerable and continued investments in our customers and partners in India to advance the government’s ‘Digital India’ vision,” Mastercard said.

While Mastercard waits for the RBI’s green signal, bank executives have been busy negotiating deals with Visa and, to a smaller extent, RuPay so that they can onboard new credit card users. RBL Bank, the fifth-largest credit card issuer in the country, with three million customers and a 5% market share, was the first to announce its tie-up with Visa a day after the RBI announced its decision to ban Mastercard. With a current run rate of one lakh new issuances per month, RBL could not afford to procrastinate.

“We expect to start issuance of credit cards on the Visa payment network post the technology integration, which is expected to take 8–10 weeks. In the interim, our bank’s current run rate of approximately 100,000 new credit card issuances per month could potentially be impacted till such time that there is clarity from the regulator on issuing new credit cards on the Mastercard network or till the technical integration with Visa is complete,” RBL Bank said.

Yes Bank expects to start issuing new credit cards after a 3–4-month gap. “We have already signed an agreement with Visa and RuPay. We expect to start credit card issuance in the next 90–120 days. There will be a bit of a slowdown in card issuance, but the existing players will fill in the gaps. We also hope that Mastercard comes back into the market,” Kumar said.

Federal Bank is looking to resume getting on board new credit card customers by the end of September as it has to integrate with the alternative switch partner. “We were a single Mastercard issuer. There are two other franchisees in the country—Visa and RuPay. We hope to be back to selling cards in the next two months,” said Srinivasan.

RBL Bank, Yes Bank and Bajaj Finserv will be the most impacted as their entire card schemes are allied with Mastercard, Nomura said in a report. HDFC Bank has 60% of its card schemes tied to Mastercard, Amex and Diners Club, while for Axis Bank and ICICI Bank, this is about 35–36%.

Among the bigger players, Axis Bank will be more jolted than ICICI Bank. “We estimate an overall impact of 17–18% in terms of card issuance since the RBI imposed the ban on 22 July. If this continues in August, the impact could rise to 21–22%,” said Axis Bank president and head (retail lending and payments) Sumit Bali.

For Axis Bank, the impact will be felt in the Flipkart co-branded credit card as it is allied with Mastercard. The co-branded card was launched in July 2019 and the bank currently has 1.2 million such cards in force. As on 30 June, the bank’s total credit card population was 7.2 million, up from 6.8 million a year ago.

Axis Bank expects the impact of Mastercard ban on its credit card portfolio to rationalise by mid-September. “Even if Mastercard is not operational by then, we should be in a position to come back to normalcy by 15 September,” said Bali.

ICICI Bank, on the other hand, has its fastest-growing credit card segment on Visa. “The ban on Mastercard will not have any material impact on us. Our fastest-growing product in the credit card portfolio, Amazon Pay ICICI Bank, is tied up with Visa,” said ICICI Bank executive director Sandeep Batra while talking to reporters.

There are over two million Amazon Pay ICICI Bank cards since the launch of the card in October 2018, making it the fastest co-branded credit card to cross this milestone in the country. ICICI Bank had a total credit card population of 10.87 million till the end of May.

SBI Card, the country’s second-largest player with 11.95 million credit cards as on 31 May, said the ban on Mastercard would not impact the speed of its issuances. “Only 4% of our new credit card issuances were on Mastercard, so the impact will be minimal for us,” said SBI Card managing director and CEO Rama Mohan Rao Amara.

In the existing situation, RuPay can make gains. Launched on 26 March 2012, it aroused symbols of nationalistic sentiment when it became the platform for Prime Minister Narendra Modi’s ‘One Nation One Card’ in 2019. Five years before, the beneficiaries of Modi’s flagship inclusion campaign Jan Dhan Yojana were offered a basic bank account along with a free RuPay debit card. And in 2018, Modi appealed to Indians to use the domestic RuPay debit and credit cards to ensure that transaction and processing fee is not earned by foreign card companies.

“This leaves only Visa Inc. and homegrown NPCI’s RuPay as payment providers under no restrictions currently. We don’t know if Visa has fulfilled all requirements of data localisation as envisaged in the Storage of Payment System Data circular of the RBI. In the near term, we don’t foresee any material impact on card issuers (especially credit card issuers), but there could be a medium-term impact if this situation persists,” Nomura said in a report.

If Mastercard is put out of the market for long, bankers fear it will not be good for the industry as it will become a duopoly market with Visa grabbing the lion’s share.

“Mastercard used to come as a drop-down option when customers apply for a credit or a debit card. But now we will have to offer only Visa and RuPay cards. Monopoly is not a good thing for banks or the customers as prices will go up,” said the former CEO of a leading credit card company who did not wish his name to be revealed.

Will Mastercard be able to comply with the on-soil data storage norms, or will it be out of the India’s credit card growth market? Will American Express return and how soon?

While the credit card market gets embroiled in this complex web of battles over data storage locations, foreign versus homegrown entities and regulatory requirements, there is one global ad campaign that may lose its reality but not its creative charm: “There are some things money can’t buy. For everything else there’s Mastercard.”