The RBI though a circular dated March 17, 2020 on “Guidelines on Regulation of Payment Aggregators and
Payment Gateways”, authorized non-bank payment aggregators and merchants on-boarded by them were
prohibited from storing card data (“CoF”) from June 30, 2021. The RBI also notified regulations on CoF
tokenization on September 7, 2021 whereby device-based tokenization is required to be implemented to ensure
card data is not stored by any entity except the card issuer or card network. By a circular dated December 23,
2021, the RBI further extended the timeline for CoF storage to June 30, 2022, while allowing industry
stakeholders to devise alternative mechanisms to handle use-cases like recurring e-mandates, EMI options, etc.,
which currently require storage of CoF data.

Notification on Small Value Digital Payments through Offline Transactions

Pursuant to notification dated January 3, 2022, the RBI has permitted payment system operators and payment
system participants including banks and non-bank entities to enable small value digital payments (upto a limit of
2200 per transaction and 22000 per instrument), without internet or telecom connectivity (“Offline
Transactions”), subject to compliance with certain conditions such as, inter alia, (i) Offline Transactions will
not require additional factor of authentication and may be made using instruments like cards, wallets, mobile
devices etc. in proximity mode only and instruments shall be enabled for Offline Transactions based on explicit
consent of the user and (ii) Offline Transactions shall be covered under RBI’s limited customer liability
circulars, as amended, and users shall have recourse to the Reserve Bank — Integrated Ombudsman Scheme for
grievance redressal.

Private Security Agencies (Private Security to Cash Transportation Activities) Rules, 2018 (the “Cash
Transportation Rules”)

The Ministry of Home Affairs has notified the Cash Transportation Rules under the Private Security Agencies
(Regulation) Act, 2005, to regulate the secured handling and transportation of cash and valuables by banks and
other financial service providers through cash handling agencies and private security agencies. The Cash
Transportation Rules require that cash transportation activities be carried out using specially designed and
fabricated cash vans which comply with the specifications stipulated therein, along with a minimum number of
trained staff to operate each cash van. The Cash Transportation Rules also prescribe, inter alia, (i) the maximum
amount of cash which may be carried by a single cash van and (ii) the specifications required to be adhered to
for cash vaults and the premises within which cash handling activities are carried out.

Information Technology Act, 2000 (the “IT Act”)

The IT Act provides legal recognition to electronic records and creates a mechanism for the authentication of
electronic documentation through digital signatures. The IT Act also provides for civil and criminal liability
including compensation, fines and imprisonment for various computer related offences. These include offences.
relating to unauthorized access to computer systems, damaging such systems or modifying their contents.
without authorization, unauthorized disclosure of confidential information and committing of fraudulent acts
through computers. The IT Act creates liability on a body corporate which is negligent in implementing and
maintaining reasonable security practices and procedures, and thereby causing wrongful loss or wrongful gain to
any person, while possessing, dealing or handling any sensitive personal data or information in a computer
resource owned, controlled or operated by it but affords protection to intermediaries with respect to third party
information liability.

In April 2011, the Department of Information Technology under the Ministry of Communications &
Information Technology notified the Information Technology (Reasonable Security Practices and Procedures
and Sensitive Personal Data or Information) Rules, 2011 under section 43A of the IT Act (the “IT Personal
Data Protection Rules”). The IT Personal Data Protection Rules prescribe directions for the collection,
disclosure, transfer and protection of sensitive personal data.

On February 25, 2021, the Ministry of Electronics and Information Technology notified the Information
Technology (Intermediaries Guidelines and Digital Media Ethics Code) Rules, 2021 (“IT Intermediaries
Rules”), which replaced the Information Technology (Intermediaries Guidelines) Rules, 2011. The IT
Intermediaries Rules requires due diligence by intermediaries including informing users about rules and
regulations, privacy policy, and terms and conditions for usage of its services, due diligence by significant social
media intermediaries including appointment of a chief compliance officer to ensure compliance with the IT Act,
observance of code of ethics by digital media publishers, provision for a grievance redressal mechanism by
intermediaries and authority to examine digital media content to authorised officers and issue directions to block
content in case of an emergency.

180
