Why India’s Mastercard ban is an opportunity for others

India's central bank has banned Mastercard from issuing credit and debit cards in the country, due to its lack of compliance with the regulator's data privacy rules. Reuters

A ban on Mastercard issuing new credit and debit cards in India for not complying with the country's data storage rules is causing upheaval and revenue loss for banks that have partnerships with the US payments company, analysts say. At the same time, rival firms like Visa, homegrown RuPay and financial technology payment startups could stand to benefit from the move.

“Change is always painful,” says Poshak Agrawal, the co-founder and chief executive of Florence Capital, a digital loans company based in New Delhi.

“Almost all banks are impacted due to this ban, some more than others … this is a major opportunity for some FinTech startups”, as it could give a boost to digital payment platforms that do not require cards and were already becoming increasingly popular in India.”

There is a lot at stake. Mastercard last year accounted for 33 per cent of card transactions in India, according to data from PPRO, a London-based payments firm. India was seen as an important growth market for Mastercard, which in 2019 committed to invest $1 billion in the country over the next five years.

The ban also comes as India's use of debit and credit cards has been on the rise in recent years, as the government tries to push the country towards formal banking and digital transactions, away from non-transparent cash payments.

Announced earlier this month and imposed by the Reserve Bank of India (RBI), the ban bars Mastercard from issuing credit or debit cards to new customers and came into effect on July 22.

“Notwithstanding lapse of considerable time and adequate opportunities being given, the entity has been found to be non-compliant with the directions on storage of payment system data”, the RBI said. The central bank, however, stressed that existing customers would not be affected.

In 2018, the RBI issued new rules which stated that Indian payments data would have to be stored exclusively within India. The regulator says that Mastercard had to comply so it could have “unfettered supervisory access” to the data.

Mr Agrawal says it “was definitely a surprise” that Mastercard was “not compliant with the policies laid out by RBI”, given that there has been an increase in monitoring and action taken by the RBI in recent months.

Earlier this year, the central bank barred American Express and Diners Club International from issuing new cards on similar grounds.

India is not the only country acting against entities that do not comply with data privacy rules. Earlier this month, China’s regulators clamped down on Chinese ride-sharing company Didi, alleging it had mishandled sensitive data about its users in the country. That led to the company’s stock dropping about 20 per cent a week after it went public in the US.

“One would expect firms to prepare their processes for RBI scanning after learning from different players in the banking industry, but that has not been the case,” says Mr Agrawal.

.

Banks have been left to deal with the fallout of the decision, which will add to their costs.

“The banks [that have] an exclusive arrangement with Mastercard will explore the possibilities of joining with other players in the market for fresh business,” says Jyoti Prakash Gadia, the chairman of the banking, financial services and insurance committee at the PHD Chamber of Commerce, which is a New Delhi-based industry group.

“This is, however, a time-consuming process of finalisation of terms and setting up new systems and, therefore, will entail the loss of business in the near future.”

Banks are already reacting to the move. RBL Bank, the fifth largest credit card issuer in India, was in partnership with Mastercard for its credit cards. Following the ban announcement, it said it was switching to Visa for its cards.

Other credit card issuers that are expected to be heavily affected by the decision include Yes Bank and Bajaj Finserv, which also had 100 per cent of their tie-ups with Mastercard.

The debit and credit card market in India has been growing in recent years, as the country – which has long been dependent on cash – increasingly moves towards formal banking.

In the past five years, the number of credit cards issued in India more than doubled to 55 million, while debit cards numbers rose to more than 800 million from 553.5 million, according to Renub Research, an Indian market research and consulting company.

Credit card transactions have been negatively affected by the Covid-19 pandemic, but prior to the health crisis, were showing strong growth.

SBI Card, which has the country’s largest public bank, State Bank of India, as its parent company, says that it is “complying with the latest RBI directive that restricts Mastercard from onboarding new customers”, according to a statement sent to The National.

The lender says it will be able to absorb the impact of the move. Data from Japanese investment bank Nomura shows that only 10 per cent of SBI Card's credit cards are issued with Mastercard.

“We have a diversified product portfolio on multiple networks,” SBI Card says. “Our new customer acquisition impact is minimal as there are only a few co-brand credit cards on the Mastercard network. All our proprietary products are available on multiple networks.”

With Mastercard unable to take on new debit and credit card customers, there is a void to fill in the market.

“Players like RuPay and Visa will take advantage of the current market position and grow their business, due to partially reduced competition in the short run,” says Mr Gadia, who is also the managing director of merchant bank Resurgent India.

RuPay is India's homegrown multinational payment service system, which was set up by the National Payments Corporation of India. Indian Prime Minister Narendra Modi has promoted its use as an alternative to foreign providers – a move that prompted Mastercard to tell the US government that Mr Modi was using nationalism to favour the RuPay network, according to Reuters.

Data from the RBI shows that RuPay has seen exponential growth in recent years, with its market share increasing to 60 per cent of cards issued as of November 2020, compared to 17 per cent in 2017.

Analysts, however, have pointed out that many of these cards were issued with accounts opened under a government financial inclusion scheme, and that the value and volume of transactions would not necessarily correlate with the high numbers of cards.

Nevertheless, the indigenous payment network is likely to get a further boost from the Mastercard ban, while FinTech firms could also benefit.

Transactions through mobile payment systems, including Google Pay and Paytm, have become more widespread during the pandemic. These operate through India's Unified Payments Interface (UPI), linking customers' mobile numbers to their bank accounts and allowing payments to be made easily both in shops and online.

FinTech companies particularly stand to gain as they play a larger role in the country's financial landscape.

Next month Ezeepay, a digital payments company in India, will launch Doorstep Digital Services, which is “focused on bringing banking to the doorstep of Indian villages”, says Shams Tabrej, the company’s founder and chief executive. Ezeepay’s services include a facility for customers to make cash withdrawals using their Aadhaar cards, an identity system for Indian citizens.

Long term, the impact of the RBI's decision will largely depend on whether Mastercard and the authorities manage to resolve the matter in what is a key market for the company.

The RBI's data storage rules were something that firms including Mastercard lobbied against, because of the additional costs involved and challenges it would create with its own anti-fraud systems.

Mastercard has said it is “disappointed” with the ban, but that it would “continue to work with [the RBI] to provide any additional details required to resolve their concerns”.

Mr Gadia says that “the compliance relating to data localisation is crucial from both a security and privacy angle”.

“Any negotiation in relation to relaxation of norms ... will require time and at least some creation of infrastructure in India, to look at a possible solution”.

Mr Agrawal believes that Mastercard will eventually comply – because India is too big a market for the company to ignore.

“Mastercard holds almost one-third of the Indian market with a lot of scope for growth,” he says. “But this can only continue if Mastercard revisits its guidelines and ultimately adheres to the RBI’s localisation mandate.”