BENGALURU | NEW DELHI: The complete rollout of WhatsApp Payment service in India is stuck in a limbo because of a lack of communication between key stakeholders. The National Payments Corporation of India (NPCI), which runs the Unified Payments Interface on which WhatsApp Payments is built, has not replied to specific queries raised by the ministry of electronics and information technology early this month.
The ministry’s concerns relate to whether the new UPI-based service conforms to RBI’s security and privacy rules. NPCI has not disclosed by when it is likely to give its approval for the formal launch of WhatsApp’s payments service. Also, there is a lack of clarity on whether WhatsApp Payment service is fully compliant with RBI’s rules.
WhatsApp in February rolled out a beta version of its payments service with ICICI Bank for a limited number of users. “We need some letter from (RBI and NPCI) saying that (WhatsApp Payments) is fine,” said a MeitY official on condition of anonymity.
“…even if there is no letter, let them be satisfied and say that everything is fine and give the approval. That is where we stand,” said the official. “We have told (WhatsApp) very clearly that the ball is in the court of NPCI and RBI.”
WhatsApp needs to consult with banks, NPCI and RBI to resolve the matter, since the ministry is not the authorising entity for this particular launch, he said. AlthoughNPCI has the final say on UPI-based applications, it has become difficult for the umbrella body for retail digital payments in India to green-light the full rollout of WhatsApp Payments without addressing the ministry’s concerns, said people familiar with the developments.
MeitY has twice sought clarifications from NPCI on WhatsApp’s data storage policy, how the company would share user data with its owner Facebook (that’s embroiled in a privacy controversy), and if the payments feature adhered to RBI’s twofactor authentication rules. NPCI responded to MeitY’s first letter in April but the ministry was not convinced with the response and sent another letter asking more detailed questions, ET reported on June 1.
WhatsApp recently updated its terms and policies, explaining that while it uses Facebook’s infrastructure for payments in India it was committed to not using payment service data for commercial purposes. “We do not have a launch date but this terms and policy update brings us one step closer to a full launch,” a spokesperson for WhatsApp said, without providing more details.
A spokesperson for NPCI said it did not want to comment on the issue. RBI did not respond to queries from ET.
Bankers familiar with the development said NPCI does not have any new points to add regarding the queries raised by the ministry. With regards to RBI’s two-factor authentication requirement for digital payments, they said WhatsApp is abiding by the rules — with the phone as the first factor of authentication and the UPI pin being the second.
As for RBI’s rule requiring all payment service providers to store data on servers within India, one of these bankers said, “RBI has given companies time till October to bring their data within India. The rules apply equally to all the players in the payment service space.” Another banker said NPCI is responsible for implementing rules specific to UPI devised in consultation with the banking regulator. In case of non-adherence, the RBI has the authority to suspend any service and take action.
“As of now, the regulator has not sought any clarification regarding WhatsApp Payments from banks or service providers,” the banker said.
One big area of concern around WhatsApp Payments relates to allowing a Facebook group company into the Indian payments ecosystem, especially in the wake of the Cambridge Analytica scandal, said the bankers. Further, the messaging platform saying that it uses Facebook’s infrastructure for payments could raise more eyebrows, they said.
While WhatsApp has said it will not store payment-sensitive data such as debit card numbers or UPI pin numbers, Facebook could gain visibility on the payment behaviours of consumers. RBI can only make storing payments data within India mandatory, but with regards to non-payments related data that WhatsApp collects, it has no jurisdiction, said the bankers.