Payments service provider and credit card issuer SBI Cards and Payments Services Pvt. Ltd. is expecting to raise Rs 9,854 crore in its upcoming IPO, which opens its issue from March 2 to March 5. SBI Cards is the second largest credit card issuer in the country after HDFC Bank; as of FY19, it has 8.3 million credit cards in force, 103,835 crore in credit card spends, and 280 million transactions, according to its Red Herring Prospectus. SBI Cards has 17% market share by credit card spends, and 18% market share by number of credit cards in force. It is registered as a non-banking financial company with the RBI, and started operations in 1998.
After the IPO, SBI’s shareholding in SBI Cards will fall to 70% from 74%, and CA Rover Holdings’ will reduce from 26% to 16%. SBI Cards’ captures 72% market share by number of outstanding credit cards (as of March 2019) and 66% market share by credit card spends in FY19. The company is dependent on SBI’s massive customer base, to which it issues and markets cards.
Half of SBI Cards’ revenue comes from interest on credit card dues, and the other half comes from non-interest income such as interchange fees, late fees, credit card membership fees, and other fees. Interest on revolving and term credit card balances made up 53.2% of the company’s total operational revenue in FY18, and 56.4% in FY17. Non-interest income comprised 48.9% of total operational revenue in FY19, 46.8% in FY18 and 43.6% in FY17.
SBI Cards filed its Draft Red Herring Prospectus (attached below) with the SEBI in November 2019, and filed its Red Herring Prospectus (see below) last week (on February 18), flagging numerous risk factors. While it flagged a laundry list of close to 60 risk factors, some of those relating to its core payments business, and impact of technology are below:
The enactment of the Personal Data Protection Bill, 2018, “may introduce stricter data protection norms for a company such as us and may impact our processes”.
Any failure, or perceived failure, by us to comply with any applicable regulatory requirements, including but not limited to privacy, data protection, information security, or consumer protection-related privacy laws and regulations, could result in proceedings or actions against us by governmental entities or individuals, subject us to fines, penalties, and/or judgments, or otherwise adversely affect our business, as our reputation could be negatively impacted. In addition, and attributable to some degree to the increased regulatory focus on personal information protection, certain of our agreements with licensee partners contain data privacy protection requirements, the breach of which may negatively affect the arrangements we have with such licensee partners.” — SBI Cards’ RHP
While outlining key regulations and policies in India, the RHP flagged the latest version of the bill — Personal Data Protection Bill, 2019. It simply summarised the key provisions of the bill, without specifying any potential impact of the proposed law on SBI Cards’ operations.
Further, the Personal Data Protection Bill, 2019 (“Data Protection Bill”) seeks to create a framework for implementing organisational and technical measures in processing personal data. The Data Protection Bill also seeks to lay down norms for cross-border transfer of personal data and to ensure the accountability of entities processing personal data. The Data Protection Bill also provides remedies for unauthorised and harmful processing, and proposed to establish a Data Protection Authority for overseeing data processing activities. — SBI Cards’ RHP
Regulations limiting interchange fees: Interchange fees in India are set by payments networks such as Visa and Mastercard; the RBI has limited interchange fees payable on debit card transactions, and similar regulations could be extended to credit card transactions in the future.
- Interchange fees made up 22.5% of total operational revenue in FY19, 21.5% in FY18 and 19.3% in FY17.
- The above figure was 21.2% and 21.6% in the nine months ended December 31, 2018 and 2019, respectively.
- Non-interest income comprised 48.3% and 49.0% of our revenue from operations in the nine months ended December 31, 2018 and 2019, respectively, and 48.9% in FY19, 46.8% in FY18 and 43.6% in FY17.
Any regulations limiting the interest rates: India does not impose any limit in interest rates chargeable on credit cards, but if these regulations change, SBI Cards’ credit card receivables could be subjected to interest rate caps. Any such change may require the company to restructure its activities, or incur costs to comply with the changes.
- The interest that it earned on revolving and term credit card balances comprised 51.0% and 51.1% of its total revenue from operations in the nine months ended December 31, 2019 and FY19, respectively, as compared to 53.2% in FY18 and 56.4% in FY17.
- Revenue from revolving credit card balances and monthly installment balances comprised 51.1% of the company’s total operational revenue in FY19, 53.2% in FY18 and 56.4% in FY17.
Cyberattacks or security breaches: SBI Cards faces risks from cyber-attacks or security breaches in transactions that involve transmission of cardholders’ sensitive information via third-parties such as co-brand partners, merchant acquiring banks, payment processors, card networks (such as Visa and MasterCard) and its processors (such as Fiserv).
Some of these parties have in the past been the target of security breaches and cyber-attacks, and because the transactions involve third parties and environments such as the point of sale that we do not control or secure, future security breaches or cyber-attacks affecting any of these third parties could impact us through no fault of our own, and in some cases, we may have exposure and suffer losses for breaches or attacks relating to them. — SBI Cards’ RHP
Third-parties may also attempt to fraudulently induce employees, cardholders, partners or other users to disclose sensitive information in order “to gain access to our data or that of our cardholders or partners” and risks may increase as with rise in use of the internet, and in online product offerings, and use of cyber-security.
Dependent on payment networks such as Visa, Mastercard, and RuPay for processing its credit card payments. The networks may fail or refuse to process transactions, may breach their agreements, or renewal negotiations on commercially reasonable terms may fail — all these scenarios present risk to SBI Cards’ business.
- The company also earns interchange fees and business development incentives, primarily on account of cardholder spends, which represented 25.1% and 25.6% of total operational revenue for the nine months ended December 31, 2019 and FY19, respectively
- Interchange fees and business development incentive comprised 24% and 25% of total operational revenues in the nine months ended December 31, 2018 and 2019, respectively, and 25.6% in FY19, 24.6% in FY18 and 21.9% in FY17.
Competition from other credit card issuers and payments solutions providers: SBI Cards will compete with other credit card issuers and payments service providers across banks, payment banks, NBFCs, and fintech companies. In particular, mobile, e-wallet, tokenisation platforms, and UPI payments “present formidable competition as they are able to attract large payment volumes at low or no payment processing fees to merchants”.
- Some competitors, including banks, may have operational advantages over SBI Cards, which is a NBFC: “Banks in India have access to a broader set of their customers’ transactional information than we do”. Banks aren’t required to carry out additional KYC processes to provide credit cards to their customers.
Operations and growth depend on co-brand partners: SBI Cards has co-brand partnerships with Air India, Apollo Hospitals, BPCL, Etihad Guest, FBB, the IRCTC, Ola Money and Yatra, among others. Credit card spends from our co-branded credit cards represented 19.3% of total credit card spends in FY19, and 24.7% in the nine months ended December 31, 2019, respectively. The company also relies on its co-brand partners to acquire new customers through our open-market sourcing channels.
- As of December 31, 2019, the company had a total of 21 fully operational co-brand partners, as compared to 18, 15 and 16 co-brand partners as of March 31, 2019, 2018 and 2017, respectively.
- Newly sourced co-brand accounts represented 29.6% and 35.2% of total cardholder accounts sourced in FY19 and in the nine months ended December 31, 2019, respectively.
Promoter relation with SBI: SBI Cards derives “substantial benefits” from its relationship with SBI, any loss or reduction in support from SBI “could adversely affect” the company. SBI Cards’ primarily consists of SBI-branded credit cards, as the company has a referral arrangement with SBI which allows it to market and issue credit cards to SBI customers. SBI is also the sponsor for one of SBI Cards’ payment network agreements. SBI Cards’ sales and marketing is clubbed with SBI’s; and it has a non-exclusive license to use the SBI brand and trademark.
- In FY19, FY18, and FY17, new accounts acquired from SBI’s customer base accounted for 55.2%, 45.5% and 35.2%, respectively, of total new accounts.
The company said its growth strategy will be to increase new card acquisitions and partnerships with retail outlets, capitalise on SBI’s infrastructure and “largely untapped” customer base, and stimulate growth in credit card transaction volumes.