The Reserve Bank of India (RBI) imposed business sanctions on American Express and Diners Club, two major global card networks, for violations with the regualtors' data localisation norms. This is the first time the central bank has imposed business sanctions against card network companies and payment operators in India due to non-compliance with the data storage norms. On Thursday, the RBI barred Amex and Diners from on-boarding new Indian customers from May 1, 2021 onward. "These entities have been found non-compliant with the directions on Storage of Payment System Data. This order will not impact existing customers. American Express Banking Corp. and Diners Club International Ltd. are Payment System Operators authorised to operate Card Networks in the country under the Payment and Settlement Systems Act, 2007 (PSS Act)." Back in April 2018, the RBI introduced new data storage or data localisation norms on payment companies. Under these new rules, all domestic customer transaction data had to store data in servers located in India. Only based on certain exceptions and under some conditions, could the data be transferred and used abroad. Foreign and domestic payments companies would have to provide a compliance certificate based on an IT system audit to the RBI, to continue their operations. While the RBI made certain exceptions for large foreign firms to comply with the data localisation rules, three years later some large entities are still languishing behind. In the case of WhatsApp Pay, a payments service on the Unified Payments Interface (UPI) network, the RBI…
