Recurring Payments in India

UPDATE 12/12/2022
The RBI has further delayed enforcement of the Card Tokenization regulation from December 31, 2021 to June 30, 2022.

Overview

The Reserve Bank of India (RBI) has issued a directive of processing e-mandates for future recurring payment requests with the scope originally covering cards and wallets but most recently Unified Payments Interface (UPI) transactions as well.

The details of the new requirements mean that an Additional Factor of Authentication (AFA) on the registration and first transaction (up to ₹15,000 before the next challenge), as well as a pre-debit notification 24+ hours prior to taking payment against the account. Within that notification, the user should see the amount they will be charged, the frequency of the recurring charge, and have the ability to opt out of that charge or subscription. 

Effective Date: September 30, 2021

In addition, India has been pushing more aggressive data localization requirements in regards to 'Payments Data' since 2018 and the RBI continues to modify these requirements. 

Effective Date: December 31, 2021

Impact of non-compliance

Companies operating in INR may see higher failure rates if they do not meet the RBI's guidelines for new recurring payments come September 30, 2021.

What to do

We encourage all customers to speak to their gateway representatives first and foremost for guidance. The gateways will be able to help you understand your risks and the potential impacts to your business, as well as provide guidance on how to implement the necessary measures to mitigate any issues with your recurring payments.

In addition, we also recommend that potentially impacted customers:

• [Recurring Mandate] Ensure that users registering a new card and/or making a first payment on a subscription are able to be challenged with a form of AFA like 3DS.
• [Recurring Mandate] Configure notifications to your consumers 24+ hours prior to their next payment that provide them information about the upcoming charge including an easily accessed option to opt out of that charge.
• [Data Storage] If applicable with the gateway's feedback, migrate any new and existing Indian card payment methods to a tokenized form. If your gateway does not support tokenization, you may want to consider one that does. There is no form of grandfathering for existing cards on file for this directive so all existing payment methods must be tokenized with the gateway if they do not provide an alternative. 

Who are we supporting in India?

To process recurring payments in India, you must present transactions in Indian Rupees (INR). The most common way to do this is to run your transactions through a local, Indian entity. If you do not have one and cannot consider one, you may reach out to your gateway provider to see if they allow presenting transactions in INR and settling in another currency. 

NOTE: This is not common and may not be possible with your gateway. If it is possible, it likely comes with heavy fees.

If you cannot present in INR, your only option is to present in a foreign currency and perform a form of one-time payment in which the end user is brought online to make the payment. Zuora will be providing modifications to our existing Hosted Payment Page (HPM) to support the creation of an authorization that needs to be captured separately. We will update our documentation as those changes are released.

If Zuora’s one time payments do not meet your needs, your current Payment Gateway provider is another option. Most gateways should provide a way for payments to be processed through a hosted solution of their own that can then be pushed into Zuora as external payments. 

Zuora is currently only reviewing the gateways in the table above due to current volume and uncertainty with the regulations. 

Ultimately, Zuora recommends our customers implement one-time payments if they have not already done so. Although this is a disruptive customer experience, it ensures the highest likelihood of collecting payments. Per this, Zuora also recommends customers explore annual subscriptions or multi-month subscriptions plans to mitigate the frequency of users needing to come back on-session. 

How do I implement a one-time payments flow?

For Zuora customers who need to implement a one-time payment flow and wish to use Zuora’s hosted page solution, you can review our documentation here to see the steps taken to do so.

The expected user experience should not differ from a standard card-on-file flow as Zuora supports using the same page and simply altering a few values including the ‘storePaymentMethod’ and ‘doPayment’ fields. This gives users the freedom to determine how much they want to authorize for, whether to capture the authorization or not, and if you want to store the payment method on file.

There are multiple ways to utilize this page: on payment failures from a Payment Run with particular response codes, proactively as a link attached to an invoice PDF, or via a workflow on some other trigger that suits your business.

What if my gateway’s not listed?

You can implement either of the following solutions:

• A Pay-by-Links solution offered by our gateway partners.
• Implement a one-time payment flow using the gateway’s hosted page or checkout solution and store the resulting payment in Zuora as an external payment as seen in an example workflow using Adyen’s Pay-By-Links offering below.

What is Zuora’s longer term strategy?

Zuora is continuing to evaluate other partners for recurring mandate processing based on their readiness and benefits to our mutual customers. We do not have a committed delivery or ETA at this time for any new gateway, new payment methods, or plans to enhance existing integrations.

Processing payments after December 31, 2021 (Data Localization & Tokenization)

Overview

As mentioned above, the Reserve Bank of Indi