RBI to SC: No permission to WhatsApp to go live on full scale UPI operations

The RBI has told the Supreme Court it has not granted permission to WhatsApp to go live for full scale operations on the Unified Payments Interface (UPI) payment system.

The central bank, in its counter-affidavit, said: “Reserve Bank had examined the said reports and the responses of the NPCI (National Payments Corporation of India) and was concerned that WhatsApp was storing some payment data elements outside India beyond the permitted timelines indicated in the circular and the Frequently Asked Questions on ‘Storage of Payment System Data’ issued by RBI on June 26, 2019.”

“It is specifically denied that the RBI has granted permission to WhatsApp to go live for full scale operations on the Unified Payments Interface (UPI) payment system.”

The RBI also denied that its circular on April 6, 2018 on “Storage of Payment System Data” has been toned down by FAQs issued on June 26, 2019. “It is submitted that Payment System Operators (PSOs) had sought clarification on certain implementation issues, from time to time, from Reserve Bank and the FAQs are intended to provide clarity on those issues to facilitate and ensure expeditious compliance by all PSOs,” said the affidavit.

The RBI acknowledged that the NPCI had communicated to it the System Audit Report and the Post Change Review Report sent to it by WhatsApp, which touched upon the details concerning storage of payment system data. The RBI said that accordingly, by letter dated November 1, 2019, the NPCI was advised to ensure that the payment data elements, as referred to therein, are not stored by WhatsApp outside India beyond permitted timelines.

In addition, the NPCI was advised to ensure that WhatsApp does not store any of the payment transaction data elements in hashed/de-identified/encrypted form in its systems outside India. “The NPCI was also advised not to permit WhatsApp to go live for full scale operations on the UPI payment system, till the time they are fully compliant,” said the RBI.

Subsequently, the NPCI had, through its letter dated January 7, said that they had received a letter from WhatsApp agreeing to complete all the pending issues by May 31, and requesting permission to go live.

The NPCI had then requested RBI’s approval to grant final ‘go-live’ to WhatsApp on UPI, subject “to (a) the third-party audit report confirming closure of the committed 2 items, and (b) acceptable VA/config reports from third party auditor”.

WhatsApp had already informed the Supreme Court that it would not roll out its payment service without full compliance with the norms.

The RBI’s response came on an application filed by the Centre for Accountability and Systemic Change, through advocate Virag Gupta, seeking a complete stoppage of the trials being conducted by WhatsApp Pay, alleging that the company has continued beta testing on its payments system on 1 million users in violation of data localisation norms in India.