On December 26, 2022, the Reserve Bank of India (“RBI”) issued a circular for migration of reporting of payment frauds to DAKSH – RBI’s Advanced Supervisory Monitoring System (“Circular”).

The RBI had operationalized the Central Payments Fraud Information Registry (“CPFIR”) in March 2020 with reporting of payment frauds by scheduled commercial banks and non-bank Prepaid Payment Instrument (“PPI”) issuers. This reporting was earlier facilitated through Electronic Data Submission Portal (“EDSP”).

The Circular states that in order to streamline reporting, enhance efficiency and automate the payments fraud management process, the fraud reporting module is being migrated from EDSP to DAKSH. The migration will be effective from January 1, 2023, i.e., entities shall commence reporting of payment frauds in DAKSH from January 1, 2023.

In addition to the existing bulk upload facility to report payment frauds, DAKSH provides additional functionalities, such as maker-checker facility, online screen-based reporting, option for requesting additional information, facility to issue alerts/advisories, generation of dashboards and reports, etc.

The Annex to the Circular mentions the reporting guidelines for CPFIR. A few important ones are mentioned below:

1. All RBI authorised Payment System Operators (“PSOs”)/providers and payment system participants operating in India are required to report all payment frauds, including attempted incidents, irrespective of value, either reported by their customers or detected by the entities themselves.
2. The responsibility to submit the reported payment fraud transactions shall be of the issuer bank/ PPI issuer/credit card issuing NBFCs, whose issued payment instrument has been used in the fraud.
3. Entities are required to validate the payment fraud information reported by the customer in their own systems to ensure the authenticity and completeness, before reporting the same to RBI on individual transaction basis.
4. Entities are required to report payment frauds (domestic and international) to CPFIR as per the specified timelines (currently within 7 calendar days from date of reporting/detection).
5. Though some elements / fields of the Reporting Format are indicated as ‘Optional’, entities shall strive to include them as part of initial reporting itself and only in exceptional cases be reported as updates.

The afore-mentioned migration is expected to streamline and automate the payment fraud management process, which in turn would, eventually lead to an enhanced cyber safety for customers.

Please find a copy of the Circular, here.

This update has been contributed by Prashanth Sabeshan (Partner) and Smriti Tripathi (Senior Associate).

Argus Knowledge Centre is now on WhatsApp! Send us a message on +91 8433523504 to receive updates from our Knowledge Centre.