The Reserve Bank of Australia (RBA) has scrapped a proposed plan to prohibit card companies from setting a default routing network on dual-network debit cards (DNDCs) following a public consultation.

The RBA in June called for public feedback on the feasibility, as well as associated costs and benefits, of preventing any one debit network from being given routing priority at issuance for domestic debit card transactions.

In effect, this would require, by default, merchants to select the routing network of their choice, providing payees with at least a basic form of least cost routing (LCR).

The proposal, if implemented, would have prevented card companies, namely Visa, Mastercard and American Express, from setting themselves as the default – often more expensive – debit network, rather than diverting to the – typically cheaper – eftpos network.

Following industry feedback on the proposal, the RBA concluded that any benefits from such a prohibition “would likely be outweighed by the costs and risks involved”.

“In particular,” the RBA wrote in its Conclusion paper summarising feedback received from its recent public consultation, “prohibiting the setting of a priority network would raise the risk of failed transactions and would be costly as all DNDCs would need to be re-issued”.

Feedback suggested that where merchant choice has not been programmed into the terminal – whether due to legacy terminals or other issues – the contactless transaction would fail or the cardholder would be required to enter their choice of network into the terminal, adding friction to the checkout process.

The costs of such a prohibition were also seen to be unreasonably excessive for card providers, requiring all DNDCs to be reissued with new EMV chips without a priority network selected. Without a forced reissuing, it would take at least three years to wait out the card replacement cycle.

According to the RBA, the majority of stakeholders expressed a strong preference for the payments regulator to continue pursuing LCR initiatives to achieve its policy objectives rather than mandating the removal of priority settings.

The RBA board said it remains strongly supportive of merchants having the ability to choose their preferred debit card network through least-cost routing (LCR).

However, the board urged providers “to make faster progress on enabling LCR for merchants that could benefit from it”.

“If providers do not make substantial progress in enabling LCR for more merchants by June 2024, the Bank will explore imposing a formal regulatory requirement on providers to enable LCR for their merchants.

“Going forward, the board also expects the industry to implement new form factors in a way that is compatible with LCR from the outset.”

Plans for tokenisation of card payments

As part of its consultation, the RBA also sought views on the tokenisation of card payments that would help prevent sensitive payment details from being stored and transferred by merchants.

Tokenisation would effectively replace sensitive information – the cardholder’s primary account number (PAN) – with a unique token that contains less critical information than the PAN.

This PAN can be then restricted for use on a particular device and/or at a specific merchant.

The Issues Paper, released as part of the public consultation, noted that despite tokenisation becoming more widespread, many merchants and their providers continue to retain sensitive card details, most often to facilitate repeated or recurring transactions.

This, the RBA said, ultimately “undermines the security benefits of tokenisation”.

According to AusPayNet data cited by the Reserve, in 2022 fraudsters made more than $275 million in card-not-present transactions at Australian merchants using stolen Australian debit and credit card details. In addition to these losses (which are often borne by the merchant), cardholders, merchants and financial institutions incur significant costs in investigating and resolving fraud cases.

The RBA said it would “endeavour to publish high-level expectations on the tokenisation of payment cards by the end of 2023”.

“These expectations will be aimed at helping to improve security, efficiency and competition for online card payments”.

The Reserve said it has requested peak payments body AusPayNet to coordinate the industry’s work to meet the RBA’s expectations and to draft more specific tokenisation standards if required.