American Express to resume India business from August 7

American Express is set to partially resume its business in India next month by acquiring merchants, even as it works to fix the issues of compliance related to data localisation of its card users that led to a regulatory ban on new card issuance, said three people familiar with the matter.

The company has asked its partner banks and payment operators in India to recommence onboarding of new merchants on its network from August 7.

“We are pleased to share that American Express will re-commence onboarding new merchants effective 7 Aug 2021,” as per a communication sent by Amex to its payments and banking partners on Wednesday.

ET has seen a copy of the communication.

This, however, does not translate into American Express resuming full-fledged operations since it is not yet in compliance with the Reserve Bank of India mandate that all data related to Indians and domestic businesses be kept in India only. Any data regarding transactions in India, if captured in servers overseas, need to be erased within 24 hours.

In a response to ET’s questions, Amex said: “American Express strictly adheres to RBI instructions and will not engage in any business that it is not permitted to do by RBI.”

An email to the RBI didn’t elicit a response till press time Wednesday.

The New York-based financial services corporation is partly beginning businesses in India more than three months after it suspended it on a direction from the RBI, which had found it violating local data storage rules.

The RBI had prohibited American Express and Illinois-based Diners Club on April 23 from issuing new cards on their networks. On July14, it barred Mastercard — one of the world's leading card operators — citing similar non-compliance.
Amex had stopped its merchant acquisition operations in India from May 1. “Companies like Amex and Mastercard typically send authentication data that hits its switches in India to servers based abroad as part of their global fraud check policies. The auditor would require going through terabytes of data to issue compliance certificates which is a time-consuming process,” an industry insider said.

A card network issues debit, credit, or prepaid cards in tie-ups with licensed banks and payment companies. It also processes payments through merchants — both online and storefront — through a network of affiliate aggregators and acquiring banks. The network regulates who, where and how cards are used in terms of safety and authentication.
The resumption of merchant acquisition is due to the fact that it does not involve capturing of any data by American Express. The data in transactions at the point-of-sale terminals lies with the debiting and crediting bank and not with the one that instals the PoS machine.

American Express in India predominantly works with private lenders such as ICICI Bank, HDFC Bank, Citibank and IndusInd Bank to issue premium travel and leisure cards through various co-branded merchant tie-ups.

As per RBI’s data localisation rules introduced first in April of 2018, payment operators in India must store data in a server physically present in India. Additionally, these entities are required to submit a system audit report (SAR).

American Express is registered as a payment system operator (PSO) authorised to operate a card network under the Payment and Settlement Systems Act. Other leading card networks in India include US-based Visa and National Payments Corp of India’s RuPay. India has 62.3 million credit cards and 902.3 million debit cards in circulation.