India's card payments ecosystem — 100 crore+ debit cards, 10 crore+ credit cards — operates under a regulatory framework that evolved from basic security mandates (2011 SMS alerts) to the comprehensive tokenisation mandate that, by September 2022, forced every merchant in the country to stop storing actual card numbers. In between: interchange fee regulation, white label ATM norms, PPI interoperability with UPI, and the card-on-file deletion deadline that was extended three times.
481 card-related notifications, 84 PPI notifications, and 8 tokenisation notifications trace this evolution.
See also: Digital Payments in India
For the narrative behind card tokenisation, PPI interoperability, and the RuPay story — see Cards, Wallets, and the Tokenisation Revolution.
Last updated: April 2026