Why is Uber sweating in India? The low-down on tricky payment rules

Global taxi service Uber faces roadblocks in many countries, as local competitors try to get their governments to slow it down. In India, this has taken a devious route. Indian taxi operators petitioned the central bank about Uber’s handling of payments, claiming that it violates Indian law. And now, the Reserve Bank of India (RBI) has come out with a directive that shows Uber an amber light. What’s more, this could cramp the style of other online businesses too.

Here’s the nitty gritty on this complex web of doing business online in India.

Last weekend, the RBI published a circular on card-not-present (CNP) online transactions. These are payments where the card holder does not present the card for examination to the merchant at the time when an order is placed and payment effected.

Normally, People all over the world link their credit cards to a merchant website once and transact at will. But according to Indian law – specifically, the Payment and Settlement Systems Act, 2007 and the Foreign Exchange Management Act, 1999 – all card transactions require two-step verification to avoid fraud. That is, each user has to type in her unique CVV (card verification value) number and 3D secure password, which is generated by the user herself and verified by VISA. Or use an additional one-time password, generated and sent through SMS or email.

The RBI circular said it had spotted instances of CNP transactions being done without the mandatory two-step process between two residents in India – card issued in India being used for purchase of goods and services offered by a merchant or service provider in India.

In cases “where cards issued by banks in India are used for making card-not-present payments towards purchase of goods and services provided within the country, the acquisition of such transactions has to be through a bank in India and the transaction should be settled only in Indian currency,” it said, adding:

Such camouflaging and flouting of extant instructions on card security, which has been made possible by merchant transactions being acquired by banks located overseas resulting in an outflow of foreign exchange in the settlement of these transactions, is not acceptable.

This is not exactly new. The RBI had issued four such circulars since 2009, but now, it has set a deadline for businesses to comply with the rule: October 31, 2014. The first to be hit by this is taxi service Uber, just a year old in India but very popular already. The latest RBI circular, in fact, seems to have been triggered by a complaint specifically against Uber. Irked by its growing popularity, other cab companies cried wolf. They wrote a letter to the RBI complaining that the Uber app’s credit card transactions violate Indian regulations. Tech in Asia had reported it then.

See: Uber’s competitors throw a spanner in its works, cry it’s violating Indian law

The Uber modus operandi

Uber collects fares from a passenger’s credit or debit card, transmits it to the Netherlands-based Uber BV in foreign currency, and then sends 80 percent of it back to the driver after deducting its commission. As it operates through a foreign payment gateway, it has been side-stepping the mandatory two-stage authentication for CNP transactions in India.

Uber’s not alone