RBI’s smart card promises more than just e-banking

Subhendu Parth & Sudarshana Banerjee

NEW DELHI: Come 2003 and you can walk into the nearest PCO wallah, flash your 32-KB chip and complete your banking transaction. Hold on, if you thought this was some new service that banks in India are going to launch. Thank the department of information technology (DIT) and the Reserve Bank of India instead, which plans to roll out these services as part of its financial application based pilot project for smart card implementation in India.

In fact, the RBI has also decided to issue a special directive thereby enabling 22,500 PCOs across the country to act as multifunctional service delivery points (SDPs). As per the earlier RBI guidelines, only banks can function as SDPs. However, the decision to amend this rule was taken keeping in mind the high penetration and accessibility factors of PCOs that is essential for the success of this roll out.

Also, in case you thought this would be some kind of a premier service for the have-alls, you are in for another surprise. The project is primarily aimed at benefiting the poorest of the poor–a bhaji walih for instance, can go to any of these PCOs authorized by the banks as an outlet and complete her transaction. She may chose to pay back her loan on a daily basis, instead of the normal monthly EMI that usually is difficult to pay for most people below the poverty line.

According to IT Secretary Rajeev Ratna Shah, the pilot project is expected to launched across 63 cities in the country by early next year. The e-purse project is part of the multi-function smart card project under active consideration by the ministry, wherein a single smart card can be used for a host of applications like driving licenses, electricity and water bills, or even taxes; and simultaneously can also be used as an e-purse. However, the pilot project will see only the e-purse function being activated, other utilities like driving license, or payment of pensions using the same card to trigger off after the completion of the pilot, circa 2004.

Sources in DIT also revealed that while a broad consensus has already emerged during the October 31, 2002 meeting of the inter-departmental committee on the guidelines that would determine smart cards operation parameters, the Smart Card Initiative committee (SCIC) is currently busy sorting out complicated issues like standards and specifications for smart cards and terminals.

It is also working on cryptography issues, standards for interface and issues related to interoperability. According to a senior official in DIT, the committee needs to address these issues in advance in order to ensure that once the project is rolled out vendors do not start shipping products that are unable to talk to each other.

The inter departmental committee, including RBI, Institute for Development and Research in Banking Technology (IDRBT), IBA, Election Commission of India, Ministry of Finance, Indian Railways, Ministry of Surface Transport, Bureau of Indian Standards and also representatives from the Army, IT industry, smart card forum and IIT also agreed that all banking and financial application related smart cards need to be secured using PKI-based system.

However, members of the committee also agreed to the need for setting up a key management infrastructure for non-PKI multi application smart cards. According to sources, the SCIC has recommended that while PKI enabled Smart Cards should be used during the initial period, the issue of setting up a key management agency for symmetric cards should be reviewed later.

The committee also discussed the ID number schema proposed by a sub-committee under the chairmanship of Dr Vivek K Agnihotri, Additional Secretary, DAR&PG. Based on the sub-committee’s report, SCIC also recommended that while the ID number should be non-significant, the issuing office number should definitely be part of the ID number.

Keeping a provision for 9999 centers, the SCIC also decided to have a 12-digit ID number with 4 digits for issuing office number and 8 digits for person's ID. This, according to a committee member, is also aimed at reducing the ID number size from 16 to 12 digits. Other information like place of birth, state or village code will be kept as fields of record. The committee also suggested that ID cards should be issued after authorization from a separate authorization center, which could be based on the place of birth.

According to V B Taneja, senior director, DIT and director of the smart card project, the pilot project proposes to upgrade 22,500 PCOs to act as multifunctional service delivery points (SDPs) having smart cards based payment system and acting as franchises of various banks. Each PCO booth would be upgraded with a telephone terminal, an Internet appliance, and two pocket sized e-purse-only terminals.

The respective PCO owners will have accounts with a bank where they will deposit the cash thus collected, and will be paid a service charge in lieu. Industry sources reveal that while the price of a 32-KB smart card is around Rs 200, an offline card reader can be cost around Rs 18,000, depending on individual vendors and systems integrators. While the cost of upgradation and equipment will also have to be borne by PCO owners, consumer would need to pay for the one time cost of the card," said Taneja.

The committee has also suggested that the smart card reader should be an offline. This, explains Taneja, will help bypass the capital investment that an online device would entail. It would have two slots–one for the user’s smart card, and the other for the owner’s smart card. The SCIC estimates that an average of 50 such cards would be issued per SDP–a total issuance of 1,125,000 cards during the pilot. SCIC has also recommended that two types of interoperable cards with PKI–full function debit (e-purse, direct debit and ATM) and e-Purse-only cards be deployed for the project.

Talking about back-end requirements for such an implementation, managing director of Smart Chip and a member of the SCIC Sanjeev Shriya said, "It could be anything–from Oracle / DB2 or UNIX, but they would be platform-agnostic. Ministry sources also inform that interoperable interfaces will be used for financial and multiple applications, EMV for debit, CEPS for e-purse and global platform for post-issuance will be demonstrated in the project.

The project also aims to use biometrics based PKI and PSTN lines for dial up access, DSL based broadband internet access, wireless internet access using variants of GSM/CDMA and WLL, leased lines, ISDN and V-SAT links, among others.

However, neither the Government of India nor DIT would be providing any financial support or subsidy for the pilot. The DIT is involved only to the extent of coordinating and handholding as far as the project is concerned. Nitty-gritty of usage, revenue, and RoI would rest exclusively upon the respective state governments.

Capital costs of smart card related technologies, central systems, and system management and operations would be borne by an operating industry consortium that would manage the project. Taneja, however, was optimistic that the project will generate enough revenue to make it a viable business case for the state governments and banks involved. According to him, usage norms and specific services being offer by such card may vary between states and banks providing such services.

According to Shah, the total duration of the trial run or the pilot would be 11 months–consisting of one month for deployment of network and back-end systems, three months for proof-of-concept phase on smart card based payment systems and remaining seven months for the deployment phase. While the committee has recommended that the deployment phase should be completed by the end of FY 2002-03, sources in the ministry point out that a project of such magnitude may suffer several unforeseen snags, and specific details like the roll out time may change drastically.

A cautious Taneja agrees and suggests that the final shape of the project will be announced soon. "The outline of the project and the reports of the various smart card committee meetings have been posted on the ministry of information technology website for suggestions from the smart card industry and the masses. Let us evaluate these suggestions first–and if necessary incorporate these suggestions–only then will we be in a position to formally announce it," he added.