After a hiatus of almost of five years, Apple has re-enabled support for credit and debit card payments for subsequent app purchases and subscription transactions on the App Store.
This means Apple is now fully in compliance with Reserve Bank of India's (RBI) card transaction tokenisation guidelines.
In HT’s experience, at least one UPI account must remain linked to the Apple Account, for now.
A tokenised card transaction is considered safer as the actual card details are not shared with the merchant during transaction processing.
Adding a card to the Apple Account requires users to confirm the addition as well as tokenisation using an OTP.
After a hiatus of almost of five years, Apple has re-enabled support for credit and debit card payments for subsequent app purchases and subscription transactions on the App Store. This means Apple is now fully in compliance with Reserve Bank of India's (RBI) card transaction tokenisation guidelines. The support for Visa and Mastercard cards to add money, is a phased rollout, and all Apple accounts should unlock access in the coming days.
Currently, credit and debit cards on Mastercard and Visa networks can be set as a payment method to add money to the Apple Account, which can then pay for app purchases and recurring subscriptions including iCloud+. A credit or debit card cannot, for now, be used to make direct purchases on the App Store—those must be paid for through the Apple Account wallet.
Also read | Apple prices just went up—but these Prime Day 2026 deals can save you thousands
The support for Visa and Mastercard cards to add money, is a phased rollout, and all Apple accounts should unlock access in the coming days. The UPI functionality to add funds, remains available alongside. In HT’s experience, at least one UPI account must remain linked to the Apple Account, for now.
Sources confirm to HT that support for RuPay cards will be added in the coming weeks.
Also read | MacBook Air M5, MacBook Neo back at launch prices: Don’t miss these deals
Device based Tokenisation guidelines for Card Transactions, implemented in 2021 and later updated in 2023, mandate that actual card details must be replaced with an alternate unique code called the “token”, which is a combination of the card being used to make the payment, token requestor or the payment receiver who forwards the request to the card network to issue a token, and the device being used to complete the transaction.
A tokenised card transaction is considered safer as the actual card details are not shared with the merchant during transaction processing. Apple and other online merchants must not save actual credit card or debit card identifiers, including card numbers or expiry date details, and must instead generate a unique encrypted token for the same.
Also read | Govt orders Apple and Google to remove 7 mobile apps that stall e-rickshaws
After the initial tokenisation push in 2019, the RBI widened the scope in 2023 beyond mobile phones and tablets, and allowed this process to be completed on laptops, desktops, wearables such as smartwatches, and Internet of Things (IoT) devices.
A key element is that all tokenised data, along with transaction details, must be stored locally—that is, on servers physically located within India’s borders.
Apple’s compliance with RBI’s tokenisation and payment data localisation guidelines however, does not mean that Apple Pay is being launched, or is scheduled to be launched in India. Apple Pay is an on-device digital payment system allows users to tap their iPhone on payment terminals to complete purchases at physical stores, and also link to payments on shopping websites.
In India, Samsung Pay on the company’s Galaxy phones as well as Galaxy smartwatches, works on the same premise. As does Google’s own Google Pay, albeit with slightly differential feature support for iPhones and Android devices.
The RBI E-Mandate Framework strictly regulates auto-debits for subscriptions like iCloud+ or Apple Music. The process requires a one-time registration using an additional factor authentication such as an OTP or one-time password sent via message or email, with banks required to alert a user about an upcoming transaction at least 24 hours before it is scheduled to be automatically processed, and that while recurring payments up to ₹15,000 can process automatically without an OTP after the initial setup, amounts higher than that will require a user’s authentication.
Adding a card to the Apple Account requires users to confirm the addition as well as tokenisation using an OTP. The saved card can be deleted later.
