How Digital Secure Remote Payment works
Mastercard's Transaction Processing Rules of 9 June 2026 define a Digital Secure Remote Payment transaction as an electronic commerce transaction that contains cryptographic information. That information is either full EMV chip data or a cryptographic value derived from an M/Chip cryptogram, passed in the Digital Payment Data field.
A wallet, or a merchant that holds a card as a network token, obtains a cryptogram for the payment and sends it with the token in the authorisation request. Where the transaction contains tokenised account information, the Mastercard Digital Enablement Service maps the token to the card and validates the cryptogram.
Mastercard's developer documentation says that cryptograms must be unique for each transaction request, and that a reused one results in a decline as a replayed attempt.
Later payments after a DSRP transaction
The rules allow a related transaction for a partial shipment to follow the first one without cryptographic information. Mastercard's documentation says the same of recurring and merchant-initiated payments, provided the original payment was made with a cryptogram.
Who needs to support DSRP
Gateways and acquirers: Mastercard's documentation makes token payments conditional on the gateway and the acquirer supporting DSRP. The cryptogram has to reach the scheme in the right field, with the matching security level indicator.
Issuers meet it through tokenisation. A card programme that is enrolled for network tokens receives these payments already validated.
DSRP or 3-D Secure?
- 3-D Secure
- Authenticates the cardholder with the issuer. DSRP proves that the token and its keys are genuine, and the two can be used on the same payment.
- Visa token cryptogram
- Visa's token payments carry a comparable value, the Token Authentication Verification Value (TAVV), under the Visa Token Service.
Where Digital Secure Remote Payment shows up in a platform
Modules that do the work
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- Card issuingVirtual and physical cards, wallets and controls, on the issuer processor you choose.
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
- Mastercard Transaction Processing Rules, 9 June 2026: Appendix C, Digital Secure Remote Payment Transactions (Mastercard)
- Mastercard Developers, Mastercard Checkout Solutions: Make Payments with a card on file
General information, not legal advice: what applies to you depends on your services and your market.