How MDES works
A token requestor, such as a wallet or a merchant's payment provider, asks MDES to tokenise a card. Mastercard's own outline has four steps:
- Tokenisation replaces the card number (PAN)
- The token is specific to the platform, wallet application or device
- Digitisation provisions the token to the target platform or device
- The token is used for transactions in place of the PAN
The roles in MDES
The Mastercard Rules of 2 June 2026 define the service broadly: identification and verification of the cardholder, tokenisation, digitisation, token mapping and on-behalf cryptographic validation are all named. The token comes from a token account range, a BIN or part of a BIN that Mastercard designates to the issuer.
Digitisation is data preparation performed by the issuer, or on its behalf, before a token is provisioned. A company approved to tokenise on behalf of a wallet operator or a merchant is an on-behalf token requestor, also called a token aggregator.
What changes for MDES at the end of 2026
Mastercard's developer documentation states that MDES for Merchants, the merchant-side service known as M4M, will be decommissioned globally effective 31 December 2026. Existing customers are told to integrate with its successor, Secure Card on File, and to migrate their tokens before that date.
MDES, Visa Token Service or a gateway vault?
- Visa Token Service
- Visa's counterpart, for Visa cards. A product that handles both brands uses both services, directly or through a provider.
- Gateway vault token
- A token that a gateway issues for cards it stores, meaningful only to that gateway. An MDES token is a network token, used across the Mastercard system.
Where the Mastercard Digital Enablement Service shows up in a platform
Modules that do the work
- Card issuingVirtual and physical cards, wallets and controls, on the issuer processor you choose.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
Platforms that need it
Guides that go deeper
Where it is written
The laws and standards this page's facts come from.
- Mastercard Developers, Mastercard Digital Enablement Service (MDES)
- Mastercard Developers, MDES Digital Enablement API: decommissioning notice for MDES for Merchants
- Mastercard Rules, 2 June 2026: definitions, Mastercard Digital Enablement Service, Digitization, On-behalf Token Requestor (Mastercard)
General information, not legal advice: what applies to you depends on your services and your market.