How payment tokenisation works
A token service provider issues the token and keeps the link between the token and the card number. For network tokens that is often the card scheme's own token service, and EMVCo assigns each token service provider a code so that its tokens can be identified.
A network token travels the whole route of a payment: from the point of purchase to the acquirer, across the network and on to the issuer's authorisation. A payment account reference (PAR) lets the parties link token payments to the account behind them without the card number.
Payment tokenisation and PCI DSS scope
PCI SSC's tokenisation guidelines of 2011 describe the vault kind: the card number is swapped for a token, and the system that holds the vault can turn the token back. That system, and anything with access to it, stays in PCI DSS scope. Systems that store, process or transmit only tokens, and are segmented from it, may fall outside.
The same guidelines add a caution. A token that can itself be used to start a payment may still be in scope.
Who uses payment tokenisation
A gateway or a merchant platform that keeps cards on file uses tokens to hold fewer card numbers. An issuer meets tokenisation when its cards are added to a phone wallet: the phone then pays with a device token, not with the card number.
What changed in 2026
EMVCo published version 2.4 of the specification's Technical Framework on 9 July 2026. In Mastercard's Europe Region, with listed countries excluded, acquirers and their service providers, gateways and processors among them, support tokenisation of stored credentials from 1 October 2026 (Mastercard Rules, Europe Region, 5.16).
Network token, vault token or device token?
- Network token
- Issued under EMVCo's specification through a card network's token service, and used across the card system in place of the card number. The Visa and Mastercard rules both define a token by that specification.
- Gateway vault token
- Issued by a gateway or processor for the cards it stores. The token means something only to that provider, which exchanges it for the card number when a payment is sent.
- Device token
- A network token bound to one phone or watch, used by wallets such as Apple Pay and Google Pay. The device presents the token with a one-time code, not the card number.
Where payment tokenisation shows up in a platform
Modules that do the work
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- Card issuingVirtual and physical cards, wallets and controls, on the issuer processor you choose.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
Platforms that need it
Guides that go deeper
- PCI DSS for a payment gateway: scope, levels and how to shrink itWhat PCI DSS v4.0.1 asks of a payment gateway: who sets your validation level, when you need a Report on Compliance from a QSA, and how tokenisation and hosted fields shrink scope.
- How to build a crypto card app like RedotPayHow a stablecoin card really works: what happens between the tap and the answer, how the crypto is converted and held, what each module does, and the licences on each side.
Where it is written
The laws and standards this page's facts come from.
- EMVCo, EMV Payment Tokenisation, with the Technical Framework v2.4 of 9 July 2026
- PCI SSC, Information Supplement: PCI DSS Tokenization Guidelines, August 2011
- Mastercard Rules, 2 June 2026: Europe Region Rule 5.16 and the definition of a token (Mastercard)
- Visa Core Rules and Visa Product and Service Rules, 18 April 2026: glossary, Token (Visa)
General information, not legal advice: what applies to you depends on your services and your market.