Network Tokenisation

Network tokenisation is the process of replacing a card's Primary Account Number (PAN) with a unique alternative value — an "EMV Payment Token" — that is restricted in where and how it can be used. Governed by the EMV Payment Tokenisation Specification (currently v2.3.1) and issued directly by card schemes (Visa via VTS; Mastercard via MDES), network tokens lift authorisation rates, reduce fraud, and auto-update when cards are reissued. They are distinct from PSP-issued vault tokens: the scheme, not the merchant's processor, issues and manages the credential. (EMVCo)

---

How it works

The token looks like a 16-digit card number but is managed in the card network's own token vault. Per EMVCo's specification, the token is domain-restricted — bound to a specific merchant or use context — and requires a dynamic, per-transaction cryptogram that expires immediately after use and cannot be replayed. At authorisation time, the network maps the token back to the underlying PAN before passing the transaction to the issuer. (Solidgate Docs; EMVCo)

A merchant (or wallet) requests a token from Visa VTS or Mastercard MDES. For most merchants, this happens transparently through their PSP (Stripe, Adyen, Checkout.com all handle token provisioning and lifecycle management without requiring additional merchant integration). Large merchants above approximately $50 million in annual card volume can apply to become direct "token requestors" via the Visa VTS API. (Stripe; r/fintech practitioner observation, 2024–2025)

Key distinction from PSP/vault tokenisation

Network tokens are processor-agnostic — the same token works across payment processors because the scheme issues it. PSP-issued vault tokens (e.g., Stripe's own pm_ token, Braintree's token) are processor-specific and cannot move to another acquirer without the underlying PAN. (NMI, May 2025)

---

Why authorisation rates improve

Three mechanisms drive higher acceptance versus raw PAN submissions: (1) The card scheme pre-validates each token before the authorisation request reaches the issuer, providing a stronger legitimacy signal. (2) The per-transaction cryptogram proves the token is being used in a real, legitimate transaction — replays are impossible. (3) Lifecycle management keeps tokens current when underlying cards are reissued or expire, eliminating declines from stale credentials. (Solidgate Blog; Adyen Docs)

Adyen states that "card networks maintain network tokens to ensure validity when card details change — such as when a shopper receives a replacement card due to expiry or loss — reducing decline friction without requiring the shopper to re-enter credentials." (Adyen Docs)

---

Authorisation rate uplift benchmarks

Source	Reported uplift	Basis	Date
Visa	+4.6 pp on CNP transactions	Visa global portfolio	undated (as-of 2026-07-08)
Mastercard	+2.1 pp	Mastercard global portfolio	undated (as-of 2026-07-08)
Adyen	+3% average	Adyen merchant portfolio	undated (as-of 2026-07-08)
Adyen (by region)	US +4.74%, UK +2.80%, Brazil +3.23%, Australia +7.03%, Bahrain +3.70%	Adyen platform data	undated (as-of 2026-07-08)
Checkout.com	+10.3 pp globally; +12.4 pp in MENA	Checkout.com portfolio ceiling figure	Mar 2025
Leaders in Payments / NMI / Mastercard panel	3–6 pp consistent range	Industry consensus across panellists	Nov 2025
Stripe (bundled)	+2% (Twilio SendGrid); +1.9% (Notion)	Includes card account updater	undated (as-of 2026-07-08)

Adyen additionally offers a Network Token Optimisation (NTO) feature using machine learning to select between a network token or the underlying PAN per transaction, yielding an additional ~1% authorisation uplift beyond the baseline gain. (Adyen Docs)

Stripe optimises per transaction by intelligently selecting whether to use a network token or the underlying PAN, with PAN fallback if the tokenised attempt fails. (Stripe)

---

Fraud reduction

Visa reports that CNP transactions using Visa network tokens see fraud levels decline by approximately 26% on average compared to equivalent PAN transactions. (Visa Knowledge Hub)

NMI cites fraud rates reduced by approximately 28–31%, attributed to the card network pre-validating each token before the authorisation reaches the issuer. (NMI, May 2025)

Checkout.com measured a 49% reduction in fraud-related chargebacks across its merchant portfolio following network tokenisation adoption, attributing the decline to the dynamic cryptogram attached to each transaction. (Checkout.com/Mastercard video, Mar 2025)

---

Scale and adoption

Juniper Research (published 2026-07-07) forecasts that network tokenisation will secure 2.4 trillion global transactions between 2026 and 2030 — representing 86% of applicable transactions — at an 18.1% CAGR, driven by Visa and Mastercard's push for full tokenisation in Europe. (GlobeNewswire, 2026-07-07)

At Mastercard's MPE Berlin 2026 presentation (March 2026), EVP Brice van de Walle stated that Mastercard had reached 57% of its goal of 100% tokenized online transactions globally, with nearly half of all Mastercard e-commerce transactions in Europe already tokenized. Mastercard's stated target is 100% tokenized ecommerce by 2030. (The Paypers / MPE 2026, Mar 2026)

As of November 2025, more than 30% of all Mastercard transactions globally ran on MDES/tokenized rails, with the figure reaching approximately 50% in North America. (Leaders in Payments, Episode 447, Nov 2025)

Adyen managed over 7.6 billion active tokens globally across its platform as of October 2025. (Adyen — as-of 2025-10)

As of 2024, 77% of merchants not already using network tokens planned to roll them out, and 90% of PSPs intended to increase their use. (PYMNTS, Nov 2024 — as-of 2024-11)

---

PCI DSS scope reduction

Merchants that store network tokens rather than raw PANs reduce their PCI DSS compliance scope, because a token with no deterministic link back to the PAN is not itself classified as cardholder data under PCI standards. (IntelliPay)

---

Fee mechanics (as-of 2026-07-08)

Network tokenisation carries scheme fees that were restructured by both Visa and Mastercard in 2025–2026:

Visa DCSF (Digital Commerce Services Fee): Restructured in January 2025, the rate doubled to 0.015% (minimum $0.01) from April 2026, now applied to all authorised CNP transactions including declines (previously applied only to cleared-and-settled transactions). The fee bundles TAVV, Visa Account Updater (VAU), VDCU, and VCES. CMSPI estimates the April 2026 Visa DCSF changes cost US merchants approximately $122.1 million. (CardTraq, 2026; CMSPI, 2026)

Mastercard DEF (Digital Enablement Fee): Restructured in July 2025 (removed the $0.40 cap on transactions ≥$1,000; included previously excluded declines due to insufficient funds), with further changes in February 2026. (CardTraq, 2026)

Network tokens can also reduce network costs for merchants on network-cost-plus pricing, with NMI citing interchange reductions of up to 10 basis points on qualifying transactions. (NMI, May 2025; Stripe)

---

Agentic commerce and the credential layer

In 2026, EMVCo announced it is working on how EMV Payment Tokenisation, EMV 3D Secure 2 (3DS2)|3DS, and Secure Remote Commerce can be adapted to support card-based agentic payments. The work focuses on consumer intent, agent trust models, and privacy-preserving interaction patterns. (EMVCo, 2026)

At MPE Berlin 2026, Mastercard's van de Walle stated that 99% of issuers are already enabled to support agentic tokens, the first tokenized agentic transactions have occurred, and pilots are running across multiple regions. Mastercard's "Know Your Agent" framework mirrors how token requestors were certified historically; "Verifiable Intent" captures consumer identity, agent instructions and limits, consumer consent, and actions taken. (The Paypers / MPE 2026, Mar 2026)

Both Visa's "Trusted Agent" and Mastercard's "Agent Pay" rely on network tokens as the underlying credential layer. (NMI Blog, 2026)

See: Agentic Commerce, Agentic Commerce Protocol (ACP)

---

Standards evolution (2026)

EMVCo's 2026 specification priorities include: development of a Digital Payment Credentials (DPC) schema to promote interoperability and standardised provisioning processes; enhancement of the Payment Account Reference (PAR) data element; and integration with the EUDI Wallet via EMV 3D Secure 2 (3DS2)|3DS. (EMVCo, 2026)

---

What practitioners report

Reddit signal is weak for this topic — r/fintech and r/payments practitioners discuss auth rate improvements and PSP capabilities without naming VTS/MDES explicitly. Recurring observations from 2024–2025 threads:

• PSPs (Stripe, Adyen) handle network tokenisation "under the hood" — most merchants are unaware it is happening. One practitioner: "Stripe just updates the card automatically, I don't know how but our churn from expired cards dropped significantly." (r/ecommerce, 2024–2025)
• Merchants above ~$50M annual card volume are advised to consider becoming direct Visa VTS token requestors rather than relying on PSP intermediation. (r/fintech, 2024–2025)
• Perceived auth-rate advantage of large PSPs (Stripe, Adyen) over smaller processors is largely attributed to network token certification by one payments engineer: "Most merchants don't even know it's happening under the hood." (r/fintech, 2025)

---

Key terms

Term	Meaning
PAN	Primary Account Number — the 16-digit card number
Network token	Scheme-issued replacement for the PAN; domain-restricted; carries a per-transaction cryptogram
VTS	Visa Token Service — Visa's tokenisation platform
MDES	Mastercard Digital Enablement Service — Mastercard's tokenisation platform
Token requestor	An entity (PSP, wallet, merchant) certified to request tokens from the scheme
TAVV	Token Authentication Verification Value — the per-transaction cryptogram
PAR	Payment Account Reference — a non-sensitive identifier linking all tokens back to a PAN
DCSF	Visa Digital Commerce Services Fee — the scheme fee for tokenisation services
DEF	Mastercard Digital Enablement Fee — the Mastercard equivalent
NTO	Network Token Optimisation — Adyen's ML feature to select token vs PAN per transaction

---

Dangling frontiers

• Card Account Updater — overlapping credential lifecycle mechanism; non-scheme-issued
• PCI DSS — scope reduction implications
• Token Lifecycle Management — how tokens are provisioned, suspended, deleted across schemes
• Secure Remote Commerce (SRC) — EMVCo's checkout standard layered on top of tokenisation
• Vault Portability — the problem of moving tokens between PSPs; resolved differently from network tokens