A payment token is a substitute value that replaces a payment card's real account number in a transaction. Under the framework published by EMVCo, the standards body of the card networks, a payment token looks like a card number, is linked to the real primary account number (PAN) by a token service provider, and can be used only in the places, devices or merchants it was issued for.
The phrase has a second, unrelated meaning in crypto regulation, where a "payment token" is a digital asset intended to be used as money, such as bitcoin. Swiss and Singapore rules use the term this way, and Singapore's version, the digital payment token, is now a legal category. The two meanings share a word but describe different things: one hides a card number, the other is itself the asset being transferred.
Payment tokens in plain terms
A card payment token works like a coat-check ticket. You hand over your coat and get a numbered ticket. The ticket is worthless to a thief who does not know which cloakroom it belongs to, and the attendant is the only one who can match it to your coat. Shops, phones and AI assistants keep the ticket; the card network keeps the coat.
A crypto payment token is more like a banknote. It does not point to anything held elsewhere; holding it is holding the value. When you send it to someone, the value moves with it. That difference explains why the two kinds are regulated so differently: the first is a security tool inside the card system, while the second is a form of private money that raises questions about fraud, money laundering and consumer protection.
EMV payment tokens
EMVCo first published its Payment Tokenisation Specification Technical Framework in 2014. In that framework a payment token is issued from number ranges set aside for tokens, so the network can tell a token from a real card number as it routes the transaction. The cardholder sees no difference at checkout, and the card's own number is never shared with the merchant. Key elements include:
- Token service provider. Usually the card network, it creates the token, stores the link to the PAN and converts the token back during authorisation.
- Token requestor. A merchant, payment gateway, processor or digital wallet that asks for a token to store or use.
- Domain restriction controls. Rules that limit a token to one merchant, device or channel, so a stolen token fails elsewhere.
- Cryptogram. A one-time code generated for each transaction that proves the token is being used by its legitimate holder.
When the token service provider is the card network, the process is called network tokenization. Tokens issued by a processor for its own vault are a looser use of the word: they are a form of tokenization but are not EMV payment tokens because they cannot travel across the card network. Payment tokens now underpin mobile wallets, saved cards, subscriptions and the agent credentials used in agentic commerce, such as Mastercard's Agentic Tokens.
Payment tokens in crypto regulation
In February 2018 the Swiss Financial Market Supervisory Authority (FINMA) published guidelines on initial coin offerings that sorted tokens into three types: payment tokens, utility tokens and asset tokens. Under that scheme a payment token is a cryptocurrency intended to be accepted as a means of paying for goods or services or of transferring value, and FINMA said it would not treat such tokens as securities. Singapore's Payment Services Act 2019 created the related "digital payment token" category and requires firms that deal in or exchange such tokens to be licensed by the Monetary Authority of Singapore.
The European Union's Markets in Crypto-Assets Regulation (MiCA) uses different labels. It regulates e-money tokens, which reference one official currency, and asset-referenced tokens, which reference a basket or other assets. A stablecoin used for payments may therefore be a payment token in Swiss usage, a digital payment token in Singapore and an e-money token in the EU.
Comparing the two meanings
| Feature | EMV payment token | Crypto payment token |
|---|---|---|
| What it is | A stand-in for a card number | A digital asset used as a means of payment |
| Holds value itself | No; it points to a card account | Yes |
| Issued by | Card network or token service provider | A protocol, a company or a decentralised network |
| Main purpose | Security and card-data protection | Payment and transfer of value |
| Governing rules | EMVCo specifications and card network rules | Financial regulators, such as FINMA, MAS or EU MiCA authorities |
Other uses of the word add to the confusion. A security OTP token generates login codes and moves no money, and a generic token on a blockchain may represent anything from a game item to a share. When reading a contract, a regulation or a product description, the context, card system or crypto, decides which meaning applies.