Token Service Provider (TSP)

A token service provider (TSP) is the organisation that generates payment tokens to stand in for card numbers, keeps the secure database, or vault, that maps each token to the real primary account number, and checks and converts tokens back into card numbers when payments are made. The major card networks are the main TSPs: Visa through Visa Token Service, Mastercard through its Digital Enablement Service, and American Express and other networks through their own services. Some issuers and domestic schemes also act as TSPs.

The TSP is the "engine room" of network tokenization. It serves token requestors such as wallets and merchants, works with the card issuer to approve each token, and sits in the authorisation flow so that issuers can continue to see the real card account. Its role and interfaces are defined in the payment tokenisation framework published by EMVCo, first released in 2014.

Think of a cloakroom at a large event. When you hand in your coat, you get a numbered ticket. The ticket is worthless on its own: only the cloakroom knows which coat it belongs to, and it will only release the coat at that cloakroom on presentation of the ticket.

A token service provider is the cloakroom. It hands out tickets, the tokens, in place of your real card number, keeps the only list that matches tickets to cards, and checks every ticket when it is used to make sure it is being presented in the right place by the right party.

• Token generation. Creating tokens, usually in the same format as a card number and drawn from dedicated token BIN ranges, with their own expiry dates.
• Vault management. Securely storing the mapping between tokens and card numbers, often in hardware security modules.
• Provisioning and assurance. Working with the issuer to verify the cardholder before a token is issued, and recording how strongly the token was verified.
• Domain controls. Restricting each token to its requestor, channel or device, and rejecting use elsewhere.
• Cryptogram validation. Checking the one-time cryptogram sent with each token payment.
• De-tokenisation. Replacing the token with the card number before the authorisation request reaches the issuer, unless the issuer handles tokens itself.
• Lifecycle management. Updating, suspending or deleting tokens when cards are reissued, lost or closed, and linking them through a payment account reference.

When a customer pays with a tokenised card, the merchant's acquirer sends the token and cryptogram through the network. The TSP validates the cryptogram and domain, looks up the real card number and passes the request to the card issuer with information about the token. The issuer approves or declines, and the TSP returns the response with the token, so the merchant never sees the card number. Clearing and settlement follow, with the network handling the token mapping. This adds a step to the flow but gives issuers extra assurance, which is one reason token transactions often show higher approval rates.

Most tokens today are network tokens issued by the card networks, which suits merchants because a single integration can cover many issuers. Some large issuers operate their own token services, especially for their own digital wallets, and some domestic schemes run TSPs for their cards. A token is generally tied to the TSP that issued it, so a merchant may need to work with several TSPs. Payment providers often hide this complexity by integrating with all major TSPs on their merchants' behalf. Proprietary "vault" tokens issued by a payment gateway are different: they are created and held by the gateway rather than a TSP, and they work only with that gateway.

TSPs hold one of the most sensitive data sets in payments, so they are subject to strict security standards, including PCI DSS and network rules for token vaults. Some regulators have set rules directly. The Reserve Bank of India allowed card-on-file tokenisation through card networks and issuers acting as TSPs and, from October 2022, barred merchants and their payment providers other than issuers and networks from storing actual card data, which drove rapid adoption. Elsewhere, adoption has been driven by network incentives, such as lower fraud and better approval rates, rather than mandates. Because a TSP outage could stop many token payments at once, operational resilience is a growing focus for networks and their overseers.

• EMVCo