Sunday, November 15, 2026
Newsletter Advertise

The Crypto Economy

Money, markets and payments, explained without the hype

Network tokenization

Network tokenization is payment tokenization run by the card network itself, in which Visa, Mastercard or another scheme issues a token that stands in for the card number and is limited to one merchant, device or kind of payment. The network swaps the token for the real number inside its own systems before the card's bank approves the payment, so a leaked token can be replaced for that one merchant without a new card.

Glossary Updated

Six in ten online Visa payments

How common are network tokens? Card network Visa answered in its annual report on Form 10-K, filed with the SEC on November 5, 2026. As of September 30, 2026, the filing says, “over 60% of ecommerce transactions were tokenized.”

The same report describes the Visa Token Service replacing “16-digit Visa account numbers with tokens that contain surrogate account numbers, cryptographic information and other data.” Rival Mastercard’s 10-K for 2025, filed on February 11, 2026, gives no share but names the same aim, “replacing card numbers with secure tokens”, and lists digital wallets, gateways, payment facilitators and payment orchestrators among the parties that provision tokenized credentials.

How one token payment moves

Visa’s 2022 fact sheet on the service traces a purchase in seven steps.

  1. The consumer starts a purchase, in a store or online.
  2. The merchant sends the network token it received to its acquirer.
  3. The acquirer passes the token to Visa.
  4. Visa looks up the card number in its token vault and checks that the token is being used where it is allowed.
  5. Visa sends both the card number and the token to the issuing bank.
  6. The issuer, or its processor, approves or declines.
  7. Visa swaps the card number back for the token and returns the answer to the acquirer and the merchant.

The merchant sees the token at both ends of that trip and never the number in the middle. Tokens issued by a merchant’s own gateway, the other main kind of payment tokenization, are swapped back inside that provider instead.

Where you see it

Most of the plumbing is invisible to cardholders, but two traces show up in the industry’s paperwork. EMVCo, the standards body behind chip and token specifications, assigns every token service provider a three-digit code that is built into the token requester ID, the identifier that pairs each token requester with the provider that issued its tokens, according to its registration page.

Visa’s product page lists PAR Inquiry, which ties a card number to all its token transactions so loyalty schemes and spending views still work. It also lists a service that uses Visa’s network data to replace an outdated expiry date on a stored card when the card is turned into a token.

The waiver that is often misread

Tokens can lighten a merchant’s paperwork, which is where the confusion starts. Visa’s compliance page, read on November 12, 2026, describes a Technology Innovation Program that drops the requirement to validate compliance with PCI DSS when at least 75% of a merchant’s yearly transactions come through chip terminals, a validated encryption solution or an “integrated industry-standard tokenization solution.”

That waiver covers the annual check only. The same page says compliance with the PCI DSS standard “is required of all entities that store, process or transmit Visa cardholder data”, and that Visa may levy a non-compliance assessment on the issuer or acquirer behind a merchant that fails it.

If you are moving stored cards to network tokens, ask your acquirer whether you qualify for the program at all, and keep the evidence of your token share for the year.