In this essay
Visa Token Service (VTS) is Visa's network tokenization service. It replaces a Visa card's 16-digit account number with a token that is used to pay in its place, so a wallet, merchant or payment provider does not need to store the real card number. A registered token requestor asks VTS for the token, Visa may pass the request to the issuing bank for approval, and each payment then carries the token together with a one-time cryptogram. When the card is reissued or compromised, the issuer can update the credential behind the token without the customer re-entering anything.
Visa's own description of tokenization is the replacement of sensitive account information, such as the primary account number (PAN), with a unique digital identifier called a token. Visa: tokenization
Who takes part in Visa Token Service?
| Participant | Role in VTS |
|---|---|
| Token requestor | Requests tokens for end users. Visa lists digital wallet providers, payment enablers, merchants and IoT manufacturers as examples. Must register with Visa before requesting tokens |
| Token service provider partners | Third parties that help others use VTS: issuer TSPs serve financial institutions, token requestor TSPs let requestors build payment products on VTS |
| Issuer | Approves token requests for its cards where Visa shares them, and controls the token's lifecycle |
| Visa | Issues the token, keeps the link between token and card number, and processes tokenized transactions on VisaNet |
| Merchant and acquirer | Submit the token and cryptogram in the authorization; they do not receive the underlying PAN |
Sources: Visa Developer: VTS provisioning and credential management, Visa: Visa Token Service fact sheet. PCI SSC's FAQ on token types confirms the last row: for EMVCo payment tokens, the cardholder presents the token in place of the PAN and the merchant and acquirer never receive the PAN. PCI SSC: acquiring, issuer and payment tokens
How does Visa Token Service work, step by step?
- Enroll. The customer adds a Visa card to a wallet, or saves it with a merchant or payment provider.
- Request. The token requestor asks VTS for a token. Visa's developer documentation says that, depending on the use case, Visa may share the token request with the issuing bank, and with the issuer's approval Visa replaces the PAN with the token. Visa Developer: VTS provisioning
- Store. The requestor keeps the token and a token reference instead of the card number.
- Pay. Each tokenized payment carries the token and a cryptogram. Visa describes the cryptogram as a dynamic, one-time-use code for each transaction that accompanies the token. Visa: Visa Token Service A copied token without a valid cryptogram is of little use to a fraudster.
- Maintain. Visa's provisioning APIs include token lifecycle actions such as activate, suspend, resume and delete, and give issuers a Token Reference ID to use in later lifecycle calls instead of the token value. Visa Developer: VTS provisioning Visa also states that financial institutions can update expired or compromised credentials without the customer making manual updates. Visa: tokenization
The token is also limited to the context it was issued for. EMVCo's payment tokenisation guide describes token domain restriction controls that only allow a payment token to be used for the requestor it was issued to. EMVCo: Payment Tokenisation, a guide to use cases
How is a VTS token different from the card number?
| Question | Card number (PAN) | VTS network token |
|---|---|---|
| Who issued it | The issuing bank | Visa, with issuer approval where required |
| Where it can be used | Wherever the card is accepted | Restricted to the requestor and domain it was issued for |
| What travels with each payment | PAN and expiry, often a security code | Token plus a one-time cryptogram |
| What happens on card reissue | Stored PAN goes stale | Issuer can update the credential behind the token |
| What a breach exposes | A reusable card number | A token that is hard to use elsewhere |
| PCI DSS effect | Systems storing it are in scope | Can reduce where PAN exists; scope still depends on data flow |
The last row matters. PCI SSC's tokenization guidance says any component that can turn a token back into a PAN stays in scope, so tokens reduce scope only when the systems holding them are segmented and cannot recover the PAN. PCI SSC: Tokenization Guidelines Network tokens vs gateway tokens covers how this interacts with a provider's own vault.
How is VTS used in wallets and card-on-file payments?
Wallets. Digital wallet providers are among the token requestors Visa lists, so a card added to a wallet is stored as a token rather than a PAN. Visa's Cloud Token Framework lets e-commerce and card-on-file tokens be bound to several trusted devices. Visa: Cloud Token Framework fact sheet For how a wallet token flows through to merchant payout, see wallet tokens and payment operations.
Card-on-file. Merchants can become token requestors themselves or use a provider that tokenizes on their behalf. Visa has announced acquirer gateway and technology partners that, once certified, can tokenize credential-on-file payments for their merchant clients. Visa: VTS adds 28 new partners Visa also offers a Token Management Service through its Cybersource subsidiary for merchants that do not want to build tokenization themselves. Visa: Token Management Service fact sheet The Cybersource architecture guide describes where that sits in a gateway stack.
What benefits does Visa claim for VTS?
These are Visa's figures, measured on Visa's data, not independent results:
- Authorization rates. Visa's tokenization page claims a 4.8% increase in authorization rates for tokenized card-not-present transactions compared with PAN, citing VisaNet data for January to December 2025, and notes that individual merchant results may vary. Visa: tokenization
- Fraud. The same page claims a 39.4% lower fraud rate for tokenized credentials than non-tokenized ones, citing Visa's FY25 fraud data. Visa: tokenization
- Regional spread. A Visa Economic Empowerment Institute report put the uplift at 4.7% globally, around 4% in Europe and North America and nearly double that in Latin America and the Caribbean. Visa Economic Empowerment Institute: open future for payments
Visa's pages from different years quote different figures, so always check the data period behind a number before using it in a business case, and measure your own baseline by issuer, market and token status.
What should a product team check before using VTS?
- Access path. Will you register as a token requestor, or use your gateway or acquirer's tokenization? This sets who owns provisioning, cryptograms and lifecycle events.
- Network coverage. VTS covers Visa cards. Mastercard cards use Mastercard's own service; see MDES network tokenization.
- Lifecycle handling. Confirm how suspend, delete and credential-update events reach your systems and customer support.
- Fallback. Decide what happens when a card is not eligible for a token or provisioning fails.
- Data model. Store token status, requestor and provider separately from the payment method shown to the customer.
FAQ
What is a token requestor in Visa Token Service?
An entity that requests payment tokens for end users, such as a wallet provider, payment enabler or merchant. It must register with Visa and agree to Visa's participation requirements before requesting tokens.
Does a merchant have to register with Visa to use VTS?
Not always. Many merchants use a gateway or acquirer that requests and manages tokens on their behalf. Registering directly gives more control but more responsibility.
What is the difference between VTS and MDES?
VTS tokenizes Visa cards; Mastercard Digital Enablement Service (MDES) tokenizes Mastercard cards. A merchant accepting both needs token support for each network, usually through one provider.
Does a Visa token change when the card is replaced?
The aim is that it does not need to. Visa says issuers can update expired or compromised credentials behind the token, so a stored token can keep working after reissue.
Does using VTS remove PCI DSS scope?
No. It can reduce the number of systems that hold PAN, but any system that captures card data or can recover PAN from a token remains in scope. Confirm scope with your acquirer and assessor.
Closing thought and further reading
VTS replaces the 16-digit card number with a token that only works where it was issued, and keeps it current when the card changes. Here is how the pieces fit.
Ideas that continue the thread.
View all essays
Need help applying this to your business?
Explore practical support for payment operations, product decisions, program delivery and AI automation, grounded in the challenges behind this essay.