Visa Token Service adds major scale through partnership push

The advancement of tokenization as a payment security layer has generally run into the same wall in the past — lots of providers are making tokens available, but they typically only worked on their network.

In looking to get past that problem, Visa is expanding its Visa Token Service commercially with 20 acquirer/gateway partners it feels can immediately add scale for using interoperable Visa tokens in addition to the partners' own as credential-on-file token requestors.

Since 2014, Visa has added more than 60 global token requestors, among them mobile and wearable manufacturers, wallet issuers, and some online merchants and payment service providers. The list of new partners adds some major players on the payments landscape: Adyen, AsiaPay, Braintree, Checkout.com, Cherri Tech, CyberSource, Elavon, Ezidebit, eWay, Fit-Pay, Giesecke & Devrient, PayPal, Payscout, Rambus, SafeCharge, SecureCo, Square, Stripe, Worldpay and YellowPepper.

\2024084\/Anthony Upton

The Visa Token Service is built on top of the EMVCo Payment Tokenization Standard supported by the card brands that make up EMVCo. It replaces Visa payment card numbers with a token unique to the merchant or gateway acquirer partner.

"We are reshaping the way digital payments will work," said William Levaggi, vice president of digital payment products at Visa. "And we are doing it from a standard-based approach, open to anyone building a token service to leverage."

The partners can integrate the Visa Token Service into the back end of their own tokenization service, providing an extra layer of token security and giving it more flexibility to move the token to other gateways or channels.

Alternatively, the merchant's gateway can provide a direct connection to the Visa tokens as its main service, also allowing them to route tokens to other gateways.

"We've been reaching out to players who have token services for merchants, and those players are ideal because they can immediately scale to network tokens and spread the benefit of network tokens in a very short time," Levaggi said. "That is why we see a big benefit in partners like Adyen, Braintree, CyberSource and others as they all have a big merchant database."

But the advancement of Visa Token Service likely won't come without at least some consternation from merchants and other providers who have feared Visa's dominance in this process in the past.

As Visa and Mastercard were continuing to develop tokenization services last year, some merchant groups expressed concern that the services could also steer transaction routing. This would be a particular concern for merchants and processors operating within the spirit of the Durbin amendment's directive for choice in debit routing.

"It's a good idea to have an interoperable token so you don't have to reinvent the wheel for every token, so Visa's service is a good thing," said Avivah Litan, a vice president at industry research company Gartner Inc.

"But this can also be looked at as a Visa dominance play, and maybe take some revenue away from other gateways," Litan added. "In that way, it's weighing the interoperability against too much centralization by Visa."

Visa has historically been wary of processors establishing their own network connection directly to a card issuer, as First Data did more than a decade ago with First Data Net. That network was dismantled after a four-year legal dispute as part of an agreement with Visa in 2006, with Visa using the argument that too many of its card transactions were moving through a network it had no direct control over applying security measures.

Ultimately, Visa sees the commercial expansion of tokenization as a vital aspect of advancing digital commerce security. The token replaces the consumer personal account number and even introduces a more secure personal account reference to the equation for various types of payments.

The Visa network token can also be used to replenish an expired or compromised card, meaning a consumer making an online transaction with an expired card can complete the payment if the issuer confirms it is a safe transaction and a new cryptogram can be applied.

"In the end, this is about better conversion of sales and better experiences," Visa's Levaggi said. "This is providing more security and better optimization."

Earlier this year, Visa launched its Visa Token Management Service to address a growing global and digital economy, giving merchants the capability to view and monitor transaction preferences and behaviors across their commerce platforms.