Payment tokenization is emerging as an important part of the payments infrastructure as Visa and MasterCard establish services designed to support mobile wallets such as Apple Pay. Replacing sensitive card credentials with tokens can improve payment security, but control over the tokenization infrastructure also raises strategic questions about which organizations will manage access to payment information and new transaction channels.
For issuing processors and EFT networks, the concern is that network-controlled token services could alter their traditional roles in the payments ecosystem. If the major card networks determine how tokens are created, managed, and routed, they could gain greater influence over transactions while creating new revenue opportunities from tokenization services.
Mercator called it on September 18! This was when we published the blog titled “Will Issuing Processors Be Marginalized as MasterCard and Visa Deploy Token Services?” This was followed by a detailed review of how tokenization works and how this enables the networks to control the tokenization infrastructure in the research report titled Payment Networks 2.0: The Battle for Tokenization. The report identified a scenario that would marginalize both issuing processors and operators of electronic funds transfer (EFT) networks.
Tokenization Could Shift Control Toward Card Networks
In the report, we noted that the two issuing processors Mercator had interviewed were entirely unclear regarding MasterCard and Visa’s intent, despite the fact the networks created profit centers for tokenization and brought all aspects of token operations into their network for enabling Apple Pay. The report also points out that tokenization represents an opportunity to disadvantage competitors:
“It should be recognized that MasterCard and Visa appear to be using tokens not only as a mechanism for a new revenue stream but also to gain network traffic from competitive debit networks. On July 24, the Secure Remote Payment Council (SRPc) issued a Tokenization Position Statement that indicates the EFT networks have been excluded from the tokenization standards process, as they were from the original EMV standards process, and that the token infrastructure currently being defined and announced by the major networks will likely not be compatible with EFT network operators, including the ATMs they drive. Note that several of the ATM networks are also owned by the issuing processors. This incompatibility has less to do with technical complexity than with a lack of planning during the standardization process. While, as described in the history of tokenization, the networks were under high competitive pressure, this is the exact same kind of lack of planning that caused a ruckus during the EMV roll-out, so it is hard to imagine this was just an oversight during the tokenization standard development.”
Visa Outlines Its Tokenization Strategy
Now Visa has clearly stated its intent. Charles Scharf, Visa’s CEO, made the following statement at the Bank of America Merrill Lynch 2014 Banking & Financial Services Conference November 12:
“Those of us that participate in the token infrastructure can make decisions on who you want to give access to, whether you want to charge for it and things like that. So it’s hugely meaningful to our ability to open up new channels and to make sure there’s clarity in terms of who controls the payment information. We put a rate schedule out there for tokenization. We said we’re waving everything through the end of 2015. We want people to adopt tokenization. We think it thus creates a meaningful set of opportunities that would be difficult for us to participate without something like tokenization.”
This statement appears to fly in the face of reports that indicate issuing banks pay a $0.50 fee for each Apple Pay phone that is enabled and that maintenance fees are also charged monthly. But even if Scharf is correct, what are the odds that Visa, or MasterCard, would take on the cost of token implementation without a profit? And with regard to his statement (quoted above) “So it’s hugely meaningful to our ability to open up new channels and to make sure there’s clarity in terms of who controls the payment information,” clearly the EFT networks recognize they have lost control.
Visa’s comments reinforce the strategic importance of payment tokenization beyond its security benefits. Control over token infrastructure can influence who gains access to payment credentials, how new payment channels are supported, and potentially which networks receive transaction volume.
That creates significant implications for issuing processors and EFT networks that have traditionally occupied important positions within the payment process. As Visa and MasterCard expand their tokenization capabilities, these organizations will need to determine how they fit into an infrastructure increasingly controlled by the major card networks. The battle over payment tokenization therefore involves not only security and mobile payments, but also control, network economics, and the future roles of established payments participants.