EMV® Payment Tokenisation FAQs

EMV^® Payment Tokenisation Frequently Asked Questions 1. What is EMV Payment Tokenisation? EMV Payment Tokenisation enhances transaction security by removing the most valuable data to a fraudster within a transaction, the primary account number (PAN), and replacing it with a unique alternative value, a payment token. This reduces the value of payments information stolen in the event of a data compromise, as a payment token should not be able to be used beyond the environment in which it was intended. Payment tokens support both face-to-face (F2F) and remote payment transactions. 2. How is EMV Payment Tokenisation different to other forms of tokenisation solutions used within the payment ecosystem? EMV Payment Tokenisation enables a payment token to be used in a payment transaction from point of purchase, to an acquirer and then passing across the payment networks through to payment authorisation by the card issuer. This offers the benefits of payment tokenisation throughout the payment process. Other forms of tokenisation can happen at different points within the payment process. For example, within the merchant environment tokenisation can happen between the merchant and acquirer. EMV Payment Tokens are compatible with other forms of tokenisation such as acquirer and/or security tokens. 3. How does EMV Payment Tokenisation benefit the payment community? It offers card issuers, their cardholders and merchants the ability to increase protection of payment data increasing overall security. This means that for cardholders and issuers, the impact from data compromise of payment tokens will be much less than if a card number (PAN) is exposed. This can reduce the need for card replacements and leverage the ability to control and replace payment tokens for specific merchants, devices or transaction types, often without any interaction from the cardholder. © 2022 EMVCo, LLC. All rights reserved. Page 1 4. Why is EMV Payment Tokenisation important for payment innovation? As an EMV Payment Token limits potential risk from payment data compromise, it promotes the development of new payment technology and scenarios where the risk of using a PAN would be deemed too high. This has enabled solutions, such as mobile payment applications, to scale and provides the ability to support high value transactions, offering consumer and merchant payment convenience. Additionally, as EMV Payment Tokenisation uses the existing acceptance infrastructure technology, merchants, card issuers and others within the payment ecosystem can benefit from enabling new payment technology with no or only limited modifications required to existing systems and processes. 5. What is the impact on a cardholder when solutions based on EMV Payment Tokenisation are implemented? For cardholders, the payment process is not impacted, and existing behaviour does not need to change. It continues to be familiar, convenient and seamless, while supporting innovative new ways to pay such as mobile payment applications, in-app and QR Codes™. This is due to EMV Payment Tokenisation using the existing payments infrastructure and its ability to maintain compatibility with F2F and remote card payment technology. 6. How does EMVCo support the payments community in delivering EMV Payment Tokenisation? EMVCo publishes and maintains the EMV Payment Tokenisation Specification – Technical Framework. The technical document defines the roles, functions and requirements that need to be adhered to when introducing EMV Payment Tokens to work within an existing or new payment ecosystem. This ensures they can overlay and interoperate across the entire infrastructure. The framework provides implementers with a common foundation that can be adapted to: o Different use cases as an enabler to deliver payments. o Regional or country specific implementation requirements. o Differentiate products and innovate by enabling solutions to upscale and be used by mass markets. For example, mobile payment applications, ride-share apps, general in-app purchases and additional security for QR Code payments. © 2022 EMVCo, LLC. All rights reserved. Page 2 The Technical Framework also defines Payment Account Reference (PAR) as a way to link transactions that use EMV Payment Tokens with the PAN for which the Payment Tokens have been issued. This enables support for value added services such as fraud screening, anti-money laundering monitoring, some PAN-based loyalty systems, and new use cases, such as transit. A Guide to Use Cases is supplement to the Technical Framework which details industry input and guidance on new ways in which EMV Payment Tokens can be used. 7. How does EMVCo support implementation of EMV Payment Tokenisation? Product or solution implementation is beyond EMVCo’s remit. However, to ensure traceability and support EMV Payment Tokenisation transparency, EMVCo manages two registration programmes: o Token Service Provider (TSP) Registration Programme - EMVCo manages and assigns TSP Code numbers worldwide to ensure that each TSP issuing EMV Payment Tokens is globally uniquely identifiable. o BIN Controller Registration Programme - EMVCo manages and assigns BIN Controller ID (BCID) numbers worldwide to ensure that within the supporting context of EMV Payment Tokens, they can effectively implement PAR without clashes or conflicts using the globally unique EMVCo assigned BIN Controller ID. 8. Does EMVCo manage a testing programme? No. Testing EMV Payment Tokens would be complex as they are not contained within one area of the payment ecosystem, but instead overlay the entire payment infrastructure. Testing, therefore, would be impractical as it would require many key elements of the payment infrastructure to be continually tested to support the pace of change. This would result in significant time and financial resource investment. 9. Who can use the EMV Payment Tokenisation – Technical Framework? Any party within the payment community can use and access EMV Payment Tokenisation and realise the benefits of the technology. The technical documents are available, royalty-free from the EMVCo website. EMV Payment Tokens have the ability to co-exist with other forms of tokenisation, support all use cases and are applicable in any environment which currently uses a PAN. The flexibility of the Technical Framework means EMV Payment Tokens can be implemented to meet global or different regional requirements. © 2022 EMVCo, LLC. All rights reserved. Page 3 EMV^® is a registered trademark in the U.S. and other countries and an unregistered trademark elsewhere. The EMV trademark is owned by EMVCo, LLC. © 2022 EMVCo, LLC. All rights reserved. Page 4