Network tokenisation explained: VTS, MDES, cryptograms

Network tokenisation replaces the card number (PAN) with a substitute number issued by the card scheme's own token service, such as Visa Token Service or the Mastercard Digital Enablement Service (MDES), and limits that token to one merchant, device or channel. Each payment with the token carries a one-time cryptogram, and the scheme updates the token automatically when the underlying card expires or is replaced.

That makes network tokens different from the tokens most payment providers have issued for years, which only work inside one provider. The table below sets the two side by side.

Network tokens vs PSP tokens

Sources: EMVCo; Visa; Mastercard; Adyen, all checked 3 November 2026.

EMVCo describes a payment token as reversible, generated at payment-issuer level, and mappable back to the card number only by the token provider and authorised parties. Its tokenisation article contrasts this with other forms of tokenisation that often run only between merchant and acquirer. For background on the issuer, acquirer and scheme roles, see how card payments work.

The parties in network tokenisation

Sources: EMVCo; Visa Developer; Mastercard, checked 3 November 2026.

EMVCo's framework, first published as version 1.0 of the EMV Payment Tokenisation Specification on 10 March 2014, gives each token requestor an ID that pairs it with a specific TSP. EMVCo assigns a three-digit code to each TSP for this purpose. Visa says token requestors must register with it and accept its participation requirements before they can request tokens.

How a network-tokenised payment works, step by step

1. The card is saved. A shopper stores a card with a merchant, or adds it to a phone wallet.
2. The token requestor asks for a token. The merchant's PSP, platform or wallet sends the card to the scheme's token service.
3. The issuer approves. Visa's developer documentation lists the issuer calls involved: an eligibility check, an approve, decline or step-up decision, and, where needed, a one-time passcode sent to the cardholder. Mastercard describes the same pattern, with extra authentication such as a passcode or in-app approval when the issuer asks for it.
4. The token is returned and stored. The merchant or wallet keeps the token, not the card number. Mastercard says a wallet also receives the card art and a cryptographic key.
5. A payment starts. At checkout, the token requestor asks for a cryptogram, a one-time code generated for that transaction.
6. The authorisation travels with the token. The token and cryptogram pass from merchant to gateway, acquirer and network. Visa's diagram shows the network then identifying the underlying card to the issuer.
7. The issuer decides. The issuer approves or declines as with any card payment, with the cryptogram as evidence the payment came from the genuine merchant account or device.
8. The token is kept current. If the card expires or is replaced, the token service updates the link behind the token, and the merchant keeps using the same token.

Cryptograms

A cryptogram is a one-time value created for each tokenised payment. Mastercard explains that the card stored in the device or merchant account generates it per transaction, which confirms the payment came from that device or genuine merchant account. Visa's corporate guide says each transaction carries a unique cryptogram. Adyen's documentation describes the same feature as a per-transaction, single-use cryptogram.

In practice the merchant's PSP or token requestor usually requests the cryptogram, not the merchant itself. Spreedly's documentation shows the fallbacks: for some transactions it can use a previous network transaction ID instead, and if cryptogram generation fails for certain Mastercard tokens it falls back to the card number.

Lifecycle updates

This is where network tokens change day-to-day operations for subscription and card-on-file merchants. When a bank reissues a card, the merchant does not need the new number.

Visa's developer pages list the lifecycle calls available to issuers: activate, resume, suspend or delete a token; update the PAN, its expiry date, or perform account updater changes; and change card metadata such as card art without re-provisioning. Spreedly lists the token statuses it receives from the networks as active, suspended, deactivated (Mastercard) or deleted (Visa).

Visa Token Service and Mastercard MDES

Sources: Visa Developer and Visa corporate pages; Mastercard, checked 3 November 2026.

Mastercard says it and others introduced the tokenisation standard in 2013. Its 1 June 2026 European press release says merchant tokenisation through Secure Card on File was live in 45 European countries and territories. Our Visa and Mastercard profiles, and the Visa vs Mastercard comparison, cover the schemes more broadly.

What the schemes publish on authorisation rates and fraud

The schemes publish their own figures. They are network averages, and both note that results for individual merchants vary.

Sources: Visa tokenization page; Mastercard network tokenization page and 1 June 2026 press release, all checked 3 November 2026.

Who provides network tokens to merchants

Merchants rarely connect to Visa or Mastercard directly for tokens. A PSP, gateway or orchestration platform acts as token requestor for them.

• Adyen says it can collect and store network tokens from the schemes and swap card details for a token automatically when it forwards payments, with no extra integration. Merchants can also manage tokens themselves and send the token and cryptogram. Adyen names Visa, Mastercard and American Express, and says network tokenisation applies only to payments it acquires.
• Checkout.com is cited on Mastercard's own tokenisation page as the source of the merchant approval figure above.
• Spreedly says it is a token requestor with completed integrations for Visa and Mastercard, using each merchant's token requestor ID. It notes Mastercard IDs are usually ready right after processing, while Visa IDs can take up to 72 hours.
• Primer lists network tokenisation among its products.

Orchestration platforms matter here because a network token can follow the merchant from processor to processor. Our payment orchestration guide explains how that portability works.

Benefits and trade-offs for merchants

Network tokens also feed into authentication: a Payment Token message extension is one of the five extensions EMVCo has defined for EMV 3-D Secure. More in the cards hub.

Frequently asked questions

What is network tokenisation?

Network tokenisation replaces the card number (PAN) with a substitute number issued by the card scheme's own token service, such as Visa Token Service or Mastercard MDES. The token is limited to one merchant, device or channel, each payment carries a one-time cryptogram, and the scheme updates the token when the card expires or is replaced.

Is network tokenisation the same as PSP tokenisation?

No. A PSP token only works inside the provider that issued it, which swaps it back to the PAN before sending the payment to the scheme. A network token travels through the acquirer and card network to the issuer, carries a per-payment cryptogram and, as Visa describes it, is not specific to any one processor.

What is a cryptogram in a tokenised payment?

A cryptogram is a one-time value created for each tokenised payment. Mastercard explains that it confirms the payment came from the genuine device or merchant account. In practice the merchant's PSP or token requestor usually requests it, not the merchant itself.

What happens to a network token when a card expires?

The token stays the same and the scheme keeps it valid, so the merchant does not need the new card number. Mastercard says a tokenised card can also keep working while a replacement for a lost or stolen card is sent. These updates rely on the issuer taking part.

Do network tokens improve approval rates?

The schemes publish network averages, not guarantees. Visa reported a 4.8% authorisation rate uplift for tokenised versus PAN card-not-present payments over January to December 2025, and Mastercard cites a 10.3 percentage point approval uplift for Checkout.com merchants using network tokens, based on Checkout.com FY2025 data. Results for individual merchants vary.

How do merchants get network tokens?

Merchants rarely connect to Visa or Mastercard directly for tokens. A PSP, gateway or orchestration platform acts as token requestor for them, as Adyen and Spreedly describe. Our payment orchestration guide explains how a network token can follow the merchant from processor to processor.

Key terms

• Cryptogram: a one-time code generated for each tokenised payment.
• Domain restriction: a limit that ties a token to a merchant, device or channel.
• MDES: Mastercard Digital Enablement Service, Mastercard's token service.
• Network token: a scheme-issued substitute for the card number that travels to the issuer.
• PAN: primary account number, the long number on the card.
• PSP token: a token only the issuing payment provider can use.
• Token requestor: the party that asks the token service for tokens, such as a PSP or wallet.
• Token Service Provider (TSP): the entity that issues and manages tokens.
• VTS: Visa Token Service, Visa's token service.