Guidance Published on New Ways EMV^® Payment Tokens Can Be Used

EMVCo recently published its latest EMV^® Payment Tokenisation supplementary A Guide to Use Cases. The guide is part of a comprehensive offering which reflects a decade of ongoing work from EMVCo to define a global payments industry approach to payment tokenisation. In this post, David Worthington, EMVCo Tokenisation Working Group Chair, explains the significance of this latest publication.

[This post assumes that the reader is familiar with EMV Payment Tokenisation. Want to understand the basics? Read the general FAQs and watch The What, Why and How of EMV Payment Tokenisation.]

EMVCo expanded its scope to lead the payments industry to standardise payment tokenisation leading to the publication of version 1.0 of the Technical Framework in 2014. There are three elements to this activity:

1. Publication and maintenance of the EMV^® Payment Tokenisation Specification – Technical Framework, to define the roles, functions and requirements that need to be adhered to when introducing EMV Payment Tokens to work with the payment ecosystem.
2. Management of registration programmes to ensure global interoperability and support transparency of:
   • Token Service Providers, who they are and what tokens they are issuing.
   • BIN Controllers, to ensure that within the supporting context of EMV Payment Tokenisation, they can effectively implement payment account reference (PAR) without clashes or conflicts using the globally unique EMVCo assigned BIN Controller ID.
3. Evolution of the EMV^® Payment Tokenisation A Guide to Use Cases to detail industry input and show illustrative examples of the many new ways in which EMV Payment Tokens may be used.

Although the guide is intended for use by anyone interested in understanding the potential of payment tokenisation, it is specifically targeted to all participants in the payment ecosystem, including card issuers, merchants, acquirers, payment systems, payment networks, payment processors, and third-party service providers.

Why is A Guide to Use Cases important?

The guide brings the technical framework to life using real-world examples that the payment community is familiar with.

It describes key elements, such as the token programme participants, the relationship between participants and the characteristics of payment tokens. It also offers examples of scenarios for how a payment token can be used and details their associated lifecycles.

The guide outlines EMV Payment Tokenisation in the real world, striving to be balanced and not too prescriptive. While each use case shows one possible way a payment token could work, we recognise that these can, and will be successfully adapted by implementations.

What’s new?

The Guide to Use Cases v2.2 builds on EMVCo’s understanding that the payments market continues to dynamically adapt and progress. It reflects the pace of digital payments evolution and the advancement of new payment scenarios and market players.

The comprehensive document also respects the mature usage of EMV Payment Tokens today.

The latest Guide to Use Cases:

• Explains convergence of EMV technologies – EMV 3-D Secure (EMV 3DS) and EMV Secure Remote Commerce (EMV SRC) – and the security value payment tokenisation can bring to cardholder authentication and e-commerce transactions respectively.
• Offers a focus on PAR. For example, PAR usage within a transit system use case and the ability to tap into a transport system with one device (such as a smartphone) and tap out with a payment card, as well as PAR use to support merchant loyalty schemes.
• Gives an overview of lifecycle management related to payment tokens and the underlying PAN. For example, the lifecycle management actions which are taken when a consumer reports that they have lost their mobile phone. This includes suspending or replacing a payment token which has been issued to a mobile payment application on the mobile phone.
• Shows variations to the seven existing use cases (proximity payments at POS, online wallets, in-app purchases, card-on-file e-commerce, e-commerce guest checkout, third party service providers and merchant-initiated transactions). For example, bulk request of payment tokens by a merchant with an existing PAN-based card-on-file database.

What’s next?

The payment community recognises the value in replacing a primary account number with a payment token to protect our sensitive data and enable new innovations. EMVCo continues to maintain its work in this area, listen to what the marketplace needs and will adapt the industry tools as required.