Token Economics

The major payments networks have been in the tokenization business for four years now. With digital payments set to explode, how long can they keep giving away the store?

The technology for rendering card-account numbers into random strings of digits has been around for decades, but with the kickoff of Apple Pay in 2014 the race was on to tokenize all the major-brand credit and debit cards that consumers could digitally cram into Apple Inc.’s spiffy new wallet.

Since then, Alphabet Inc., Samsung Electronics Co. Ltd., and dozens of others have launched their own digital wallets. And the big networks have laid plans to mine the so-called Internet of Things, which includes everything from smart watches to smart clothes and clever fridges, for yet more transaction volume.

By masking the actual 16-digit primary account number, or PAN, the token can serve multiple purposes embracing security but also smoother processing, particularly when it comes to functions as mundane as displaying card art or keeping track of cards on file.

For the time being, tokenization from the big networks remains free to merchants, acquirers, digital-wallet providers like Apple, and other token requestors. And for its part, Visa Inc., which in the late spring of 2015 famously decreed free tokenization for entities that process on its network, doesn’t see that changing.

“The position we stated in 2015 still holds true. We are committed to that model,” says Ansar Ansari, senior vice president for digital products at Visa.

‘Nothing Is Free in Life’

But how long can the networks maintain that commitment? That’s a complicated question. On the one hand, forces are building that in most businesses would exert upward pressure on pricing. To be sure, mobile-payment growth for the general-purpose wallets has fallen short of the rosy expectations of 2014, but the ranks of U.S. users—including devotees of Starbucks’s app—is projected to grow at a nice 5%-to-7% clip over the next few years.

Similarly, research firm Gartner Inc. projects IoT endpoints will reach nearly 13 billion in 2020, triple the number at the end of 2016. That’s not to say all of these devices will be fitted for payments, but a good many will be, and not just refrigerators.

Rising transaction counts will require more token requests, exerting higher demand on token service providers. These are the 40 or so entities registered so far with EMVCo, the international standards group controlled by American Express Co., Discover Network, Mastercard Inc., Japan’s JCB network, and China’s UnionPay, as well as Visa. Most of these TSPs have registered only in the past two years.

“Right now, no, they’re not charging, but they’re chatting it up,” says Steve Mott, principal at BetterBuyDesign, a Stamford, Conn.-based payments consultancy.

In industry chatter, Mott says he’s heard “two to three cents [per token] bandied about” as an acquirer fee, “but also I’ve heard volume tiers.” His opinion is that there is a “better than even chance” for this fee. Before Visa dropped the idea of pricing for tokenization, it had been planning on a 7-cent fee.

Other factors could heighten pressure on the token market, experts say. The so-called single buy button the networks are proposing for e-commerce transactions (“The Shared Checkout’s Slow Check-in,” June), for example, will also stimulate token demand once it finally clicks in. “As that develops, that could boost tokenization,” notes Zilvinas Bareisis, a London-based senior analyst for Celent, a Boston-based financial-services advisory firm.

As demand grows, networks will need to invest in their token engines and token-vault capabilities, as well. “Nothing is free in life,” says Terry Dooley, executive vice president and chief information officer at Shazam, the Johnston, Iowa-based electronic funds transfer network. “The ability to scale is going to require a continued investment in those vaults. A charge for service will provide revenue to invest in those services.”

There could even be a wholesaling opportunity for tokenization, since not all of those TSPs registered with EMVCo operate their own vaults. Some outsource that safekeeping function, allowing those who do own vaults, like the major networks, to contemplate pricing for that service.

The Sell-By Date

Still, many observers argue it’s far too soon for talk of token charges, despite the expected deluge of volume.

For one thing, it’s easier to raise prices once you’ve been charging for something than it is to start charging for something you’ve been giving away, argues Rick Oglesby, principal at AZPayments Group, a Mesa, Ariz.-based consultancy.

“If I’m in the shoes of the networks, I’m not thinking about trying to charge for that yet,” he says. “I’m trying to embed my tokens everywhere they can be embedded.”

Similarly, while volume on the big networks is growing, traffic is rising much faster for alternative payments and in developing markets on systems that don’t depend on the these networks. That could slow any impulse to slap on token fees, says Thad Peterson, a senior analyst at the Aite Group, a Boston-based consulting firm.

“This is probably not a great time for the networks to put their transaction volume at risk,” he says.

But even Oglesby doesn’t argue that tokens will remain free forever, or even, possibly, for the next five years. He gives it three to five years before pricing will be imposed.

And, in the eyes of some experts, the sell-by date could arrive even sooner. “I think 2018 is too soon,” says Celent’s Bareisis. “I’d say probably two to three years.”

A Token ‘Tidal Wave’

While sluggish consumer adoption of Apple Pay and other mobile-payments serviees has dampened expectations among many observers for a breakout year, the fact remains that the token factories have been busy.

Already, requestors have deployed 192.2 million EMVCo tokens in the U.S. market, which will generate more than $161 billion in payment volume by the end of the year, according to estimates calculated by Tim Sloane, vice president for payments innovation at Mercator Advisory Group, a Maynard, Mass.-based financial-services consulting firm.

“This includes mobile payments, wearables, and IoT as well as multiple tokens (cards) per device and re-issued tokens due to new or repaired phones/wearables that requires re-provisioning,” says Sloane in an email message to Digital Transactions. “Note that this does not include payments made on mobile devices using the browser or in-app payments that utilize a card on file.”

Little wonder that some processors, at least, are expecting bigger things. A recent blog post on PayPal Holdings Inc.’s Web site, for example, was headlined: “A Tokenization Tidal Wave Is Coming: Are You Ready?”

To help prepare for the “tidal wave,” PayPal in 2016 negotiated a deal with Visa that gave the online processor access to Visa’s token engine in return for promoting Visa cards for account funding instead of the automated clearing house system.

In the months that followed, PayPal further positioned itself by striking similar deals with Mastercard and other providers.

‘A Good Pipeline’

But it was Visa that not only struck the landmark deal with PayPal but also led the way in the “free-token” movement. Since then, it has been building out its engine to the point that it now serves 63 token requestors, double the number from a year ago, and 40 countries.

“We feel good about the transaction growth we’ve seen,” says Ansari. Visa won’t release actual transaction counts, but percentage growth has been in three digits year over year, he adds.

While Visa is looking to cultivate further growth from the IoT and the developing market for in-dash payments from automobiles, it’s in existing card-not-present transactions flowing from both merchants and acquirers where Ansari sees near-term potential.

“Securing payments for the [card-not-present] channel is where we have a good pipeline, where we have commercial contracts not yet announced,” he says.

Mastercard, too, is looking to the CNP channel for near-term potential. “We’re seeing increased demand from merchants to bring this … technology to their card-on-file activities,” says Jorn Lambert, executive vice president of digital solutions, in an email message.

Issuers in 50 markets have integrated Mastercard’s technology so far, he adds, so that now “more than seventy-five percent of all our cards are already enabled to be tokenized.”

Easier transactions and better security will also help drive growth, Lambert adds. “We think these numbers will continue to grow for a number of reasons. Consumers are looking for a seamless, more convenient shopping experience. With the increased adoption of contactless and mobile payments, tokens will continue to power this experience with the same chip-level security in every purchase—in-store and online.”

‘Down the Road’

Another goal for both networks is to make things easy for requestors, a wide-ranging group that includes merchants, acquirers, gateways, digital platforms, and startup IoT technology players. “One of our key objectives is to ensure a client does not have to strike multiple agreements to get access to Visa cards,” Ansari says.

With all that said, it doesn’t look likely that token requestors will have to fret about fees any time soon. But just how long “free” will last is still the big question.

While the business is growing, the networks won’t be disposed to risk dampening demand. But that doesn’t mean some sort of pricing may not arrive for niche applications.

While stressing Visa’s principle of no-fee tokenization, Ansari says, “There may be opportunities down the road to commercialize a set of value-added services built on tokenization.” A hypothetical example would be digital issuance of prepaid products, he adds, such as gift cards.

But nothing like that is in the works now, he stresses, adding, “We are committed to the position of not charging.”

 

Timeline

March 2014

EMVCo releases token specifications

October 2014

Apple Pay is launched

June 2015

Visa makes permanent a temporary hold it had placed on token fees as long as the requestor processes with Visa

November 2015

EMVCo introduces a registration process for TSPs that includes a requirement that applicants own or have access to a token vault

December 2015

The PCI Security Standards Council releases a 92-page set of requirements for TSPs

January 2016

EMVCo publishes a specification bulletin for a Payment Account

Reference, or PAR, intended to tie multiple tokens back to the original primary account number

July 2016

PayPal strikes a landmark deal with Visa to access Visa’s token engine and gain access to the physical point of sale

September 2017

EMVCo publishes the technical framework of its current tokenization specification, version 2.0

September 2018

Visa tokenizing transactions for 63 requestors and in 40 countries; issuers in 50 countries have integrated Mastercard’s technology, enabling 75% of its cards for tokenization.