Merchant tokenization is a security capability that replaces a cardholder's 

 with a unique network token specific to a single merchant.

Merchant tokenization differs from digital wallet tokenization in one key way. Digital wallet tokenization starts when a user adds a card to a wallet. Merchant tokenization is driven by the merchant when a user saves their card on file for future use.

A cardholder enters card details at an online merchant or subscription service. For example, Netflix or Amazon. The user saves the card for future billing.

The merchant or their payment processor requests a network token. The request goes to the card network (Visa or Mastercard). The DPAN (Device Primary Account Number) token replaces the raw PAN (Primary Account Number).

After the issuer approves, the merchant stores the token. The merchant token replaces the sensitive card number in their database.

The merchant uses this token for all future payments. This covers recurring charges and one-click purchases. Each transaction includes a unique cryptogram. The network validates this cryptogram, ensuring that a stolen token cannot be used elsewhere.

 The network restricts the token to a specific domain. The token only works at the merchant that requested it. Other merchants cannot use a stolen token.

 When a cardholder loses or reissues a physical card, the network automatically updates the merchant token. Services like VAU/ABU handle this. Subscriptions continue without interruption.

 Issuers can view and manage tokens individually. Suspend a specific subscription token without canceling the physical card.

Learn how merchant tokenization secures stored card payments with network tokens, reducing fraud, enabling auto card updates, and protecting subscriptions.

Merchant tokenization

Implementation steps

Digital wallet tokenization

Electronic Commerce Indicator. A code that signifies the type of electronic commerce transaction during payment processing. It distinguishes between transaction categories, particularly in transactions where the card is not physically present. 

Cardholder Authentication Verification Value. A cryptographic token generated by the card issuer’s Access Control Server (ACS) during a 3D Secure (3DS) authentication process.

CAVV

Strong Customer Authentication. This is a regulatory requirement that mandates multi-factor authentication for electronic payments to enhance security and reduce fraud.

Virtual Private Cloud. A global virtual network that spans all regions and lets you isolate your resources within projects.

Card Verification Code. A three-digit security codes on Mastercard payment cards used to verify cardholder possession during online or phone transactions.

Card Verification Value. A three-digit security codes on VISA payment cards used to verify cardholder possession during online or phone transactions.

Payment Card Industry Data Security Standard. Created to improve and streamline the security controls organizations use when handling cardholder data and reduce credit card fraud.

PCI_DSS

Payment Services Directive 2 is a EU regulation that aims to enhance the safety and security of payment services and promote innovation and competition in the market.

PSD2

The Federal Reserve Banks use the X9 industry standard to safely exchange check data and digital check images with other banks. This electronic format allows banks to process and transfer check deposits quickly without needing to mail the origin

X9_check_standard

This is an international electronic money transfer for friends and family to send money to those across borders quickly and easily.

remittance_transfer

This is any entity that regularly sends money from consumers to businesses and individuals in other countries. This includes banks and financial service institutions that conduct remittance transfers as part of their normal business operations.

remittance_transfer_provider

The net transfer of funds between the issuer and acquirer, facilitated by the card network, to fulfill the financial obligations of cleared transactions (typically T+1).​

Settlement_in_Cards

An issuing processor authorizes or declines card transactions on behalf of the issuing bank. Cross River has an in-house card issuing processing engine called P1. ​

Issuing_Processor

Fee paid between banks for acceptance of card-based transactions, facilitated via the card networks.​

Interchange

Process by which the merchant's final transaction details are submitted through the card network to the issuer.​

Clearing

The Merchant’s bank in the Four Party Model (cardholder, merchant, acquiring bank, network, issuing bank). Charges MDR to Merchant, pays Interchange card networks.

Acquiring_Bank

Me2Me payments involve a person or entity transferring funds between two accounts that they own.

Me2Me

Wallet defunding refers to the process of moving money from digital wallets back to bank accounts.

Wallet_Defunding

A descriptive reference used to define a range of accounts not held in Cross River. The prefix then is tied to a partners FBO account.

external_account_prefix

Three-Domain Secure is a security protocol designed to enhance the security of online credit and debit card transactions, helping to prevent fraud and unauthorized use.

Primary Account Number. A unique identifier, typically 14 to 19 digits, found on credit, debit, and other payment cards that indicates the card issuer and the individual cardholder.

SAS Anti-Money Laundering. This system helps institutions detect and prevent illicit activity while maintaining regulatory compliance, using advanced detection, AI, and machine learning to strengthen monitoring and protect against financial crime.

SAS_AML

ClaveBancaria Estandarizada is a standardized banking code used in Mexico to identify bank accounts. It consists of 18 digits that include the bank code, branch location, and account number. 

CLABE

Accounting for Financial Liabilities. Refers to receipts or payments from personal non-resident bank accounts. Helps financial institutions identify the nature of the transactions being processed, ensuring accurate reporting and compliance.

Accounting for Financial Assets. Refers to receipts or payments from personal resident bank accounts or deposits. Helps financial institutions identify the nature of the transactions being processed, ensuring accurate reporting and compliance.


Customer Identification File. A digital record that contains comprehensive details about a bank’s customers. It serves as a centralized repository for essential information related to an individual's banking relationship.

Fair banking is the principle and practice of providing equal and non-discriminatory access to financial services, ensuring that decisions by banks are based on objective risk rather than political, religious, or ideological affiliations.

Fair_Banking

Fair_Lending

Account Funding Transaction.  Pull funds from a debit card for specific purposes. Use an AFT to fund a wallet or prepaid card, or to initiate a person-to-person (P2P) transfer through the card network rails. AFTs are not allowed for purchases.

A 32-character hexadecimal string with hyphens, such as 123e4567-e89b-12d3-a456-426655440000 used as a unique identified. Sometimes called a UUID.

GUID

Know Your Business processes verify legitimacy business entities and their ownership structures to prevent financial crime and comply with regulations. KYB requires information including company registrations and operational activities. See also KYC.

Know Your Customer processes verify the identity of an individual customer to prevent financial crime and comply with regulations. KYC uses personal details and identity documents for this verification.

A GUID assigned to you by Cross River. This ID is required for some API calls.

Partner_ID

The automated lending platform from Cross River that includes services such as Preapproval, Oversight, Arix Origination and Funding, Selling, and Hooks.

Lending

Information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual. Also known as PII.

Personally_Identifiable_Information

These are contracts for monetary assets that can be purchased, traded, created, modified, or settled for. In terms of contracts, there is a contractual obligation between involved parties during a financial instrument transaction.

financial_instrument

Interest Rate Cards are pre-configured interest rate profiles that can be assigned to specific accounts on demand.

rate_card

A financial institution holding a principal license with a Card Network has the right to issue cards itself and sponsor other institutions (fintechs) to issue on its behalf (BIN sponsorship). Affiliate/Associate members cannot offer BIN sponsorship.

Principal_member

A 6 or 8 digit number assigned by the card networks for card issuing and functions as the first 6 or 8 digits on the card itself. The BIN identifies the bank that is responsible for issuing the program and handling daily settlement with the Network.

Card_BIN

A solution that allows partners to offer card solutions without requiring a direct relationship with the card networks. The bank acts as an intermediary while allowing partners to use its bank identification numbers (BIN). 

BIN_sponsorship

Politically Exposed Person is an individual who holds a prominent public position, or has done so in the recent past and is subject to a higher level of scrutiny due to an increased risk of involvement in bribery, corruption, and money laundering.

Office of Foreign Assets Control. Part of the US Department of the Treasury that administers and enforces economic and trade sanctions based on US foreign policy and national security goals.

OFAC

Move funds internally between accounts. The transfer requires both a debit and credit account and can be either a master account or sub-ledger, or any combination of the two.  Can be made via API calls or for non-API Partners on the COS Explorer.

book_transfer

This is where the financial institution verifies the member has the funds needed before they are transferred to the receiver.

Good_Funds_Model

An instant payment service developed and operated by the Federal Reserve for financial institutions in the United States, which allows individuals and businesses to send and receive money.

FedNow

A payment processing network used to send money electronically between banks in the US. Available year round, it transfers funds between 2 banks account instantaneously. Processes on bank holidays and weekend and after business hours.

A merchant category code (MCC) is a four-digit number used for retail financial services to classify a business by the types of goods or services it provides. Codes are specified by the ISO 18245 standard.

Card Acceptor ID. An internal identifier assigned to your business by your Acquirer when creating the merchant account used for financial processing.

CAID

Business Application Identifier, used by merchants in card payments

The automated loan validation and funding software from Cross River

Arix

Mobile Deposit Capture is the process of submitting a check electronically using a smartphone

Input Message Accountability Data. A unique number given to each FedWire payment when using the Federal Reserver Bank Service and can be used to investigate and track wire transfers.

IMAD

Notification of Change.  The purpose of an NOC is to identify and communicate incorrect information within an ACH entry, such as account numbers or transit and routing number. Sent by a RDFI to the ODFI and the Originator via their ACH Operator.

A global financial messaging standard for electronic payments. It enhances interoperability across financial systems, improves payment processing efficiency and supports compliance by providing detailed transaction information.

ISO20022

A SWIFT Code is a standard format of Bank Identifier Code (BIC) used to specify a particular bank or branch. These codes are used when transferring money between banks, particularly for international wire transfers.

SWIFT

Receiving Depository Financial Institution. All ODFIs must also agree to act as an RDFI to receive ACH payments. An RDFI receives entries directly or indirectly from its ACH Operator for debit or credit to the accounts of its customers.

RDFI

Originating Depository Financial Institution. It has the authority to initiate ACH transactions on behalf of its customers. ODFIs ensure compliance with regulatory standards and securely transmit payment instructions to the ACH network

ODFI

 National Automated Clearing House Association. Nacha governs the ACH Network, the payment system that drives Direct Deposits and Direct Payments with the capability to reach all U.S. bank and credit union accounts

Nacha

International ACH Transaction. A Nacha SEC code.

A uniquely configured financial product you offer your customers. For example, a debit card or a savings account, configured according to your needs and specifications, are product types.

product_type

Bank Identification Number. A unique identifier used in payment card transactions.

A Demand Deposit Account (DDA) is a bank account that allows you to access your funds on demand.

COS_Explorer

relationshipmanager

Cross River guides provide details about our products

guide

var_miha

new_var_2

new_mih_var

mih_var

This is a plain text that will be inserted in an expandable heading for using this raw as an exampl

testheight

available

testulet

testvar

altscenario

This is a plain text that will be inserted in an expandable heading for using this raw as an example