Tokenized Payment Volume Has Surpassed Physical Cards
As digital tokens become the industry standard, merchants must adapt to new security and operational mandates.
Updated on Oct. 14, 2026 in Financial Services
Live Poll
Do you trust the shift toward fully tokenized digital payments for your personal transactions?
Tokenization has moved from a security enhancement to the dominant method for processing digital payments, with Visa now managing three times as many tokens as physical cards. This shift serves as the foundation for emerging AI-powered commerce, impacting how businesses process transactions globally.
Why it matters
Tokenized transactions offer higher approval rates and lower fraud, making them essential for competitive digital operations. However, this transition forces businesses to navigate tightening regulatory frameworks regarding payment infrastructure and digital resilience.
Mastercard reports that 3 in 5 European e-commerce transactions are now tokenized, with a goal of reaching 100 percent by 2030. Meanwhile, Giesecke+Devrient Netcetera manages more than 1.4 billion payment tokens globally.
The players
Mastercard
A global payment technology corporation that processes transactions and sets infrastructure standards for card-based commerce.
Visa
A global digital payments company that provides the underlying infrastructure for consumer and business card transactions.
Giesecke+Devrient Netcetera
A technology provider specializing in secure software solutions and payment token management for financial institutions.
American Express
A diversified global financial services firm that issues payment cards and develops proprietary commerce technology.
The details
Tokenization works by replacing sensitive card numbers with digital tokens that remain specific to a device or merchant, reducing fraud and streamlining checkout processes. Banks and issuers are now responsible for provisioning and managing these tokens across their lifecycles to comply with evolving standards like DORA. This infrastructure has become necessary for agentic transactions and AI-driven checkout experiences where automation requires a high-security digital surrogate for payment data.
Timeline
January 2025: DORA digital operational resilience requirements began.
April 2026: American Express released a developer kit for AI-powered commerce.
April 2026: Council of the European Union published final PSD3 and Payment Services Regulation texts.
2030: Target date for Mastercard to reach 100 percent European e-commerce tokenization.
Market Landscape
The transition to universal tokenization aligns with the digital security requirements set by the Digital Operational Resilience Act (DORA). This shift marks a departure from traditional card-based processing towards a strictly managed, agentic digital payment environment.
Businesses should review their payment provider's readiness for upcoming PSD3 and Payment Services Regulation requirements. Operators must also ensure their technical stack supports AI-ready tokenized flows to maintain current fraud and approval rate benchmarks.
The takeaway
Tokenization is now the technical foundation for modern digital commerce and AI-led transactions. Operators should audit their current payment processing architecture to ensure compatibility with these security standards ahead of further EU regulatory updates.
Further reading
For more on the changing infrastructure of global payments, see our latest coverage on Financial Services.
Source note: This article includes information reported by SecurityWorldMarket.
Live Poll
Do you trust the shift toward fully tokenized digital payments for your personal transactions?
