Reference

Payment Certification Levels

A practical guide to EMVCo L1 / L2 / L3 terminal certifications, PCI DSS merchant compliance tiers, and the standards that govern every card-present transaction.

EMV Payment Tokenization

Replaces the cardholder's real card number (FPAN — Funding PAN) with a surrogate token (DPAN — Device/Digital PAN) of the same length and format. The DPAN is domain-restricted and can only be used with the specific device, wallet, or merchant it was issued for. Defined in EMVCo Payment Tokenization Specification.

FPAN vs DPAN

FPAN — Funding PAN

Real PAN embossed on the physical card. If stolen, it can be used anywhere the card is accepted. Changing it requires physical card reissuance and disrupts all active subscriptions.

DPAN — Device/Digital PAN

Token generated by the Token Service Provider (TSP). Same 16-digit length, passes Luhn check. Domain-restricted: locked to a specific device, merchant, or use case. Compromise means deactivate that token only — FPAN is unaffected.

Token Ecosystem Players

Cardholder

Owns the real card. Initiates provisioning by adding card to wallet or consenting to token issuance.

Token Requestor (TR)

Merchant, wallet app, or payment facilitator that requests the token. Each TR receives a unique Token Requestor ID (TRID) from the scheme.

Token Service Provider (TSP)

Generates and manages tokens. Acts as trusted intermediary between the TR and issuer. Maintains the FPAN-to-DPAN mapping vault.

Card Issuer

Approves token provisioning, controls Token Assurance Level requirements, and receives the DPAN in authorization messages (de-tokenizes internally).

Payment Network

Visa (VTS), Mastercard (MDES), Amex (AEIPS) operate the TSP function for their respective scheme.

Major Token Services

Visa Token Service (VTS)

Token BIN starts with 4. Supports push and pull provisioning. Powers Apple Pay, Google Pay, Samsung Pay for Visa cards. Token validation via TAVV cryptogram.

Mastercard MDES

Token BIN may differ from FPAN BIN (separate BIN range). Uses DSRP cryptogram for CNP tokenized transactions. Full EMV-like cryptogram from device secure element.

Amex AEIPS

15-digit tokens matching Amex PAN length. Manages provisioning for Amex cards in Apple Pay and Google Pay. CAVV equivalent for e-commerce tokenized flows.

Token Lifecycle

1
ProvisioningTR submits FPAN + PAN data to TSP. TSP validates with issuer. Issuer approves. TSP generates DPAN + limited-use cryptographic keys.
2
Identity VerificationCardholder verifies ownership via OTP/SMS, in-app push, biometric, or call center. Sets Token Assurance Level (TAL 00–99).
3
ActiveDPAN ready for use. Each transaction: device generates cryptogram (TAVV/DSRP) from limited-use key + transaction data.
4
SuspendTSP or issuer temporarily blocks token (lost device report, fraud flag). No new transactions. Token remains in system.
5
ResumeTSP or issuer re-enables a suspended token. May require re-verification of identity.
6
DeletePermanent deactivation. Triggered by device factory reset, card replacement, explicit cardholder request, or inactivity.

Transaction Cryptograms

Cryptogram
Scheme
What it is
Transmitted in
TAVV
Visa
Derived from FPAN + limited-use key + transaction data. Replaces CAVV for tokenized transactions.
DE55 (chip) or 3DS authenticationValue (e-commerce)
DSRP
Mastercard
Full EMV-like cryptogram (AAC/TC) derived inside device secure element. Proves device possession.
DE55 tag 9F26 (ARQC equivalent)
AAV
Mastercard 3DS 1.0
Legacy Accountholder Authentication Value; replaced by DSRP for token flows.
DE55 / 3DS authenticationValue
CAVV
Amex
Amex equivalent for token-backed e-commerce authentication value.
3DS authenticationValue

Push vs Pull Provisioning

Push (Issuer-Initiated)

Bank pushes eligible cards to the customer's wallet app automatically. Customer sees the card in wallet after login without manual entry. Requires deep bank-wallet integration. Common in banking apps.

Pull (Consumer-Initiated)

Customer manually photographs card or enters PAN in wallet app. TSP validates identity via OTP or call center. No prior bank-wallet integration needed. Common for adding cards to Apple Pay / Google Pay.

Token Assurance Level (TAL)

TAL Range
Verification Method
00
No cardholder verification performed
01–09
Basic verification (card number validation only)
10–19
Issuer or TSP-managed verification — OTP, call center, knowledge-based
20–29
Biometric verification — fingerprint or face ID
30+
Hardware-bound cryptographic verification (eSE / eUICC)

Related Tools

Use these tools to work with the cryptographic primitives that underpin terminal and card security.

🗝️ DUKPT Key Derivation🔢 PIN Block Encoder🧮 ARQC Calculator🔓 EMV TLV Decoder🏷️ MAC Calculator🔐 DES / 3DES Calculator