In a payments operations Slack channel, teams are grappling with tokenization strategy, ownership, and the implications of Mastercard's 2030 mandate on their infrastructure. They're not asking about theory; they're asking what happens when they need to change providers, when an agent tries to pay on behalf of a customer, or when they realize they don't control their own payment credentials.
Here's what you need to know.
Can My Current Provider Refuse to Hand Over My Tokens?
Yes, if they own them. This is a central issue many merchants discover too late.
When your PSP generates and stores tokens, they typically retain ownership and control. If you decide to migrate to a different provider, you're often starting from scratch, re-tokenizing every stored payment method, re-enrolling customers, and dealing with authorization declines from presenting new credentials to issuers.
Some PSPs will negotiate token portability, but it's not guaranteed. You're essentially asking for permission to take your own customer payment data with you.
The alternative is universal tokenization, where you own the token vault. You generate and control the tokens, and PSPs connect to your vault rather than managing credentials themselves. In this model, switching providers means updating routing logic, not re-tokenizing your entire customer base.
Consider how much autonomy you want in your payments decisions. That answer tells you how critical token ownership is for your business.
What's the Difference Between Network Tokens and Universal Tokens?
You should use both, and the distinction matters for authorization optimization.
Network tokens come from the card networks (Visa, Mastercard) and are tied to the specific network's ecosystem. They typically increase the likelihood of avoiding soft declines because issuers recognize them as trusted, updated credentials. When the underlying card expires or gets reissued, the network token stays current without merchant intervention.
Universal tokens are PSP-agnostic surrogate values that you control. They act as a common denominator across processors, acquirers, and regions. When paired with an orchestration platform, they let you route the same stored credential to different providers without re-tokenizing.
The early narrative positioned these as competing formats. That was wrong. Network tokens give you authorization lift. Universal tokens give you operational flexibility and portability.
The winning strategy: use universal tokens as your system of record, then dynamically request network tokens when submitting to the networks. This gives you both the authorization benefits and the control you need to pivot processors or optimize routing without losing customer payment data.
Will PANs Disappear by 2030 Due to Mastercard's Tokenization Mandate?
No. PANs aren't disappearing, but their role in the transaction lifecycle is shrinking.
Issuers will still provide PANs to consumers. Credit cards will still be widely used in 2030. But Mastercard has committed to tokenizing all e-commerce transactions by 2030, which means merchants will need the infrastructure to convert PANs to network tokens at the point of transaction.
Digital wallets already present network tokens directly to merchants, and that volume will grow. But you'll still encounter customers who haven't adopted wallets, those on the other side of the digital divide who present a raw PAN at checkout.
The 2030 mandate shifts the conversion responsibility to you. When someone enters a PAN, you need the capability to convert it to a network token before submitting for authorization. This is not just for authorization lift; it's also a PCI compliance strategy. Tokenizing immediately reduces your cardholder data environment scope and limits your exposure to Account Data Compromise risk.
If you're still routing raw PANs in 2029, you're building technical debt.
How Do I Know if an AI Agent Can Use a Customer's Payment Credential?
You don't, yet. This is the trust problem that agentic commerce introduces.
Historically, you verified the consumer and their payment method. Now you need to verify the consumer, the AI agent acting on their behalf, and the permissions governing that relationship. When an agent presents a token to complete a purchase, you're assessing three layers: identity, authorization, and intent.
Tokens can create guardrails here. If you control the token vault, you can attach metadata that defines usage scope, such as which agents are permitted, what transaction types are allowed, spending limits, and expiration windows. Network tokens weren't built with this level of merchant control in mind. They're scheme-persisted credentials where you don't control the usage or relationship.
Universal tokenization gives you an anchor point. You can drop agent-specific rules directly into your ecosystem without re-architecting your entire payment stack. As agentic commerce scales, this becomes your tool for maintaining line of sight to who is transacting and under what authority.
Start building this capability now, even if agent-driven transactions are still a small percentage of your volume. The infrastructure takes time to implement correctly.
Does Token Ownership Matter for Small Businesses?
It matters the moment you need to make a change.
Token ownership usually isn't top of mind when you're launching. Payments services get bundled into your overall cost of doing business, and you're focused on getting transactions processed, not on credential portability.
The issue surfaces when your PSP experiences downtime, when a new payment method or fraud tool launches and your provider doesn't support it, or when you want to add a second processor for redundancy. At that point, you discover whether you have the authority to move your data or whether you need your provider's permission.
If you don't own your tokens, switching providers means re-tokenizing every stored card. That's customer friction, authorization declines, and potential revenue loss during the migration window.
For small businesses with a single PSP and no immediate plans to change, this might be acceptable risk. But if you're scaling, integrating multiple channels, or planning to expand internationally, token ownership directly impacts your negotiating leverage and operational flexibility.
Do Tokens Make It Harder to Detect Fraud?
No, but it changes what you're monitoring.
Tokens replace the PAN, not the transaction metadata. You still have access to billing address, device fingerprint, transaction velocity, order value, shipping destination, and behavioral signals. Your fraud detection models should be built on these contextual factors, not on raw card numbers.
In fact, tokenization can improve fraud detection. Tokens are persistent across card reissuances, which means you can track a customer's transaction history more reliably than with PANs that change when cards expire. You can also apply token-level controls, usage limits, channel restrictions, geographic boundaries, that act as preventive guardrails rather than reactive alerts.
The challenge is ensuring your fraud platform integrates with your token vault and can access the metadata you need. If your fraud vendor and your tokenization provider don't share data effectively, you're creating blind spots.
Where to Go From Here
Token ownership isn't just a technical decision, it's a strategic one that determines how much control you retain over your payment infrastructure as the ecosystem evolves.
If you're evaluating PSPs, ask explicitly: who owns the tokens? Can you port them if you leave? What's the process for retrieving your data?
If you're preparing for agentic commerce, start building the metadata layer that defines agent permissions and usage scope now, before autonomous transactions become a significant volume.
And if you're facing the 2030 mandate, map out your PAN-to-network-token conversion capability. The tactics are changing, but the mission hasn't: protect customers, optimize performance, and maintain line of sight to your payment relationships.
