---
title: "Tokenization"
url: "https://mahouse.world/glossary/tokenization"
type: "glossary term"
topic: "Payments"
author: "Ihor Vlasov"
reviewed: "2026-09-20"
published: "2026-08-06"
---

# Tokenization

Tokenization has two meanings that share a word and a principle. In payments it is replacing sensitive data — a card number above all — with a substitute value, the token, that is useless outside the system that issued it, so merchants and wallets can store and use the token while the real number stays in a vault. In capital markets it is representing an asset — a fund share, a bond — as a token on a blockchain.

**Also known as:** Tokenisation, Payment tokenization, Network tokens, Asset tokenisation, Tokenised assets

## Key facts

- **Used at (payments):** card-on-file storage, mobile wallets (Apple Pay and Google Pay hold network tokens, not card numbers), subscriptions and recurring billing, one-click checkout, and every merchant's PCI scope reduction; (assets): tokenised money-market funds (BlackRock's BUIDL, Franklin Templeton's fund, over $5 billion by 2025), tokenised bonds and deposits, private-credit and real-estate tokens, and the collateral of DeFi
- **Binding (payments):** PCI DSS — tokenised card data outside the vault is out of scope; EMVCo's payment-tokenisation specification; the schemes' rules on token requestors and lifecycle; (assets): securities law applies to a tokenised security exactly as to the security, MiCA to tokens that are not securities, and pilot regimes (the EU DLT Pilot Regime, the UK's Digital Securities Sandbox) allow tokenised trading and settlement infrastructure with modified rules
- **Typical mechanics (payments):** the merchant or wallet requests a token from the scheme or a token-service provider; the real number is stored in the vault; the token is bound to the requestor and often to a device or domain; transactions carry the token, the scheme maps it back at authorisation; lifecycle events (card reissued, expired) update the token without the merchant's involvement, which raises authorisation rates by several points; (assets): a smart contract issues tokens representing the asset, with transfer restrictions for eligibility, and a legal structure that makes the token the record of ownership or a claim on the custodian holding it
- **Typical benefits:** (payments) PCI scope and breach exposure reduced, authorisation rates up 2–5 points from lifecycle management, fraud down through domain and device binding; (assets) settlement in minutes rather than days, fractional ownership, programmable distributions and compliance, 24-hour transferability, and, for funds, on-chain cash for on-chain collateral
- **Parties:** (payments) the schemes as token service providers, processors and gateways, wallets, merchants, and PCI assessors; (assets) issuers, asset managers and banks running tokenisation programmes, custodians, the blockchain platforms, the regulators, and the market infrastructures (DTCC, Euroclear, SIX) building tokenised settlement

## How tokenization works in practice

Payments: a customer saves a card at a merchant. The merchant's gateway requests a network token from the scheme; the scheme vaults the card number, issues a token bound to that merchant, and returns it with a cryptogram scheme. The merchant stores the token; its systems never hold the real number, and its PCI scope shrinks from the whole platform to the gateway integration. When the customer's card is reissued after fraud elsewhere, the scheme updates the token's mapping; the merchant's next charge succeeds without the customer re-entering anything — the two to five points of authorisation-rate gain that made network tokens standard for subscriptions. A stolen token is useless to anyone but that merchant. Apple Pay works the same way: the phone holds a device-bound token, and the card number was never on it.

Assets: an asset manager tokenises a money-market fund. A smart contract on a public or permissioned chain issues one token per share; investors are whitelisted after KYC; subscriptions are paid in stablecoin and tokens minted; yield accrues daily to token balances; transfers between whitelisted wallets settle in minutes at any hour; redemptions burn tokens and return stablecoin. The fund is the same fund with the same regulation; what changed is that its shares are now on-chain cash that can be posted as collateral, moved between institutions on a weekend, and settled against tokenised securities in a delivery-versus-payment transaction with no intermediary holding either leg. The programmes of 2024–2025 — tokenised treasuries, deposits, repo — are the infrastructure for that, and the pilot regimes are where the legal and operational rules are being set. For a fintech, payment tokenization is a hygiene and conversion tool it should already use; asset tokenization is a product line for those with the licences and a market it should watch. For a buyer, the first is in the technology diligence, the second is a business with securities and crypto-asset regulatory files.

For a payments company, tokenization is the reason its card-on-file business is safer and converts better; for an asset manager or bank, it is the beginning of assets that move like data, under the same rules as before.

## Example

A subscription business with 2 million stored cards migrates from storing card numbers in its own PCI-scoped vault to network tokens. Results in a year: PCI scope reduced from the whole billing platform to one integration, saving €700,000 a year in assessment and controls; involuntary churn from expired and reissued cards down from 4.1% to 2.3% a year because lifecycle updates keep tokens valid — worth €5 million of retained revenue; fraud on stored credentials down 60% through merchant binding; and authorisation rates up 3 points because issuers treat token transactions as lower risk. The migration cost €400,000 and four months. The same year, the company's treasury moves €30 million of operating cash into a tokenised money-market fund, earning yield on balances that settle to its stablecoin accounts in minutes when needed — a smaller change with a similar logic.

## Common mistakes

- Storing real card numbers when network tokens would remove them from scope and raise approval rates.
- Reading a token as secure everywhere; it is bound to its requestor and useless elsewhere by design.
- Confusing the two tokenizations in a plan or a diligence.
- Tokenising an asset without the legal structure that makes the token the ownership record.
- Building asset tokenization without the securities and crypto-asset licences the asset requires.

## Related terms

- [Network Token](https://mahouse.world/glossary/network-token.md)
- [Primary Account Number](https://mahouse.world/glossary/primary-account-number.md)
- [PCI DSS](https://mahouse.world/glossary/pci-dss.md)
- [Blockchain](https://mahouse.world/glossary/blockchain.md)
- [Smart Contract](https://mahouse.world/glossary/smart-contract.md)
- [Stablecoin](https://mahouse.world/glossary/stablecoin.md)

— Ihor Vlasov, M&A FinTech Expert. Last reviewed 2026-09-20. https://mahouse.world/authors/ihor-vlasov