Can tokens be moved if an operator changes infrastructure provider?

The underlying card data can be migrated between PCI DSS validated vaults, provided the contract allows it. Operators should check export terms before choosing a vault, since a token that cannot leave its provider recreates the lock-in universal tokenization is meant to remove.

The data can move, if the contract allows

Universal tokens are references; what matters is the card data or network tokens behind them, held in the infrastructure provider's vault. That data can be migrated to another PCI DSS validated vault, under a procedure both parties agree on, as processors migrate card data between them. The condition is contractual: the export terms, fees and notice periods.

What to check before choosing a vault

• The right to export card data and network token references on termination.
• The format and procedure of the export.
• Any fees or minimum notice.
• Whether network tokens can be transferred to a new token requestor, which depends on scheme rules.

Why it matters

Universal tokenization is meant to remove provider lock-in. A vault whose contract forbids export recreates that lock-in one level up. Operators should read the portability clause of the infrastructure agreement with the same attention as that of a processor. NORBr's position is that the data belongs to the operator and can be migrated under the agreed procedure, which operators should confirm in their contract rather than take on trust.