Can tokens be moved when a PSP changes processor?
It depends on the token. Vault tokens belong to the provider that created them, so changing processor requires a secure migration of the underlying card numbers between PCI-compliant parties. Network tokens are bound to the token requestor, not to the acquirer, so a PSP that holds them can keep using them with a new processor. Multi-acquiring depends on this.
In detail
Whether tokens can be moved depends on who created them and who holds the card numbers behind them.
Vault tokens
A vault token only has meaning inside the vault that issued it. When a PSP or merchant changes processor, the old provider must export the card numbers, encrypted, to the new provider’s PCI-compliant vault. The new vault then issues new tokens and a mapping file links old and new values. This migration needs the old provider’s cooperation and a clear contract clause.
Network tokens
A network token is bound to the token requestor, such as a PSP or a platform. If that requestor changes acquirer, it can keep sending the same tokens, because the scheme detokenizes them before the issuer. If the processor was the token requestor, the tokens stay with the processor.
Good practice
- Check token ownership in every processor contract.
- Keep a vault you control, or be the token requestor yourself.
See why migrating tokens doesn’t have to be complicated and What Is Tokenization?.