A Payments Primer: Tokens as a Control-Point for Transaction-Routing

Print Friendly
Share on LinkedIn0Tweet about this on Twitter0Share on Facebook0


Howard Mason



March 11, 2016

A Payments Primer: Tokens as a Control-Point for Transaction-Routing

  • Payment tokens have an important economic impact as a control point for how payments transactions are “routed” for processing with important implications for Visa and MasterCard as they manage the risk of disintermediation. This is in addition to the more advertised function of tokens to improve security by acting as a proxy for a checking or credit-line account numbers (in the same way that a subway token acts as a proxy for legal tender).
  • In credit, Visa tokens, which appear as a 16-digit number embossed on the front of a Visa-branded card, support only payments-routing over the Visa network and, since Feb 2013 for cards issued by JPM, over the ChaseNet network. Merchants have no other choices so that Visa is able to charge approximately a dime for processing each transaction when other infrastructures could be made available, from ACIW for example, at a cost of fractions of a penny. In debit, Visa’s insistence that its tokens support only its network was broken by Durbin which allows retailers to route transactions over any available infrastructure.
  • The significance of mobile payments is that merchants integrating payments into own-brand apps can interpose their own token between point-of-sale and the Visa network and thereby gain greater routing flexibility. Indeed, the provision of white-label tokens to merchant apps is a core element of PayPal’s value proposition.
  • If a customer insists on paying with a Visa-branded card, a merchant token is mapped to the Visa network. However, if a customer agrees to an alternative payment tender (such as a private-label card or decoupled debit over, say, the ACH network) the token is mapped differently; customers paying with the app then do not need to clutter their wallets with private-label cards from different stores (as is presently the case for private-label solutions such as Target RED).
  • Of course, there is the potential for app-clutter but we expect this to be resolved over the next few years as retailers deploy beacon technology capable of waking merchant apps and popping them to the phone home screen when a customer is in-store.
  • The bigger picture is that, as merchants integrate payments into their apps, it is they rather than banks which become the key distribution channel for tokens. Given Visa and MasterCard have traditionally competed by locking up bank distributors, through the use of interchange (paid by merchant acquiring banks) and other financial incentives (paid by the network themselves), this represents an important shift in competitive dynamics. MasterCard has been more aggressive than Visa by making its technology available to support the Target RED card program and by providing tokens to the private-label card lenders including C, ADS, and SYF.
  • As a provider of tenderneutral tokens (that can support electronic tenders beyond the branded card networks), PayPal offers merchants greater routing flexibility and hence pricing power with the branded networks. Under PYPL’s new management team, tokens are the tip of the spear as the firm extends its franchise from fixed to mobile internet, and the announcement in February that First Data will distribute PayPal’s tokenized solution is an important milestone. As PayPal tokens are deployed with merchants (whether on a branded basis through the PayPal app or buy button or a white-label basis through unbranded integration into merchant apps), we expect offline merchants to route an increasing proportion of their traffic away from the branded card networks and note approximately one-half of PayPal’s online volumes route to non-network solutions including PayPal Credit, PayPal Wallet (i.e. prepaid), and ACH-debit.


It is an investing trope that businesses defended by a strategic moat can sustain supra-competitive pricing: the only bank-branch on the street-corner, the only print newspaper in town, the only cord between providers of electronic media and households, the only payment “rail” between merchants and customer accounts.

Obviously, IP-enabled technology has parted the waters in the first three cases; this note focuses on the fourth where the market is discounting no interruption in the status quo. How much is that status quo worth? Visa charges a network fee (a nickel for debit and dime for a credit) for clearing and settling[1] transactions between the “issuing” bank representing the cardholder and the “acquiring[2]” bank representing the merchant; commodity-processors, such as ACIW, can process or “route” these transactions for fractions of a penny.

In Visa’s case, the strategic “moat” is its control over payment tokens. Taking the form of the 16-digit number on the front of your bankcard, these tokens represent the number of the underlying checking account (on a debit card) or pre-approved line of credit (on a credit card). The advertised role of tokens is to improve security: if your Visa payment card is lost and stolen, your bank can issue a new one (with a different Visa token) without changing the number of the underlying payment account.

However, tokens have another impact on economics in that they restrict the routing choices of merchants so as to put Visa in a monopoly position for network processing. Specifically, if a customer uses a Visa-branded credit card (and hence a Visa credit token since this token is embossed on the front of the card), the acquired transaction must be processed over the Visa network. The single exception is that, as of February 2013, JPM is allowed to process transactions acquired on JPM-issued Visa cards over its proprietary ChaseNet network. The situation is different in debit since, as of October 2011, the Durbin Amendment allows merchants to route transactions acquired on a Visa debit token over any available infrastructure. The result of Durbin is that it now makes sense for third-parties to invest in debit-processing infrastructures as can be seen from the bank investment in clearXchange (whose first use-case is person-to-person payments but which will almost surely be extended to support point-of-sale debit) and investment by FIS in PayNet (a version of which will support the CurrentC-branded mobile payments initiative of the Merchant Customer Exchange or MCX).

Durbin dilutes the economic value of Visa tokens in debit by releasing merchants from the associated mandatory routing rules. IP-technology has the potential for a more dramatic shifting of the payments value-chain by displacing Visa tokens altogether. To understand, it is worth pausing to compare the “old” world where tokens representing card credentials are stored on a magnetic strip and accessed visa a plastic card distributed by a bank and the “new” world where tokens representing card credentials are stored on a phone chip (or in the cloud) and accessed via a mobile app distributed by a merchant.

In the old world, banks are the distribution channel for payment tokens, and the close relationship between banks on the one hand and Visa and MasterCard on the other gave these two networks near-duopoly status. Indeed, prior to 2003, banks working with Visa and MasterCard were not allowed (under the exclusionary rules) to distribute the tokens of competing networks such as AXP and DFS. Visa and MasterCard competed with each other, as they do today, to distribute tokens through banks by offering meaningful financial incentives. Banks that signed up with Visa put Visa-issued tokens in the hands of their customers by embossing on the front of the Visa-branded cardholders issued to these customers. If the cardholder then used that Visa-branded card to make a purchase, Visa was guaranteed the processing business (prior to Durbin in debit and the ChaseNet deal in credit).

In the new world, app-providers are the distribution channel for payment tokens and they may or may not work closely with Visa. Apple, of course, did and the launch of Apple Pay and then Android Pay was highly significant for Visa and MasterCard because the implementations were founded on the use of the Europay-MasterCard-Visa (EMV) standard for dynamic, digital tokens. Like the static tokens on the front of a plastic card, digital tokens are 16-digit numbers representing underlying payment accounts; however, unlike static tokens, they leverage the processing power of a mobile-phone (along with quite sophisticated encryption technology) to change dynamically from transaction-to-transaction so as to become less valuable to a thief. If Apple Pay and Android Pay were the end of the story, then Visa would have succeeded in porting its token leadership and hence pricing power from the old world to the new world and this note would be making a moot point.

However, Apple Pay and Android Pay are not the end of the story. From the Target RED card program to Walmart Pay, to say nothing of MCX itself, merchants are looking to embed payments capability in their own apps and using the services of PayPal’s Braintree and Stripe (in which Visa has a $5mm strategic investment) to achieve this. In embedding payments capability in their apps, merchants are driven less by the direct impact on payment economics (such as the potential to reduce card acceptance costs) and more by the desire to improve app-utility for shoppers; this is part of a broader strategy to compete with AMZN by encouraging customers to use apps so as to combine the convenience of a digital experience with the immediacy of a store experience. Shopper use of merchant apps also generates valuable transaction data that, unlike for a typical Visa card payment, can be linked to the identity of the shopper and so used more effectively by merchants for improved fraud risk management and targeted marketing.

There is an important convenience advantage to shoppers in the use of merchant apps for payment which is not present for Apple Pay or Android Pay. Specifically, payments are not broken (given how easy it is to swipe a plastic card) but checkout is cumbersome. A shopper looking to pay with a Visa card, earn loyalty points, redeem coupons, and get a credit for a returned item may have to produce four different pieces of plastic or paper. Embedding payments into a merchant app (including the CurrentC app) allows these four processes to be integrated into a single phone-based transaction. The Starbucks mobile app, accounting for near 20% of tender at Starbucks stores, provides an example of the potential for engaging customers through pay-and-save mobile apps in a way that improves the customer checkout and loyalty, as opposed to merely payment, experience over a plastic card-swipe.

While the primary motivation among merchants may be to migrate customers to payments-enabled apps to improve customer engagement and convenience, this shift offers an opportunity to shape customer choice of payment tender and hence lower card acceptance costs. PYPL’s model for fixed-internet provides an illustration: PYPL introduced the eponymous buy button in 2001 to provide a convenience benefit to shoppers who could use the button as an alternative to entering in Visa card credentials at each merchant web-site they transacted with. Having branded the consumer payments experience, PYPL then began to integrate back into payments processing through, for example, the acquisition of Bill-Me-Later (now branded PayPal Credit) as alternatives to the branded card networks. Today, nearly 50% of PayPal volumes are routed away from the branded card networks via PayPal Credit, PayPal Wallet, and direct-to-account (ACH-enabled) debit.

We expect merchant apps to broaden funding choices beyond the network brands in the same way even if, initially and as in the case of the Starbuck app and Apple Pay, they exclusively offer network-branded payments. Mass-affluent consumers who like the rewards on their Visa cards can keep them since wallets will tend to be “open” in the sense of supporting the network brands as well as alternatives. This is a significant difference today between Walmart Pay, which supports Visa credit, and CurrentC which has indicated that it will support Visa debit but not Visa credit; in practice, we expect CurrentC to open its wallet to Visa credit so as not to drive Visa-loyal consumers to alternative mobile payment solutions. However, once a consumer has become accustomed to using a merchant app for payment, because of the convenience benefits, the merchant has the opportunity to offer alternative tender-choices including private-label credit and debit.

Both Target, through its RED program, and Starbucks, through My Starbucks Rewards or “MSR”, have demonstrated that it is possible to switch meaningful volumes, ~20-30% of tender in the above two examples, to private-label tender from network-branded cards. A fairly common concern among investors is that these are special cases – Target because it offers a 5% discount for RED card users which, if copied by other retailers, would lead to a race-to-the-bottom on margins and Starbucks because the high visit-frequency of customers justifies the allocation of screen real-estate to the Starbucks app. Finally, investors are skeptical that merchants have the technological capabilities to compete with Apple Pay and Android Pay particularly given sensitivity about keeping payment credentials secure. We address each of these issues – customer incentives, app-clutter, and secure implementation – below.

Customer Incentives

Each year, issuing banks representing cardholders on the Visa and MasterCard networks receive ~$60bn from acquiring banks representing merchants on the networks; these “interchange” payments are ultimately funded by merchants and largely used by issuing banks to fund rewards to cardholders. In other words, merchants are paying banks to provide bank-branded rewards to their shared customers.

Merchants have three natural objections to this set-up. First, they would prefer to set the level of rewards rather than face a situation where if they do not agree to Visa interchange and so refuse to accept Visa cards, they risk losing business from customers who prefer the Visa brand and particularly those who need pre-approved access to a line-of-credit. Second, since they are funding the rewards, merchants would rather the rewards be associated with their brands and not with a bank brand. Third, merchants want to reward customers for shopping not for use of a bank payment product; in other words, merchants want rewards to be tender-neutral; it is for this reason that Target customers receive the same 5% discount whether they use a Target RED credit card or a Target RED debit card.

The challenge, of course, is that banks have succeeded in generating attractive rewards currencies. For example, users of a Chase-United Airlines card can aggregate spending across all merchants and focus rewards on accumulating the miles-rewards necessary for an annual vacation. In similar fashion, the “membership rewards” program of AXP offers a broad array of rewards-redemption choices that could not easily be assembled by any individual merchant or even, at this stage, by a loyalty-coalition of merchants such as Loyalty One – and AXP is moving anyway to pre-empt this sort of initiative in the US through launching its own loyalty coalition, Plenti, which generates rewards to shoppers independently of whether they use an Amex card. For some merchants, customers visit frequently enough that merchant-specific rewards are attractive; Starbucks “STARS” are an example although, even there, CEO Howard Schultz has talked about expanding the redemption options for STARS so that they can be exchanged for goods outside SBUX stores.

That said, private-label credit cards are gaining share from network-branded alternatives in part because of merchant-specific rewards (Chart 1) such as enrolment discounts when a shopper registers for a card and on-going loyalty discounts when a shopper uses the card. In practice, we believe that merchants will become more effective at winning share for private-label credit cards (PLCC) from general-purpose credit cards (GPCC) as they use the data generated from the payments process to target coupons based on purchase behavior rather than offering one-size-fits-all discounts. The transition to mobile payments is an important catalyst for this since the process of offering and redeeming coupons can be integrated into the main payments stream thereby removing current frictions (that coupons cannot be offered in real-time at “point-of-interest” and often require a consumer to keep a paper record for redemption).

Chart 1: Private-Label Credit Cards (PLCC) are Gaining Share of Receivable

Indeed, the CurrentC app from the merchant customer exchange is explicitly designed to reduce the checkout friction associated with coupons. Furthermore, CurrentC has partnered with coupon-provider Inmar to allow consumers to clip and redeem manufacturer coupons digitally within the app. Beyond the value to consumers (that, otherwise, cannot obtain coupons from Walmart, for example, given its strategy of everyday low pricing), the move is significant for manufacturers since it will allow them to improve the efficiency of trade-spend (i.e. funds that are made available to retailers, including through manufacturers’ coupons, to support their brands). Trade-spend currently amounts to ~$200bn/year in the US (and so is meaningfully larger than the US$60bn of interchange funding bank rewards) but is notoriously inefficient; this is because manufacturers are typically sent information from point-of-sale (POS) systems when a promoted product is sold but this is unaccompanied by details of the shopper; the result is that manufacturers do not know whether the coupon stimulated a sale from a new customer or represented a windfall discount to an existing customer. The digital integration of manufacturers’ coupon into CurrentC changes that because the consumers register to the app and therefore give up their personally-identifying information or PII. We expect manufacturer access to PII along with POS-scans for promoted product to meaningfully improve the efficiency of trade-spend. As a result, those retailers that are able to generate these data from their apps will attract a higher share of trade-spend and likely engage a positive flywheel effect where improved marketing efficiency leads to higher marketing dollars in turn driving more traffic and improving efficiency. The targeting of trade-spend is the underlying catalyst and likely explains the comment of PayPal CEO Dan Schulman, in reference to the competitive dynamics of payments and retailing, that “data is the weapon”.


A key reason for the success of the Starbucks app is that loyal customers visit daily or multiple times in a day so that the use of real-estate on a phone screen makes sense. An investor concern about the potential for consumer use of merchant apps, and hence increasing merchant control of payments, is app-clutter. In practice, we expect app-clutter will become a less binding constraint on the number of apps that consumers engage with as retailers roll out beacon technology. Beacons are low-power radios that can digitally engage with consumer smart phones and hence, through a merchant app, provide consumers with a digital experience while they are in-store.

We expect beacons to be able to wake-up a merchant app when a consumer enters a store, pop it to the home screen, provide a greeting and any update on store news, and then support consumers through the shopping experience by tracking their location more precisely than is possible with GPS. After an initial permissioning, therefore, the consumer will not need to manage the app or have it take up space on the home-screen. Indeed, retailers may upload “dark apps” operating in much the same way as cookies on a browser in that they will not interact directly with the consumer but rather track consumer activity, and in particular travel-path through the store, so as to provide operational intelligence.

Secure Implementation

The cornerstone of security for mobile payments is tokens and, after its adoption by Apple Pay and Android Pay, the EMV protocol established by the major branded card networks is well-positioned to emerge as an industry standard. However, retailers are leery of adopting this standard for payments integration in their own apps out of concern that they will simply end up facing the same Visa-MasterCard duopoly for tokens in mobile payments as they have faced in card-based payments. Jamie Henry, payments director at WMT, made the point unequivocally “the existing rules that are in place for card-based payments are not going to be acceptable for mobile-based payments”.

Retailers are therefore turning to third-party solutions with PayPal’s token solution, acquired with the purchase of Paydiant in March 2015. Indeed, PayPal has built out its capabilities – through the acquisitions of Braintree in September 2013 and Modest in August 2015 – so as to provide a turnkey solution for merchants looking to a third-party to develop a merchant app with payments integration. There are other providers who can support merchants in the app-integration of payments, most notably Stripe (in which Visa has a $5mm strategic investment) but PayPal is increasing bundling this capability (the core competence of Braintree) with other app-development services and, of course, PayPal unlike Stripe has an important consumer franchise with 180mm active users of the eponymous wallet along with the Venmo and Xoom consumer payment franchises.

©2016, SSR LLC, 1055 Washington Blvd, Stamford, CT 06901. All rights reserved. The information contained in this report has been obtained from sources believed to be reliable, and its accuracy and completeness is not guaranteed. No representation or warranty, express or implied, is made as to the fairness, accuracy, completeness or correctness of the information and opinions contained herein.  The views and other information provided are subject to change without notice.  This report is issued without regard to the specific investment objectives, financial situation or particular needs of any specific recipient and is not construed as a solicitation or an offer to buy or sell any securities or related financial instruments. Past performance is not necessarily a guide to future results. The analyst principally responsible for the preparation of this research or a member of the analyst’s household holds a long equity position in the following stocks: JPM, BAC, WFC, and GS.

  1. Clearing involves the exchange of non-monetary information about a transaction; settling involves an exchange of value.
  2. Here “acquiring” is a term-of-art. From the standpoint of the Visa ecosystem, a transaction is originated or “acquired” by the bank representing the merchant.
Print Friendly