• Doug Yeager

    this is an impossible statement, or at least implies the wrong thing:
    “NFC World understands that the updated cloud-based payment specification also makes provision for issuers to use a third-party token service provider (TSP) or their own in-house tokenisation solution.”

    because visa is requiring this:
    Tokenization is also based on a 16-digit number but the BIN needs to be from a specific allocated token BIN range, supplied on request “by the card scheme”.
    (issuer cannot supply their own token BIN anymore…that seems problematic for the issuer to negotiate with an alternative path)

    that would force the visa TSP to be used in some way (even if they let the bank ultimately do the PAN lookup service, but Visa is keeping a record of this)

    wonder if the SEC will get involved. this could really hurt vendors of TSP systems like BellID (Rambus) and Sequent amongst others.

    there is no technical advantage to this decision (or mandate).