What is Merchant vault vs network token?

Two tokenisation models: PSP vaults store PAN cryptographically for one merchant; network tokens are scheme-issued, portable, and auto-updated by issuers.

Merchant vault tokenisation involves a Payment Service Provider (PSP) securely storing a cardholder's original card number within their own systems, issuing a proprietary token unique to that merchant for subsequent transactions.

This token, typically a randomly generated string of characters, replaces the sensitive card data in all merchant-side systems, reducing the merchant's PCI DSS scope as they no longer directly handle the full PAN.

In contrast, network tokens are generated by card schemes (e. g. , Visa Token Service, Mastercard Digital Enablement Service) and are designed to be universally accepted across any merchant or PSP that supports the scheme's tokenisation framework.

These network tokens are dynamically updated by the issuing bank in the event of card reissuance due to expiry or compromise, ensuring continuous payment without merchant intervention.

For merchants, the choice between these tokenisation models impacts data portability and operational overhead. A PSP-vaulted token is specific to that PSP and merchant, meaning a merchant cannot easily migrate customer card details to a different PSP without re-entering the original card number.

Network tokens, however, offer greater flexibility; since they are issued by the schemes, they can often be used across multiple PSPs supporting the scheme's tokenisation.

A common operational pitfall occurs when merchants assume a PSP-vaulted token provides the same level of automatic card lifecycle management as a network token, leading to declines on recurring payments when a card expires or is reissued, requiring the customer to update their details.