Mastercard is accelerating the move away from traditional card-number-based ecommerce payments and towards network tokenisation across the UK and Europe.

The latest milestone took effect on 1 October 2026, when eligible Mastercard credential-on-file transactions were expected to move to network tokens. This is particularly relevant to subscription businesses, travel companies, marketplaces and other merchants that store customers’ cards for future payments.

However, this should not be interpreted as an immediate shutdown of every non-tokenised payment. Current provider guidance states that Mastercard has not announced that transactions using the underlying card number will automatically be declined. The direction is clear, though: merchants and payment providers need to prepare for a token-first ecommerce environment.

What is a network token?

When a customer saves their card with a merchant, many payment gateways replace the card number with an internal gateway token. The customer’s actual card details are still held in the provider’s secure vault and may be submitted to the card scheme when a future payment is processed.

A network token goes further.

It is issued and maintained by Mastercard and replaces the primary account number throughout the payment process. The token is linked to the customer, card and merchant relationship, making it considerably more difficult to use outside its intended context.

If the customer’s physical card expires or is replaced, Mastercard and the issuing bank can update the underlying credentials without the merchant needing to collect the new card details.

This helps prevent otherwise valid recurring payments from failing simply because a card has expired or been reissued.

Mastercard’s European timetable

Provider guidance currently sets out the following roadmap:

• 1 October 2026: Network tokens for eligible Mastercard credential-on-file transactions.
• April 2028: Expansion to eligible guest-checkout transactions.
• April 2030: Intended network tokenisation of all Mastercard ecommerce transactions in Europe.

There are exceptions where a token cannot be created, no active token is available or the issuer rejects the token request. Certain card-issuing countries are also excluded from the current European mandate.

Mastercard’s wider objective is to reduce dependence on static card numbers and move European ecommerce towards tokenised credentials, Click to Pay and biometric authentication.

What are the benefits for merchants?

Improved recurring-payment continuity

Network tokens are maintained throughout the card lifecycle. A subscription or merchant-initiated payment may therefore continue successfully after the underlying card expires or is replaced.

This can reduce involuntary customer churn and the need to contact customers for updated payment details.

Higher authorisation rates

Issuers receive a credential that has been provisioned and maintained through the card network, providing greater confidence that the payment information is legitimate.

Mastercard reports that tokenised transactions can achieve an approval-rate improvement of between three and six percentage points compared with payments submitted using the underlying card number. Results will vary according to the merchant, issuer, country and transaction type.

Reduced fraud exposure

A network token is restricted to its intended payment environment and cannot generally be reused successfully by another merchant.

For customer-initiated payments, the token can also be supported by a transaction-specific cryptogram, adding another layer of protection against stolen-card use.

Better payment data protection

Replacing card numbers with network tokens reduces the amount of sensitive card information moving through the payment chain. This may reduce elements of a merchant’s PCI DSS scope, although tokenisation does not remove the requirement to maintain PCI DSS compliance.

Will merchants need to make technical changes?

This depends on how the merchant currently stores and processes card credentials.

Merchants using a fully managed gateway or PSP vault may find that network tokens are provisioned and applied automatically. In this situation, little or no integration work may be required.

Merchants using a third-party vault, independently managed card data or multiple payment providers should confirm:

• Whether Mastercard network tokenisation is enabled.
• Whether existing stored cards will be migrated or only new cards tokenised.
• How failed token-provisioning attempts and PAN fallback are handled.
• Whether tokens can be used across different acquirers and processing routes.

These questions are particularly important for merchants using payment orchestration. A tokenisation solution should support intelligent routing and provider resilience without creating a new form of vendor lock-in.

Network tokenisation does not replace other requirements

A network token is a payment credential, not a substitute for the wider stored-card framework.

Merchants must still obtain appropriate customer consent, correctly identify customer-initiated and merchant-initiated transactions, apply Strong Customer Authentication where required and follow the relevant recurring-payment rules.

Mastercard is also introducing separate Transaction Link Identifier requirements for recurring and other economically related payments. From 23 October 2026, applicable subsequent transactions must include the identifier connected to the original customer agreement.

Network tokenisation and transaction linking are separate requirements, but both can apply to the same recurring payment.

What should merchants do now?

Merchants storing Mastercard credentials should ask their gateway, PSP or acquirer to confirm their network-token position in writing.

The most important points are whether tokenisation is active, how existing stored cards are being migrated, whether all acquiring routes are supported and what happens when a token cannot be used.

At Axcess Merchant Services, we help businesses understand how scheme changes affect their payment setup and work with payment providers to improve acceptance, resilience and recurring-payment performance.

If your business stores card details, operates recurring payments or routes transactions across multiple providers, speak to our team to review whether your current payment infrastructure is ready for Mastercard’s token-first roadmap.

Contact the Axcess Merchant Services team now.