Inside Visa’s Token Program

Visa’s Digital Enablement Program (VDEP) may have launched just a few weeks ago, but its roots are almost 50 years old.

That’s how Jim McCarthy, Visa’s EVP of Innovation and Strategic Partnerships, views it, anyway.

Forty-seven years ago was when Visa Founder Dee Hock first had the idea for creating a global network for the exchange of value and what would be required to actually bring that vision to life. Two years later, he convinced the Bank of America to license BankAmericard and thereby create the physical infrastructure that could authorize a transaction from a consumer with a network-branded issuer card to a merchant in near real-time on a global basis – and to clear and settle that transaction between the merchant and issuing banks.

But, McCarthy tells MPD CEO Karen Webster in a recent interview, that’s not the most significant thing that Hock did when he created Visa – now the largest payments network on the planet.

The other thing that Hock set in motion at that time, McCarthy asserts, was the creation of the operating rules and business terms that would govern the network of 14,000 banks that would eventually become Visa. That, says McCarthy, “forever changed the commercial relationships that existed between banks and Visa – establishing and formalizing a global network of financial institutions bound by a shared set of rules and standards.”

That, McCarthy says, is precisely what VDEP will do for a world that is still all about exchange value on a global basis, but now using devices connected to the Internet.

And it will do so using tokens.

VDEP, just like the Visa framework put in place now some 45 years ago, eliminates the need for each and every player that would like to enable mobile and digital payments to go through the tedious, costly and time consuming process to create and enter into bilateral agreements with every banking institution to get it done.

“That can get complicated – not to mention time consuming,” says McCarthy. “It just doesn’t scale.”

That’s a lesson Visa and McCarthy learned from the deployment of Apple Pay last fall. Even though Visa’s existing Token Services Program supports Apple Pay, any FI that wants to participate must negotiate their own bi-lateral agreements with Apple.

“What we learned from [the experience with Apple Pay] is that the way that it was being rolled out from a commercial standpoint just didn’t scale,” McCarthy observes.

That’s all different now with VDEP.

For each and every new token requester that wants access to Visa and its 14,000 FI members and their billions of accountholders, McCarthy tells Webster that VDEP provides a consistent, universal framework to leverage. FIs and other payments services providers no longer need to negotiate individual agreements with each other. Not only will that simplify and accelerate mobile and digital commerce for players like Android Pay and Samsung Pay, McCarthy believes, but it will benefit the hundreds of innovators that want to bind payments credentials to any device connected to the Internet – cars, wearables, appliances, clothing, you name it — to solve a problem for a consumer and a merchant.

“Any activity that a consumer engages in online – be it through a platform, an app, a browser – generally leads to commerce of some sort,” and that is what VDEP will now seamlessly enable for Visa’s mobile and digital stakeholders, McCarthy explains.

“The fact that we’ve taken nearly 50 years of innovation into the digital age and applied it in a way that doesn’t add layers of friction to commerce is the magic, here.”

Yet any time that big players, especially payments networks, make big moves, merchants and issuers raise eyebrows and big questions…even if the overall outcome is a positive one that strengthens the relationships issuers and merchants have with their consumers.

One of the biggest questions (and eyebrow raisers) is that four letter word: data. Specifically, FIs, merchants, and mobile and digital stakeholders want to better understand how leveraging the VDEP framework affects who gets access to their customer data, not to mention what the ultimate end game is for network tokenization schemes.

McCarthy states that this was a point Visa was “very cognizant of” in creating VDEP — which, he attests, is only about protecting payments risk for both issuers and merchants.

Explaining that VDEP limits the use of data solely to consumer-facing use cases, he goes on to say that “the only thing a platform can use the data for is to show the consumer up to 10 transactions that have occurred. There is no residual data usage rights. A merchant does not have to worry about a third party capturing data without its knowledge.”

And although Visa possesses “a token vault” that links tokens to the underlying account, McCarthy is unequivocal in saying that the “the relationship is between the consumer with either their merchant or issuer – or, potentially, their [payments] platform.”

“We have no interest in being the purveyors of the digital identity,” McCarthy emphasizes.

Visa’s role, McCarthy states, is to function as it always has: acting as “the switch” that connects stakeholders who are exchanging value over the Visa network. The difference now is that the global payments network is connecting digital platforms back to the underwriter of the risk – the issuer of the Visa-branded account — via a token.

Remarks McCarthy, “that allows [the issuer] to enter into an agreement very easily and share information about how a digital identity may look inside, for example, a social network or a search engine, in order to better protect their payment risk.”

Protection that, McCarthy says, VDEP’s design enables in any number of use cases.

For example, merchants can have any card on file – or an entire database, for larger eCommerce merchants – be replaced with tokens. This effectively domain-restricts the card (or card database) specifically to the merchant and frees it from having to worry about the information being used anywhere else.

Additionally, the token service gives the merchant the ability to choose whether at the point of sale the consumer presents a QR code or an NFC radio signal or a BLE beacon-enabled transaction, because VDEP is agnostic in that respect.

“We knew that for our tokenization services to work,” explains McCarthy, “[they] had to be as simple as possible on the commercial side – so that the technology could do what cool technology can do to enable a great consumer and merchant experience, and business models didn’t have to get in the way.”

A problem McCarthy believes contributes to what he describes as the “balkanization of the mobile space,” resulting from untenable business models that underpin new technology. For digital and mobile payment services to replace plastic cards, McCarthy asserts, the former has to become as ubiquitous as the latter. And that’s where even the greatest technology can fail.

“There was nothing wrong with the technology of Softcard or even Google Wallet V.1,” McCarthy says, “ but the extra steps required of the merchants and the consumers to implement and adopt each of them — as dictated by the business model and commercial terms — compared to the simplicity of using a physical card, rendered them untenable.”

A lesson that McCarthy mentions Visa took onboard after introducing QSR payment capabilities about 10 years ago. Although that breakthrough, made possible by a simple amendment to the operating rules, did ignite card acceptance at places like McDonald’s and Starbucks and Taco Bell, the change was limited to inside the store and only related to card acceptance. The commerce experience wrapped around the transaction remained untouched, unchanged and filled with friction.

McCarthy likens that example to the persistent downside in the era of eCommerce, which remains rife with friction at the point of payment. That persists, says McCarthy, in many ways because the industry has yet to mature in terms of thinking about who’s going to control the commerce experience. Putting the consumer first, and letting what the consumer wants dictate the process – putting an emphasis on digital activity – and linking that back to the bank, is a struggle.

“Where we’ve gotten to” – and it does take time, notes McCarthy – “is that people are starting to mature their thinking. The digital companies don’t want to be banks, and the banks aren’t going to be able to keep pace with all of the changes in technology. It’s the marrying of the two, in support of consumers and merchants and commerce, that I think really opens the door.”

A door that McCarthy and Visa believes VDEP can unlock faster, and more securely for the 14,000 issuers and 2.2 billion cardholders it serves, and the hundreds of other mobile and digital commerce innovators waiting in the wings.