In India, the card number is dying — not because consumers asked it to, but because the Reserve Bank ordered it to. Since the card-on-file tokenization mandate took effect in October 2022, a merchant that wants to store your credentials can no longer keep the sixteen digits; it must hold a network-issued token instead. Visa, which for three years has described tokenization as a strategic priority for its Indian business, has now quietly become the current of record for a meaningful share of the country's digital commerce. That phrase — current of record — is not marketing language. It describes who holds the trusted mapping between a shopper and a merchant. In payments, whoever holds the mapping holds the ledger. The interesting question is not whether Visa supports tokenization. It is whether a compliance mandate got dressed up as a strategy, and what Visa actually bought when it put on the costume.
To understand why this matters, you have to hold two structures in your head at once. There's UPI, India's account-to-account rail run by NPCI, which moves retail payments at zero MDR for person-to-merchant transactions and has effectively captured the small-ticket, high-frequency layer of Indian commerce. And then there's the card network stack — VisaNet, a centralized authorization and clearing system with regional processing nodes and millisecond latency requirements — which owns the larger-ticket, credit and cross-border layer, where acquirer fees run several multiples higher than anything UPI permits.
These two systems do not compete on the same field. UPI owns the account layer: consumer, merchant, bank and PSP all interconnect inside one national network. Cards own the credential layer. When the RBI forced tokenization, it did something subtle to that second layer. It took the card number — a bearer instrument that lived on merchant servers, in spreadsheets, in breach dumps — and replaced it with a network-issued token that a merchant can request but never possess. Merchants and aggregators became "token requestors." The vault stayed with the network.
I spent three months in 2017 manually auditing ICO smart contracts for a niche blog, reading token distribution code line by line, and the lesson I kept returning to is that the vault, not the transaction, is where power sits. Tracing the code back to the conscience sounds poetic until you realize it is also the most literal description of payment architecture. Visa did not win the mandate. But it was positioned to monetize it.
Here's the structural insight most coverage misses: tokenization changed what Visa is, not just what it does. Before the mandate, Visa was a clearing channel — it moved authorization messages and settled net positions. After, it also operates as a token service provider, registering and issuing the credentials merchants depend on to initiate a transaction at all. That is a jurisdictional upgrade from pipe to custodian.
It is also a remarkably cheap upgrade. Visa did not rebuild VisaNet. It layered a credential service on top of the existing authorization path. Latency and clearing mechanics are unchanged. What changed is who holds the customer relationship at the point of checkout — and that is a far better place to sit than the rail itself, because rails attract regulation and credentials attract fees.
Which brings us to the part the press release calls "convenience." The real commercial meaning of convenience is conversion rate. A stored token removes the card-number entry step and, in many flows, the additional factor authentication friction that hangs off it. For an Indian e-commerce merchant, that shows up directly in abandoned-cart reduction. For Visa, it shows up as authorization-rate improvement measured in basis points and incremental transaction volume. The safe-sounding phrase "security and convenience" is doing double duty as a technical description and a revenue forecast.
Tokenization also creates a data asset that did not exist before. A token bound to a merchant, a device and a purchase context is not merely a de-identified PAN. Over time it becomes a high-resolution map of intent: which device shops where, on what cadence, at what ticket size. Visa already runs Visa Advanced Authorization for real-time risk scoring; adding a token lifecycle layer on top produces a two-tier structure of card-level and token-level signals. That data is more auditable than a black-box model, which matters to a regulator increasingly demanding explainability, and it is more valuable than raw card numbers for marketing-adjacent purposes. The same asset is simultaneously the compliance story and the monetization story — which is exactly where the tension lives, because India's data localization rules and the 2023 Digital Personal Data Protection Act both constrain how far that metadata can travel.
The compliance ledger, on balance, favors Visa. Merchants no longer store PANs, so the network's reputational exposure to merchant-side breaches falls. Under DPDP's data minimization and purpose-limitation principles, tokenization is arguably the cleanest posture available. That gives Visa the vocabulary to sell what is effectively compliance-as-a-service back to merchants and payment aggregators — a safety narrative converting into a new line item. And the mandate itself was never something Visa resisted. The RBI's card-on-file rules fit its existing global Visa Token Service capability almost exactly. Visa is not the defendant here. It is the compliant executor, and executors get to write implementation standards. Where the regulator built a wall around the card number, Visa showed up with a bridge — and collected toll in both directions.
The risk side deserves equal weight, because the threat profile migrates rather than disappears. Card-number theft compresses when there is no card number to steal. What expands is token provisioning and re-provisioning fraud — attacks aimed at the lifecycle of the credential rather than the credential itself. Visa has responded with scoring products that sit precisely at that new attack surface. Read the sequence carefully: a security capability launched in response to a security risk becomes a new fee-bearing service. That is the pattern of the entire strategy.
There is an availability asymmetry too. Tokenization concentrates merchant-side security responsibility into the network. If a token service degrades, every merchant holding a stored binding loses the ability to transact — the blast radius is no longer one issuer's authorization problems but a shared credential outage. Availability upgrades from a performance metric to a systemic-risk metric. Visa's multi-active data center footprint in India is sized for exactly that scenario, but the exposure is real and new.
And there is an architecture conflict almost nobody has priced. India's 2018 localization directive already requires payment system data to reside in-country. If DPDP rules eventually require token metadata — not just the token itself — to stay inside India, Visa faces a choice between a globally unified token vault and a quasi-independent Indian token system. The latter erodes the global network effect that makes the vault valuable in the first place. That is the slow cost, and it compounds.
The consensus reading is that tokenization is Visa's firewall against UPI. I think that is backwards.
Tokenization hardens the card layer. It does nothing about the account layer, which is where UPI actually competes. UPI's network effect is stronger because it connects consumers, merchants, banks and PSPs on a single national rail, while Visa's network is bilateral — acceptance on one side, issuance on the other. A third side of token-merchant-device data enriches the card network internally. It cannot stop a cross-layer substitute from eating the base.
The more likely outcome is divergence, not defeat. India's card volume share and card revenue share are going to move in opposite directions. UPI has crushed card transaction counts by an order of magnitude and will keep doing so. But Visa's Indian unit economics lean on credit, cross-border and commercial flows — segments where UPI's zero-MDR structure is not built to carry the economics. A bear thesis resting on transaction-count share is measuring the wrong denominator. Meanwhile the genuine regulatory risk is not a fine or a penalty. It is rule publicization: if the RBI or NPCI ever mandates network-agnostic token interoperability, or stands up public token infrastructure, the vault position Visa spent three years deepening gets quietly nationalized. Mastercard's 2021 new-issuance ban over localization non-compliance is the precedent showing how fast the regulator can move once it decides to.
So the honest contrarian claim is this: tokenization is not a moat against UPI. It is a moat around the one layer where Visa is still allowed to be indispensable.
The audit is not the end, but the beginning. Watch three signals over the next eighteen months: whether the RBI issues guidance on cross-network token portability, whether Visa's Indian value-added service revenue outgrows its transaction revenue, and whether token metadata stays inside India or starts moving. If the first moves toward openness, the vault becomes a rented room. If the second moves faster than the third, Visa has already answered the question it was too polite to ask out loud: in India, the card number was never the asset. The mapping was.
