Posted: October 07, 2026 | Updated: October 08, 2026 at 3:56 PM
Visa is quickly adopting its tokenization technology. During its Q3 2026 earnings call, CEO Ryan McInerney stated that over 58% of Visa’s global e-commerce transactions were tokenized. Tokenization requires card provisioning, which requests card expiration dates. Card provisioning requests are only valid for a limited period of time. Consequently, card issuers must update the expiration date of the card to maintain the tokenization request.
Not having up-to-date expiration dates is considered an exception case. Visa’s VCES fact sheet states that online merchants are often not notified of card expiration, and as such, token requests for expired cards may be rejected. To resolve the exception case, Visa implemented its VCES.
Beginning October 30, 2026, token requests for cards on file within four of Visa’s geographical regions will require the Visa Credential Enrichment Service to resolve exception cases. Merchants that process cards on file will not need to implement additional code for VCES. We will explain exception resolution and provide additional information regarding stored card transactions and what to verify with your acquirer.
Visa announced the change in its merchant news digest in May 2026. The news digest described four regions. Of the four regions, two were situated in North America, that is, the United States and Canada. The other two regions were the Asia-Pacific region and the CEMEA (Central Europe, Middle East and Africa) region. The regions of Europe and Latin America were not included.
The most important terms of the announcement were straightforward. The Virtual Customer Acceptance Solution (VCAS) became available to all token requestors that keep customer card-on-file (COF) requests on 10/30/2026. Visa would not charge a separate price for VCAS. Instead, Visa would charge the DCSF (Dimension Change Service Fee) for each authorization request made for COF transactions. Visa has communicated that it wants to increase its market share of token requestors.
The service was provided by default. Merchant requestors had the option not to use the service. They had to reach out to their bank, in which case the bank would turn off the service by 09/30/2026.
Visa calls its client bulletins that carry the legal language binding terms. Visa, however, shares recaps of the bulletins on its website. Merchants are directed to their acquirer for the full service terms and conditions.
As shown by Visa’s Token Service, Visa replaces the card number with a token, which can then be verified by Visa only. A business can request tokens for their cards by sending a provisioning request to Visa. The business is referred to by Visa as the requester or token. The provisioning request includes the card number that is expiring and the card’s expiration date. Visa’s VCES fact sheet mentions the card expiration date twice. The first is to create the token, and the second is to authorize transactions charged to the card.
The VCES fact sheet outlines four processes. First, any token requestor that has cards stored by Visa can participate. Second, the token requestor prepares and forwards a request to Visa Card Services (VCES) for a new token because the previous token request has an expired or missing expiration date. Third, VCES adds the latest card expiration date Visa is aware of to the request. Fourth, VCES forwards the request to the card issuer to make the final decision.
The data source is clear. The fact sheet mentions that VCES uses VisaNet to find the card expiration date for card numbers that have been previously authorized for a transaction. Visa can only authorize transactions for cards if the card number is associated with a chip.
According to Visa’s fact sheet, higher token provisioning rates, lower rates of false declines for card-not-present transactions, and improved authorization of recurring transactions are possible with the use of VCES. Visa’s public materials, however, do not disclose a match rate or approval uplift specific to VCES.
The only job of the VCES component is to convert a card to a token. From what we can tell from Visa’s information, there are no other responsibilities of VCES related to card file updates or standard authorizations. Once the updated and enriched authorization request is formed and sent to the card issuer, the responsibility of VCES is complete.
It largely affects legacy card files. A card file that was created a long time ago may have an expiry date that may have already lapsed. As per information provided by Visa, VCES allows such a card file to be tokenized. VisaNet does not store chip-and-PIN approved transactions for such a card, and therefore, there will not be a more recent date for VCES to provide. The other two Visa services cover the card file for the remaining period of its life.
Once a token is created, Visa describes the service, Visa Digital Credential Updater (VDCU), for managing the token’s lifecycle. As Visa explains, a token will go stale if the card is reissued, and in that case, a new token would be requested. VDCU helps alleviate the need to request a new token in those cases. Visa’s June 2020 Token Service fact sheet mentions that in a tokenization scenario, a financial institution can update a cardholder’s compromised or expired credential without requiring the cardholder to perform a replacement process.
Merchants store card numbers in several ways. Visa utilizes Visa Account Updater (VAU) to refresh card details for subscriptions and other recurring card-bearing transactions. With Real-Time VAU, card details are fetched and updated in the eSIG(n)ature prior to the transaction. VAU updates the merchant’s account record. VCES, on the other hand, modifies the token request at the token request touchpoint.
| Service | Where it acts | What it keeps current | Visa source |
| VCES | Token provisioning requests | The expiry date on an eligible request | VCES fact sheet (2022) |
| VDCU | Existing network tokens | Token details when the card number changes | Acceptance lifecycle page |
| VAU and Real-Time VAU | Card records the merchant stores | Saved card details used for subscriptions and other stored-card billing | Acceptance lifecycle page |
Falls that continue to happen adhere to Visa’s response-code rules. As of April 2024, Visa stated that decline codes in Category 2 and Category 4 allow 15 attempts in 30 days. Category 1 codes indicate to issuers not to approve any transactions. Merchants are not allowed to attempt a transaction again after receiving a Category 1 decline code. The Visa Customer Enablement Solution (VCES) does not alter these constraints.
Membership billing charges stored cards regularly. Visa views these as unauthorized merchant-initiated transactions (MITs). Visa has announced it will change how it processes three things around October 30 relating to MITs: how it will treat the fee, the tokenization of standing instructions, and how it will enable transactions to be linked together.
VISA imposes VCES in the DCSF. CMSPI has reported that from October 2023, the U.S. DCSF has been charged domestically on settled card-not-present (CNP) transactions. As per the April 2026 update to Braintree’s network, VCES, along with Visa Account Updater and Real-time VAU/VDCU and TAVV, were part of the U.S. DCSF, effective April 1, 2026.
Braintree’s September 2026 update, which covers Canada, reports that Visa’s DCSF was implemented in Canada from June 1, 2026, for all CNP transactions. Braintree’s U.S. rates for April 2026 also apply in Canada from June 2026. Beginning on this date, Braintree will no longer charge Canadian customers separately for VCES, VAU, and VDCU, as well as TAVV, CVV2, and AVS. The exception to this rule is AFTs and OCTs. These will continue to be charged separately.
| Market | Start | Domestic | Domestic floor | Cross-border | Cross-border floor |
| United States | Apr. 1, 2026 | 1.50 bps | $0.01 | 3.50 bps | $0.01 |
| United States | Apr. 1, 2027 | 2.25 bps | $0.0125 | 5.25 bps | $0.0125 |
| Canada | June 1, 2026 | 1.50 bps | $0.01 | 3.50 bps | $0.01 |
| Canada | Apr. 1, 2027 | 2.25 bps | $0.0125 | 5.25 bps | $0.0125 |
Table 2: Visa DCSF for card-not-present authorizations.Source: PayPal Braintree Network Update Guides, April 2026 (U.S.) and September 4, 2026 (Canada).
Public fee terms for VCES in the Asia Pacific and CEMEA regions are not present in Visa’s merchant digest.
Europe will not be a part of the rollout. The region of Europe is not included in Visa’s VCES notice. PayPal Braintree reports that in the EU, Visa will introduce a DCSF on April 1, 2027, at 2.25 basis points per authorization for Group A transactions and 10 basis points for Group B transactions. Braintree states that Group A transactions are predominantly domestic and Group B transactions are predominantly cross-border. The Braintree EU Bundle includes the services of VAU, Real-Time VAU, VDCU and AVS/CVV2. Other information related to VCES is not included in that EU list.
Visa has linked its recurring billing option to merchant-held tokens. Its Digest states that as of July 30, 2025, a standing instruction will be declined if a phone or wallet token is created after that date. New standing instructions require tokens issued to the merchant for recurring-charging purposes. Wallet tokens, created before July 30, 2025, will still be valid.
In December 2025, Visa released information concerning the Original Transaction ID (OTID). According to Visa, the OTID is the identification link for a scheduled transaction to the first, or original, transaction conducted by the customer. Visa recommends that merchants process the OTID for all transactions, regardless of whether a raw card is processed or a token is processed. Based on Visa’s recommendations, approval of the transaction will result, and a decline will occur unnecessarily.
Performance results of tokens in general have been published by Visa. In August 2022, Visa disclosed the result of an analysis of 8,600 plus issuer banks and 800,000 plus merchant locations. Visa stated that the use of tokens by card-issuing banks resulted in an increase in approvals by 3%, and a fraud decrease by 28%. In June 2023, Visa disclosed that the use of tokens resulted in an additional 40 billion USD in e-commerce transactions and reduced fraud loss by 650 million USD.
Visa has said its token count surpassed 4 billion at some point in 2022, with 1 billion issued in 2020 and 2 billion in 2021. Visa said the 4 billion tokens issued were greater than the number of physical cards issued. On June 4, 2024, Visa said it had 10 billion tokens issued. On its fiscal fourth-quarter 2025 call, Visa said the token count was over 16 billion. In January 2026, McInerney said the token count was over 17.5 billion, which is more than three times the number of physical cards issued.
The token count and the shift to e-commerce have occurred simultaneously. McInerney said on April 29, 2025, that 48% of Visa’s e-commerce volume was tokenized. On July 28, 2026, he said the volume was tokenized at 59%. During the October 2025 call, McInerney said it was Visa’s goal to tokenize 100% of e-commerce transactions.
The shift to e-commerce has rapidly dropped the need for guest checkout. During Visa’s fiscal first-quarter 2026 call McInerney said guest checkout of Visa e-commerce transactions declined to 16%, from 44% in 2019.
Figure 4: Guest checkout share of Visa e-commerce transactions
Visa routes VCES traffic through its own infrastructure. The Digest does not show any integration or enrollment steps, or an integration form for token requestors that are ‘stayed in.’ By default, as of October 30, 2026, requestors who have taken no action are enrolled.
You must confirm your ‘opt-out’ status. Contact your acquirer to find out if anyone requested to remove your business from VCES prior to the deadline of September 30, 2026. You should also contact your token requestor(s) to confirm your stored cards, if applicable, before that date.
If your request was not opted out, VCES will respond to eligible token requests as of October 30, 2026. An opt-out request, however, will change nothing, as VCES will not respond to the requesting token.
One Scope Check is found in the question. VCES only responds to token provisioning requests. If a merchant stores cards as card number data, and does not make a provisioning request, VCES will not take any action. Your acquirer is in a position to verify if your stored card data is tokenized.
The call can also be used to evaluate other services besides VCES. You can find out if your merchant account is enrolled to Visa Account Updater or Real-time VAU. You can inquire if the gateway transmits the Original Transaction ID for repeated charges. This was requested by Visa, effective December 2025. You can ask how the DCSF is appearing on your processing reports. For 2026, as per the PayPal Braintree Guide, the fee would cover VCES, VAU, and VDCU.
Keep the answers for your records. Visa considers its digest as a summary of bulletins that are posted privately. The details given by Visa are at the account level. Your acquirer has these bulletins.
On October 30, 2026, VCES will be enabled by default for token requests made by stored-card token requestors in Canada, the U.S., Asia Pacific, and CEMEA. VCES extends the expiry date for eligible token requests. It finds the expiry date in Visa’s records for chip-approved, face-to-face, point-of-sale transactions. Visa charges no additional fee for this service, as it is provided as part of the DCSF. The opt-out window closed on September 30, 2026.
For requests related to memberships and subscriptions, credit your acquirer for the initial request to tokenize your stored cards. The acquirer will help determine next steps.
This element of Visa Token Service offers a feature to enrich token requests with card expiry date. Visa captures such transactions in case of chip-on-card approvals at the merchant’s point of sale.
VCES enriches eligible token requests to Visa with the updated card expiry date and does not update the card records held by the merchant. Visa Account Updater and Visa Digital Credential Updater are services to refresh and update stored card records and holdings, respectively.
Visa states that VCES will help eliminate authorization exceptions and improve success rate for card-not-present transactions. Visa has not disclosed the VCES-related decline exception rate.
Visa charges its customers for Card Not Present transactions and processes VCES without a surcharge.
To not use VCES, a Merchant’s request must be communicated by the Acquiring bank to Visa by September 2026. Beyond this, no further opportunities to not use VCES have been disclosed by Visa.
