Token Service Provider (TSP)
PCIComplianceHubLast updated
An entity that generates, issues and manages payment tokens, and maintains the mapping between a token and the underlying primary account number. Because the token vault holds that mapping, a TSP is a high-value target and is covered by dedicated PCI Security Standards Council security requirements in addition to PCI DSS.
Applies to. No PCI DSS v4.0.1 requirement names a token service provider. A TSP that runs a token vault stores PANs, so it is a service provider under PCI DSS and is assessed on the vault, the token-to-PAN mapping and the systems connected to them, and the Council's separate Token Service Provider security requirements add controls specific to the vault and token issuance. A merchant meets the concept from the other side: where a TSP or gateway replaces the PAN with a token before the merchant's systems store it, those systems hold no cardholder data and can leave scope, provided nothing in the merchant environment can turn the token back into a PAN, and the TSP is listed and tracked as a third-party service provider under Requirement 12.