UnionPay Token Service Details – The Complete Guide 2026

[Student]

(From official UnionPay International developer portal, EMVCo framework compliance, and public specs – December 2025)

UnionPay International (UPI) offers a payment tokenization service compliant with the EMV Payment Tokenisation Specification – Technical Framework (v2.0+). It replaces the Primary Account Number (PAN) with a Payment Token (surrogate value) to enhance security for mobile, e-commerce, and contactless payments.

Key 2025 Facts:

• UnionPay token service is integrated with EMVCo standards – interoperable with Visa/MC/Amex/Discover/JCB.
• Tokens are 13–19 digits, pass Luhn check, and use dedicated Token BIN ranges (flagged in BIN tables).
• Token Assurance Level (TAL): Indicates confidence in token-PAN binding (based on ID&V method).
• Supported use cases: Mobile QuickPass, QR payments, in-app, card-on-file.

Core Roles in UnionPay Token Service (EMVCo-Aligned)​

Role	Description	UnionPay Implementation
Token Requestor (TR)	Entity requesting token (e.g., wallet, merchant, app gateway)	Mobile apps, merchants, acquirers
Token Service Provider (TSP)	Generates/manages tokens (UnionPay or certified partner)	UnionPay International (main TSP)
Token Vault	Secure storage mapping token ↔ PAN	UnionPay secure servers
Issuer	Validates token requests	Partner banks

Token Requestor ID: 11-digit identifier assigned by TSP.

Token Types & Features​

• Payment Token: Surrogate PAN (13–19 digits).
• Token BIN: Dedicated BIN/range flagged for tokens only.
• Token Assurance Level (TAL): Confidence in binding (set by TSP, updated with additional ID&V).
• Token Location: Remote storage, card-on-file, mobile device, etc.
• Lifecycle Management: Provision, activate, suspend, resume, delete.

UnionPay-Specific Services:

• VCCP (Virtual Card Control Platform): For issuers to manage tokens remotely.
• Shared Payment Token: For multi-user scenarios (e.g., corporate).
• Token Transaction Cryptogram: Dynamic one-time code for high-value.

Token Request Flow (From UnionPay Developer Portal)​

1. Token Requestor submits request (TOKEN_REQUESTING API).
2. TSP validates with issuer.
3. Issuer approves → TSP generates token + cryptogram keys.
4. Token returned (with TAL, expiry, restrictions).
5. Token activated (TOKEN_STATE_UPDATE).

API Examples (UnionPay APP Gateway):

• TOKEN_REQUESTING: Apply for token.
• TOKEN_STATE_UPDATE: Activate/suspend.
• TOKEN_TRX_CRYPTOGRAM_REQUEST: Get dynamic cryptogram.

Token Restrictions (Domain Control):

• Channel (e-commerce, in-app, contactless)
• Merchant-specific
• Device-bound
• Amount limits

Token Assurance Level (TAL)​

• Set by TSP based on ID&V method.
• Higher TAL = fewer restrictions/higher limits.
• Updated with additional verification (e.g., biometric).

Integration for Token Requestors​

• Register as TR with UnionPay.
• Use APIs for token lifecycle.
• Support for APP Gateway (mobile apps) and SaaS Card Issuing.

Compliance: Follows EMVCo framework + UnionPay enhancements (e.g., QR integration).

Bottom Line – December 2025​

UnionPay Token Service is EMVCo-compliant – replaces PAN with secure token, supports lifecycle management, assurance levels, and domain restrictions. Main TSP: UnionPay International. Focus: Mobile QuickPass, QR, cross-border.

For developers: Use UnionPay International Developer Portal APIs.

Stay safe – tokenization is core security.

Your choice.

– Based on UnionPay developer portal (2025).