Reviewed October 17, 2026. This practical guide replaces an earlier general overview; the original publication date and URL are retained.
A provider move can disrupt saved-payment customers even when the new checkout works for a new card. Before signing a migration plan, test whether existing payment credentials can be used through an authorized transfer process. The useful question is whether a recurring or returning customer can complete the next permitted transaction without an unexpected re-enrollment.
Inventory credentials without exporting card data
Count customer records by token type, source platform and intended use. Ask each provider to identify who controls the token vault and which migration process is available. Record the answer in writing. Do not ask staff to copy raw card numbers into a spreadsheet as a shortcut for moving stored credentials.
Define success for each use case
Separate a returning shopper, an ongoing subscription and a delayed permitted charge. For each case, document the consent record needed, the provider responsibilities and how a failed migration will be communicated. A successful token import count does not establish that each credential is usable in its intended transaction context.
Run a limited authorized test
Agree on test records and secure transfer channels with both providers. Check the customer mapping, duplicate prevention, authorization result and reporting reference. Reconcile the output back to the approved input list. Include a record that should fail, so the team can verify that exceptions are not silently converted into new customer accounts.
Keep rollback and deletion responsibilities explicit
Name the person who can stop the migration and define how customers will be contacted if re-enrollment becomes necessary. Retain the old system only for the agreed transition purpose and period. Confirm deletion and access-removal responsibilities with the appropriate security reviewer before closing the project.
Source and next steps
EMVCo describes payment tokenisation. A particular provider’s export rights and migration support must still be verified through that provider’s contract and technical process. Read EMVCo payment tokenisation overview.
Continue with Payment Tokenization: Ask What the Token Protects and Who Controls It and Embedded Payments: Map the Support and Exit Responsibilities.
For the regional operating checklist and further reading, use the AMS New Jersey merchant guide. Explore related topics in Eric Kuvykin’s reading paths.
