Tokenization is now widely used across the payment industry, but adoption does not necessarily translate into strategic maturity. Forrester research cited at the beginning of the webinar found that only 18% of global issuers describe themselves as advanced, with real business strategy behind it, and 70% already rely on a third party to help close the gap. Closing it means moving to a fully token-centric architecture, where tokens become the primary mechanism for managing payments, allowing tokenization capabilities to scale. The question is what closing that gap can deliver.

That was the focus of the webinar organised by The Paypers with Thales. Moderated by Esther Groen, it brought together Lily Varon, Principal Analyst at Forrester, Edoardo Zavarella, Principal Consultant at Forrester, and Basit Abdul, Regional Business Owner EMEA at Thales Payment Services. They discussed why a tactical approach is no longer enough, what a strategic token-centric infrastructure looks like, and what the Forrester Total Economic Impact™ (TEI) study found when it measured the value.

Here are the key takeaways.

Most issuers tokenize, but few do it strategically

Forrester’s Q1 2026 survey of 537 senior decision-makers at large banks and issuing processors shows where the market sits. Globally, 20% of issuers are at an early stage, 36% are developing their capabilities, 26% are established, and just 18% have advanced capabilities.

The gap between current capabilities and future ambitions is wider still: 28% already report a token-centric strategy, and that share is expected to nearly double to 54% within 24 months.

The difference between good and great, Varon explained, is how far a team goes beyond payment security (replacing the card number to meet PCI and scheme mandates). Advanced teams also use tokens to improve acceptance and fraud outcomes, centralise token management, and analyse token metadata to send the right token down the right path.

New use cases are raising the bar

Several use cases now place new demands on token infrastructure: e-commerce tokens, device tokens for wallets such as Apple Pay and Google Pay, Click to Pay, payment passkeys, and, further out, AI agents acting on a customer's behalf. Agentic commerce is not mainstream yet, but Varon noted it is approaching and will be built on network token infrastructure. Issuers aren't too late, she said, but the time to get the foundation right is now, because what they build today sets them up for that future.

Approval rates matter as much as fraud

In a live poll, lower fraud and chargeback costs and higher approval rates with fewer lost transactions led at 25% each. A better, more consistent customer experience followed at 15%, then faster launches of new payment experiences and readiness for new forms of commerce, including agentic, at 13% each, and lower operational costs at 10%. Varon expects the spread to even out over the next two to three years as teams see the wider benefits.

Basit explained the commercial stakes. Scheme mandates put pressure on issuers to maintain tokenization approval rates above 90% to avoid penalties, and many struggle to do so. Moving from 90% to 95% adds interchange revenue by allowing more legitimate transactions to be approved (one customer reported 15%, from 80% to 95%). Basit added that merchants and acquirers also need to be prepared to receive tokenized transactions, as schemes can charge when the ecosystem isn’t ready.

Zavarella added a cost that rarely shows up in business cases. He described a wrongly declined legitimate transaction as the ultimate disaster: customers switch to another payment method, so the issuer loses the revenue, and they may also lose trust in the card that failed. From his own experience, Zavarella said he kept using a backup card for months before trusting his main one again.

What the Forrester study found

The TEI study discussed was commissioned by Thales and conducted by Forrester Consulting in May 2026. It draws on interviews with four issuers and processors running Thales Tokenization, with portfolios from about 5 million to over 50 million cards. Forrester TEI methodology is to run the interviews independently and remain confidential from Thales.

The results are modelled on a composite organisation: a global card issuer and processor with 10 million cardholders and five tokens per user, with 30% of tokens active before the investment. Over three years, it projects:

USD 1.2 million from reduced fraud, modelled on a 30% fraud reduction for tokenized versus card-number (PAN) transactions and a conservative USD 14 average chargeback processing cost, applied to the extra tokenized transactions the partnership made possible
USD 1.1 million from IT performance gains, as developers, testers, and operations teams were freed from custom code, regression testing, maintenance, and new features implementation, and the PCI burden for the tokenization layer moved to the partner
USD 434.000 from higher acceptance, based on a conservative 3.5% authorisation uplift versus the legacy solution

Together, that is USD 2.7 million in benefits, a net present value of USD 1.6 million, a 150% return, and an 11-month payback period over three years. As a modelled composite built on stated assumptions, it shows what is plausible, not what any single institution will achieve.

Build, buy, or partner?

Beyond the numbers, the study lists benefits it couldn't measure, and the one all four interviewees stressed was optimised innovation through strategic partnership. By abstracting operational and infrastructure complexity, a partner can leave internal teams free to focus on governance, differentiation, and customer experience. As one issuer put it, APIs aren't its core business, and building tokenization in-house would have meant substantial upfront investment and ongoing maintenance. Basit added that pace is the real test: building for one use case is possible, but keeping up with Click to Pay, Payment Passkeys, and wallets at once is harder.

Build for today, and for what comes next

The panel's shared message was that tokenization is no longer a collection of fragmented integrations but a strategic infrastructure layer. What you build today delivers value today and prepares you for tomorrow, including payments by AI agents, and it rests on governance, scalability, interoperability, speed, and resilience.

Want to hear the full discussion? Watch the webinar recording and download the study here.

About the author

Paula Albu has experience in content writing and editing, as well as being a creative storyteller. As a Junior Editor at The Paypers, she investigates Web3 technologies along with the latest trends and regulations in banking and fintech. Paula is committed to turning complex industry topics into engaging, accessible content that resonates with readers and creates a meaningful connection. She is available via LinkedIn or at paula@thepaypers.com.

Why tokenization is now strategic infrastructure