Visa Tokenized Credential on File (TCOF)

Overview

This document describes the integration of Visa Tokenized Credential on File (TCOF) transactions with the Paynetics Acquiring platform.

It explains the supported functionality, onboarding process, API integration, transaction flows, request parameters and responsibilities when processing Visa network token transactions through the Paynetics Acquiring API.

Unlike Mastercard SCOF, Paynetics is not the Token Requestor. The PSP remains responsible for merchant integration, token provisioning, token storage and token lifecycle management. Paynetics acts solely as the acquiring processor and forwards transactions to Worldline after validating and mapping the required Visa TCOF fields.

Product Description

Overview

Visa Tokenized Credential on File (TCOF) allows merchants to process stored credential transactions using Visa Network Tokens instead of the original PAN.

Network Tokens are issued and lifecycle-managed through the Visa Token Service (VTS), providing improved security, authorization performance and payment continuity.

The PSP is responsible for:

• Merchant checkout

• Visa token provisioning

• Token vault

• Token lifecycle

• Token decryption

Paynetics is responsible for:

• Validating Visa TCOF transactions

• Processing transactions through the Acquiring API

• Mappings to processors

• Forwarding transactions for authorization

• Settlement and reporting

In Scope

• Visa Tokenized Credential on File (TCOF)

• Visa Stored Credential Framework

• Customer Initiated Transactions (CIT)

• Merchant Initiated Transactions (MIT)

• Purchase transactions

• Pre-authorizations

• EMV 3DS authenticated transactions

• Processing through Worldline Current Processing Platform (GICC)

• Processing through Worldline New Processing Platform

Out of Scope

• Mastercard SCOF

• Token Requestor services

• Visa Token Service enrolment

• Token provisioning

• Token lifecycle management

• Token vault

• Token decryption

• Merchant checkout implementation

• Click to Pay enrolment

• Wallet implementation

Currency and Country Coverage

Supported settlement currencies

• EUR

• GBP

Supported processing currencies

All currencies supported by Paynetics Acquiring.

Supported countries

• European Union

• EEA

• United Kingdom

Merchant Onboarding

Visa TCOF does not require any additional merchant onboarding beyond the standard acquiring onboarding process.

Supported onboarding methods

• Automated Merchant Onboarding API

• Manual Merchant Onboarding

Once approved, merchants may immediately process Visa Tokenized Credential on File transactions.

Important: Paynetics does not participate in Visa Token Service onboarding and does not manage token provisioning. These activities remain entirely within the PSP domain.

Onboarding via API

The recommended onboarding method is the Merchant Onboarding API.

During underwriting Paynetics may request additional merchant information if required.

Manual Onboarding

Merchants may also be onboarded manually by submitting onboarding documentation through the secure document portal.

After uploading the documentation, notify: underwriting@paynetics.digital

Manual onboarding capacity is limited.

Fees Setup

No changes from the standard acquiring process.

Payouts

No changes.

Reporting and Reconciliation

No changes.

Visa TCOF transactions appear in:

• Acquiring API

• Daily reconciliation files

• Standard reporting

Profit Share

Standard acquiring commercial model applies.

Technical Integration

After signing the acquiring agreement Paynetics provides:

• Sandbox

• API credentials

• Integration documentation

• Test scenarios

After successful certification:

• Production API key

• Production endpoint

Transaction Flow

1. Customer selects previously stored payment credential.

2. PSP retrieves Visa Network Token.

3. PSP decrypts token (if required).

4. PSP submits transaction to Paynetics Acquiring API.

5. Paynetics validates mandatory Visa TCOF fields.

6. Paynetics maps Visa fields into the corresponding Worldline GICC fields (current platform) or Worldline New Platform fields, depending on the processing route.

7. Worldline authorizes the transaction through Visa.

8. Authorization response is returned to Paynetics.

9. Paynetics returns the response to the PSP.

Supported Endpoints

• POST /v1/purchase

• POST /v1/pre-authorization

Pre-authorizations must always be completed by POST /v1/capture.

Visa TCOF Specific Request Parameters

The following parameters are specific to Visa Tokenized Credential-on-File (TCOF) transactions. All remaining request parameters follow the standard Purchase and Pre-Authorization API specification.

Supported Recurring Types

Supported ECI Values

Example Purchase Request

{

"merchant": "df1f946a-8b03-4a21-8eb7-dab86a77a027",

"reference": "Order-1001",

"amount": 50,

"currency": "EUR",

"card_number": "4895370012345678",

"card_expiration_month": "12",

"card_expiration_year": "28",

"cardholder_name": "John Smith",

"recurring_type": 3,

"wallet_payment": {

"wallet_identifier": "network",

"digital_payment_cryptogram": "AlhlvxmN2ZKuAAESNFZ4GoABAAAA"

},

"cavv": "jJ81HADVRtXfCBATEp01CJUAAAAA",

"eci": "05",

"version": 2,

"directory_transaction_id": "7b03c772-dba0-4818-872e-849d63a5a659"

}

Example Response

The response follows the standard Paynetics Purchase response format. No TCOF-specific fields are returned beyond the standard response body.

Responsibilities

3DS Transactions

Visa TCOF fully supports EMV 3DS.

For authenticated Customer Initiated Transactions, the PSP must provide:

• CAVV (exactly 28 characters)

• ECI

• EMV 3DS Version

• Directory Transaction ID (when version = 2)

• Digital Payment Cryptogram (TAVV, exactly 28 characters)

Paynetics validates these values and maps them to the corresponding Worldline fields before forwarding the authorization.

Merchant Initiated Transactions (MIT)

Merchant Initiated Transactions are supported for subsequent recurring and Unscheduled Credential-on-File (UCOF) transactions.

For MIT/UCOF (recurring_type 2 or 5), the PSP must supply the initial_transaction field, linking the subsequent usage back to the original stored-credential transaction.

The digital_payment_cryptogram is optional for MIT/UCOF use cases.

The PSP remains responsible for maintaining the relationship with the original customer consent and stored credential. Paynetics processes these transactions according to the Visa Stored Credential Framework.

Responsibilities Matrix