PayPal: One Token to Rule Them All

Print Friendly, PDF & Email


Howard Mason


February 29, 2016

PayPal: One Token to Rule Them All

“We also handle more payment types than just credit cards. This means merchants don’t have to process a different set of parameters for credit cards, Paypal, or any other payment method introduced; it can all be done with one token”. PayPal CEO Dan Schulman, Jan 2016

  • The critical juncture in the value-chain for payments is the token. While the advertised function of tokens is to improve security (by masking the credentials of a payment account), there is another impact on economics because the token-owner can influence how transactions are routed for processing. Indeed, the pricing power of the branded card networks rests on a token oligopoly (since the primary account numbers or PANs embossed on the front of your debit or credit card are network-issued tokens) along with rule-sets restricting the routing choices available to merchants when these PANs are involved.
  • The transition to mobile payments is breaking the token oligopoly of the network brands. In mobile payments, tokens can leverage the computational abilities of a mobile device to be dynamic in the sense of changing from transaction-to-transaction (as opposed to PANs which are static) thereby reducing the risk of loss if a token is hacked or stolen. Tokens therefore lie at the heart of payment apps giving companies that strategically partner with merchants around app development an advantaged position as token distributors. The two leading companies in this space are PayPal’s Braintree and Stripe (in which Visa has made a strategic investment).
  • Through Braintree, PayPal is aggressively promoting its token standard, which handles all electronic payment tenders, over network-issued tokens. Braintree and Stripe compete by making it as easy as possible for developer-clients to embed payments in merchant apps and, indeed, advertise how few lines of application code is required. One way to reduce application code is to work with a single token standard that can handle all tender types rather than multiple token standards (including, for example, the EMV[1] standard for branded card payments and the Clearing House standard for ACH payments). Braintree is marketing this convenience-advantage of PayPal tokens to its developer-clients.
  • Visa recognizes the risk of third-party token-providers with Jim McCarthy, global head of innovation and strategic partnerships commenting in February 2015, “we have been in the [token] business for a long time … mobile finally got to the point where … we saw like look we can’t have these credentials being decoupled and disintermediated”. And PayPal CEO Dan Schulman, while being somewhat coy about the details of PayPal’s token strategy and deferring discussion for the future, acknowledges the potential: “I think tokenization is a tremendous opportunity … we’ve got tokens that we’ve put in front of credit cards, tokens that we’ve put in front of debit cards, tokens that we’ve put in front of ACH accounts”.
  • Visa CEO Charlie Scharf addresses the threat from PayPal specifically albeit implicitly: “people that generate business for us in the short term, whose business model is built around disintermediating us eventually and our clients [i.e. the banks issuing Visa-branded cards], is not something that we like, not something that we support, and not something that we’re just going to sit idly by and watch”. In response, PayPal is downplaying its interest in routing transactions away from Visa (despite the important improvement in PayPal economics for off-network transactions including ACH debit, PayPal Credit and PayPal wallet) with CFO John Rainey remarking that “roughly 50% of our funding mix is card-based today … I don’t think you would see that disproportionately different if we did not steer at all”.
  • However, it is the merchants, not PayPal, that will look to lower card acceptance-costs by routing away from the branded networks in cases where this is enabled by non-network tokens. Providing these tokens is a core element of PayPal’s “beyond the buy button” strategy which involves expanding its merchant offering from the branded button to white label services, including tokens and gateway services[2], as the firm “consciously makes a strategy choice to be a 100% share of checkouts.”. Indeed, along with easy integration into mobile apps, routing flexibility is part of the appeal of PayPal’s tokens to its merchant-clients.
  • In the case of debit, Durbin gives the merchants the right to route over any available infrastructure regardless of whether the customer presents a network-branded card and, in the case of credit, merchants have a great deal of firepower (including from trade-spend receipts) to encourage customers to make a private-label credit card the default choice for their app.
  • A reason tokens increase routing flexibility is that making a processing change simply requires mapping the token to a new payment route. There is no need to issue a new card to the customer (e.g. a Visa card instead of a MasterCard). Furthermore, to the extent a customer designates the new payment tender as a default for the merchant app (and hence token), that tender becomes sticky in the top-of-wallet position.


Merchants are determined to break the oligopoly of the branded card networks, and the consumer shift to mobile phones is an enabling catalyst. This is because payments require a token to represent the payer’s account (for greater security than if the account number were used directly), and the transition to mobile payments allows new entrants, such as PayPal, into the token-providing business. Traditionally, the branded networks have had a lock on token-providing through the 16-digit numbers that are embossed on the front of a typical credit or debit card; these network-provided primary account numbers or PANs are tokens of the underlying payment account typically provided by an issuing bank.

The Source of Pricing Power at Visa

Before discussing the transformational impact on payment industry structure and pricing of new entrants to the token-providing business, it is worthwhile summarizing the economic model of the branded card networks using Visa as an illustrative example. The root of Visa’s pricing power is that shoppers with access to pre-approved credit at point-of-sale spend more. As a result, with the rare exception, few merchants can afford the cost in lost sales of refusing to accept Visa credit cards. Visa massively amplifies this intrinsic pricing power through a rule-set that has been repeatedly, and sometimes successfully, challenge in Court by the merchants under anti-trust law. The three main strands of the rule-set associated with the Visa acceptance brands are honor-all-cards, exclusive routing, and anti-steering restrictions:

  1. Honor-all-Cards: Until 2003, the honor-all-cards rules applied across credit and debit so that a merchant accepting Visa credit cards also had to accept Visa debit cards (and, indeed, were the primary reason that Visa’s debit product gained share from competing offerings from the ATM networks such as STAR and NYCE even though they were meaningfully more expensive for merchants to accept). Now, however, the honor-all-cards rules apply across issuers within debit and across issuers within credit but not across debit and credit – i.e., in theory, a merchant could choose to accept Visa-branded credit cards but refuse Visa-branded debit cards and vice versa. Regardless, even in diluted form, the honor-all-cards rules are anathema to merchants since they forestall price-competition between issuers. Unlike, say, manufacturers of soap powder banks do not make tough visits to Bentonville offering lower prices in return for shelf space at WMT; rather, this shelf space is guaranteed since, under the current honor-all-cards rules, WMT has an all-or-none decision around acceptance of Visa credit cards.
  1. Anti-Steering Rules: As a District Court ruled in February last year, anti-steering rules “sever the essential link between the price and sales of network services by denying merchants the opportunity to influence their customers’ payment decisions[3]”. Visa and MasterCard removed their anti-steering rules in July 2011 following merchant litigation but the point is largely moot because AXP maintained their anti-steering rules which apply for Amex-accepting merchants to all card brands and not just the Amex brand. AXP’s anti-steering rules have been found by a District Court to violate anti-trust law but remain in effect pending appeal; we do not expect the appeal to be successful so that the rules will be removed in 2017 and merchants allowed to create incentives for customers, through rewards for example, to use low-cost tender. This will create downward pressure on acceptance costs as networks bid for merchant share of wallet through lowering these costs.
  1. Exclusive Routing: Until 2011, Visa insisted that transactions originated (or “acquired” in industry vernacular) on Visa-branded cards had to be processed on the Visa network arguing that this exclusivity was necessary to preserve brand reputation; indeed, in 2006, Visa successfully used this argument to prevent First Data from using its internal systems for processing transactions acquired on Visa-branded cards even when First Data acted for both the acquiring bank (representing the merchant in a transaction) and the issuing bank (representing the cardholder in a transaction). However, in 2011, Durbin undercut Visa’s position by permitting retailers to process debit (but not credit) transactions over any available infrastructure regardless of how they were acquired, and JPM negotiated with Visa an exception for credit transactions in 2013. Specifically, where Chase is both the acquiring bank and the issuing bank, it can process a credit transaction acquired on the Visa brand through its proprietary ChaseNet infrastructure.

The combined effect of these rules is that a merchant must make an all-or-none decision to accept Visa-branded cards regardless of issuer (and so cannot engage price-competition between issuers), cannot influence customer choice of card tender at point-of-sale (and so cannot engage price-competition between networks), and cannot escape supra-competitive pricing by processing network-branded transactions over a commodity infrastructure. It will come as no surprise that the costs of card acceptance have therefore risen (on a per-transaction basis and despite increasing volumes – Chart 1) to a point that Alaska Air, for example, they are twice as high as the US labor costs and more than the total cost of food and beverages.

Chart 1: Changes in US Credit Interchange Fee on $40 Transaction at Average Merchant

Source: GAO: The “premium” rates are for high-rewards cards, such as travel cards, directed at high-spending consumers while the “basic” rates are for cards directed more at consumers who are more focused on credit-availability than rewards.

Chart 1 shows the rising rate of credit “interchange” which is a fee paid by the merchant accepting a credit card to the bank which issued the card to a consumer; it illustrates that credit interchange is approximately 2% for a premium rewards card and 1.2% for a more vanilla card. Interchange is the lion’s share, typically over 80%, of the all-in cost to a merchant of accepting a credit card but is not the only cost. In addition, the merchant will pay network fees to Visa of approximately a dime on a credit transaction and a nickel on a debit transaction; other firms, including ACIW (whose CEO is Phil Heasley, a former Chair of Visa) can do the same processing for much less than a penny per transaction.

The Relevance to Industry Pricing of Tokens

PayPal has broken the oligopoly of the branded card networks for online transactions. The eponymous buy button is convenient for consumers (because they do not have to enter a card account number into a merchant web-site to complete a transaction) and valuable to a merchant (because the greater consumer convenience reduces cart abandonment costs). Having interposed its brand between the merchant web-site and a branded card network, PayPal is free to steer – i.e. to influence customers to use a payment tender that is lower cost. PayPal has been successful at this with nearly half of its transactions funded with alternative tender to the branded card networks whether through private-label credit (i.e. PayPal Credit), direct-to-account debit (processed over the ACH network as an electronic check), or via PayPal Wallet (i.e. using prepaid balance).

The irony is that Visa was responsible for creating PayPal through granting it permission to act as a payment aggregator (now called a “payment facilitator[4]”) – that is to represent other merchants on the Visa system and allow these sponsored merchants to piggy-back of its merchant “acquiring” account with Visa rather than incurring the financial and compliance burdens of establishing their own acquiring accounts. This introduction of payment facilitators (for fixed-internet in 2001 and for mobile-internet in 2013 with PayPal and Square respectively being examples) extended Visa’s reach to small merchants without the scale to support the outright and compliance costs of establishing a merchant account but at the expense of allowing PayPal to “wrap” the Visa brand.

While this trade-off might have made sense for e-commerce, representing ~10% of total commerce, the prospect that PayPal may be able to ride the consumer shift to mobile payments and leverage its brand positioning from fixed-internet to mobile-internet and hence to in-store payments is a cause of concern. Visa CEO, Charlie Scharf, commented on this last month: “People that generate business for us in the short term, whose business model is built around disintermediating us eventually and our clients [i.e. the banks issuing Visa-branded cards], is not something that we like, not something that we support, and not something that we’re just going to sit idly by and watch”.

PayPal has sought to defuse tension by remarking that its goals are aligned with Visa to the extent both companies benefit as consumers shift from cash to card payments, by noting that it enables card acceptance by smaller merchants that might not otherwise engage with the Visa brand, and by emphasizing that it wants to allow customers to pay in their choice of tender without steering away from the branded network[5]. However, there is a sting in the tail with CEO Dan Schulman commenting in the context of Visa possibly raising its fee to PayPal that “we drive a tremendous amount of volume for our network partners” and that “we are in lots of conversations with lots of partners including Visa”. The fact of the matter is that PayPal’s negotiating position improves as it increases the volumes it can direct to Visa and as it builds the ability to route transactions to other partners.

PayPal Tokens and Software-Driven Payments

The deployment of PayPal tokens into m-commerce supports both objectives, and the announcement of an agreement with First Data in January to enable the acceptance of PayPal tokens in-store at First Data’s acquiring clients is indicative of PayPal’s new strategy to extend its franchise from e-commerce. The driver of token adoption at physical point-of-sale will be increasing penetration of software-driven payments solutions as opposed to traditional fixed-wire solutions (you can think of the difference as analogous to that between a smartphone and a rotary phone); as illustrated in Chart 2, McKinsey expects software solutions to account for well over one-third of acquiring-processing revenues from physical point-of-sale by 2018 compared with under one-quarter in 2013.

Chart 2: US Payments Acquiring/Processing Revenue $bn

Source: McKinsey: Innovation and Disruption in US Payments

The merchant motivation for deploying software-enabled payment solutions is that payments can then be integrated more seamlessly into other business-management applications including, for example, marketing and rewards, inventory control, and fraud risk management. Furthermore, software-enabled payments terminals can support app-to-app communication with customer smartphones creating a rich and real-time information exchange that can be conditioned upon past payments history and responsive to a current checkout. PayPal is the most advanced in leveraging these software-solutions to create a different shopping experience for consumers that strengthens their relationship with merchants. Subway is the canonical example: “we power the Subway app and with that … you can customize your sandwich, you can take pickles off it, you can say what time you want to pick it up, you can split tender, you can use rewards and you go to the store and it’s an altogether different experience”.

It is this ability to strategically partner with a merchant and create a different and differentiated shopping experience that distinguishes the PayPal approach from Visa Checkout. Both buy buttons reduce cart abandonment costs, particularly on mobile where entry of card credentials on a small screen is even more trying for a consumer than doing so on a desktop, but this is now a table-stake rather than source of competitive advantage. In its approach to merchants, PayPal can also offer 180mm active accounts worldwide (with PayPal claiming that merchants see an average 16% sales lift when they install the PayPal buy button) and the capabilities for deep integration with a merchant app so as to create “a value change to the consumer and something that they see as a different shopping experience”.

To accomplish this, PayPal has assembled capabilities that are difficult for others to match including its consumer franchise (including the legacy fixed-internet users along with customers of Venmo and Xoom), the merchant-app and tokenization skills of Paydiant, and the mobile gateway capabilities of Braintree (where a gateway acts as an interface between payments software at point-of-sale and the acquiring processor). Visa is attempting to assemble similar capabilities through Visa Checkout (and the associated requirement for customers to register and hence give up their personally identifying information which, otherwise, would be known to the bank-issuer but not Visa itself), through partnering with Verifone (which is also looking to support merchants with payments software), and through strategic investment in Stripe (which is Braintree’s main competitor in the mobile gateway market). However, this cross-organizational assembly of capabilities is unlikely to be as nimble and market-responsive as PayPal’s more coordinated and in-house approach.

PayPal gets paid for providing these merchant services through its buy button since on these PayPal-branded transactions it makes the spread between its take-rate (i.e. what it charges the merchant) and its funding costs (i.e. what it needs to pay Visa or any other ultimate tender-provider). Shifting the funding-mix to lower-cost tender – such as direct-to-account debit, a PayPal prepaid balance, or PayPal credit – widens this spread but, as noted, PayPal has adjusted its business model at the margin. To a lesser extent is the firm directly managing the funding mix through, for example, adding frictions to the process by which a customer registers a Visa debit card; rather, PayPal is looking to be more neutral about enabling customers to pay with the tender they prefer. Nonetheless, PayPal represents a significant disintermediation threat to Visa since, once the anti-steering rules are removed, merchants may look to shape customer tender preferences around lower-cost alternatives.

The Disintermediation Threat to Visa from PayPal Tokens

This disintermediation threat increases to the extent merchant customers adopt PayPal’s token technology as well as its buy button, and the distinction is important. A key message from Dan Schulman since taking over as CEO in 2014 has been that “we are consciously making a strategy choice to be a 100% share of checkouts”. While the PayPal buy button is “implemented in a way that typically improves our share of checkout”, it is clear that not all consumers will make all their purchases in PayPal-branded format. PayPal’s aspiration to reach 100% of checkout for its merchant-clients therefore rests on augmenting the PayPal buy button with unbranded services with tokenization being the lead steer. The advantage for merchants of this tokenization services is that it is multi-tender, as opposed to the EMV token services from the branded card networks which secure only payments on the branded card networks. As Dan Schulman comments “we handle more payment types than just credit cards. This means merchants don’t have to process a different set of parameters for credit cards, Paypal, or any other payment method introduced; it can all be done with one token”.

The catalyst for merchant adoption of PayPal’s tokenization services is the shift to in-app payments where PayPal’s Braintree competes with Stripe to support merchants in providing API-driven tools to embed payments inside commercial applications. A key audience is the developer community responsible for developing these applications, and the key selling point for payments application programming interfaces or APIs is ease-of-use by developers. Indeed, Braintree and Stripe compete by advertising how few lines of application code is required to embed payments using their APIs. One way to reduce the application code is to enable a single token standard, such as that provided by PayPal, which can accommodate all payment tenders rather than multiple token standards such as the EMV standard for branded card payments and, say, bank-issued tokens for ACH payments. Furthermore, Paypal’s strategic partnership with merchants around all aspects of their app development (as in the case of Subway, for example), makes it an advantaged distributor of tokens thereby making it an advantaged provider of tokens.

The challenge for Visa is that its token is then “wrapped” by a third-party token in an analogous way that its brand is “wrapped” by third-party brands in many wallets (including PayPal’s own wallet). A difference, of course, is that the token is not branded but that does not alleviate the ability of the token-owner to route payments more flexibly and, in particular, to route away from the branded networks. Indeed, PayPal is moving away from using its position in the payments value chain to influence customer choice of tender but, in the case of tokens, is putting that ability in the hands of merchants and almost surely is making the case that, by providing this routing flexibility, its token scheme can add value.

Visa recognizes the risk with Jim McCarthy, global head of innovation and strategic partnerships commenting in February 2015, “so long story short about tokenization, we have been in that business for a long time … mobile finally got to the point where … we saw like look we can’t have these credentials being decoupled and disintermediated”. And Dan Schulman, while being coy about the strategy and promising to talk more about tokenization in the future, recognizes the opportunity: “I think tokenization is a tremendous opportunity … we’ve got tokens that we’ve put in front of credit cards, tokens that we’ve put in front of debit cards, tokens that we’ve put in front of ACH accounts”.

©2016, SSR LLC, 1055 Washington Blvd, Stamford, CT 06901. All rights reserved. The information contained in this report has been obtained from sources believed to be reliable, and its accuracy and completeness is not guaranteed. No representation or warranty, express or implied, is made as to the fairness, accuracy, completeness or correctness of the information and opinions contained herein.  The views and other information provided are subject to change without notice.  This report is issued without regard to the specific investment objectives, financial situation or particular needs of any specific recipient and is not construed as a solicitation or an offer to buy or sell any securities or related financial instruments. Past performance is not necessarily a guide to future results. The analyst principally responsible for the preparation of this research or a member of the analyst’s household holds a long equity position in the following stocks: JPM, BAC, WFC, and GS.

  1. EMV standard for Europay-MasterCard-Visa and is the token standard promulgated by the branded card networks.

  2. See our note of June 11, 2015 titled “PayPal – Gateway Service to Integrate Offline and Online Commerce”



  5. In some older products, PayPal has made it easier for consumers to register for direct-to-account payments than Visa debit but these frictions have been reduced in the latest release of the PayPal app.

Print Friendly, PDF & Email