Tokenisation in the Philippines: The consumer is ready, but is the infrastructure?

Being token-ready involves much more than switching on wallet acceptance.

Apple Pay is expected to launch in the Philippines in the next few months, following Google Pay’s arrival late last year, as the central bank pushes digital banks and electronic wallets towards standardised payment rails. But wider wallet access will count for less if issuers and processors cannot support tokenised payments reliably behind it.

Filipinos already use digital payments heavily. Money moves through wallets and bank apps for bills, online shopping, transfers and day-to-day purchases. In 2024, digital retail payments accounted for 57.4% of total transaction volume and 59% of total transaction value, whilst formal account ownership, especially through electronic money wallets, continued to rise.

Apple Pay and Google Pay are entering a market where digital payment habits are already well established.

A wallet launch adds pressure because the real work starts once the card goes into the wallet. The primary account number (PAN) is replaced with a token, and that token has to be provisioned, managed, and updated over time. If a card is suspended, reissued or expires, the wallet credential has to keep up. Issuers also need to know how that token is being used, where controls apply and what happens when something goes wrong.

New rules from the Bangko Sentral ng Pilipinas (BSP) are steering digital banks and electronic wallets towards rails such as InstaPay and PESONet, with stronger expectations around refunds, clearing, and settlement. A wallet launch is the visible moment. The operational burden sits much further back.

Security moves tokenisation up the agenda
The security story hits first. Fraud and identity specialist TransUnion put the Philippines’ suspected digital fraud rate at 13.4% in 2024 – more than double the global average of 5.4%. In a market carrying that level of exposure, tokenisation does not need a long sales pitch. Swapping out the PAN for a token cuts down how far real card details travel and how useful stolen data becomes.

Wallets play a role in that process, but they are only part of it. The gain becomes clearer once tokenisation is routine and issuers have to manage those credentials with the same control and visibility they expect elsewhere in the payment flow. A tokenised credential gives the issuer more control over where and how it is used, whilst narrowing the number of places where the original card details need to be exposed. In a market already carrying elevated fraud pressure, that is a practical operational benefit.

Mastercard’s 2030 direction adds a timetable to the discussion. Its public target is 100% tokenisation by 2030, alongside the phase-out of manual card entry for electronic commerce across all markets by then. That shortens the runway. Banks that still treat tokenisation as a wallet project or a feature enhancement may find the market overtaking their timetable.

What token-ready infrastructure actually involves
Being token-ready involves much more than switching on wallet acceptance. It means being able to provision tokens efficiently, manage them through their lifecycle, apply restrictions in real time, and maintain visibility over how tokenised credentials are behaving across devices and channels.

Push provisioning sits in a less visible part of the wallet journey, but it can make a direct difference to how easily a card is added and activated. Manual provisioning asks the customer to type in card details and complete extra checks, which creates more room for drop-off.

Push provisioning allows the issuer to create the payload securely and pass it into the wallet with fewer steps, which improves activation and conversion.

The lifecycle issues follow quickly once usage builds. Tokens have to be suspended, resumed, replaced, and refreshed as cards expire, are reissued or change status. Issuers need to know where a token is active, which controls apply to it and how fast those controls can be updated. That includes responding when card status changes, fraud signals appear or a token needs to be restricted without waiting for batch updates or manual workarounds. Those demands become much more visible once tokenised payments begin to settle into everyday card use.

Higher token volumes expose the difference between cloud-hosted and cloud-native infrastructure. A cloud-hosted stack may be able to support wallet tokenisation while still treating tokens as wrappers around the underlying card. A cloud-native environment is more likely to treat token state, card controls, and transaction decisioning as part of the same live system. The difference is practical rather than architectural. One model supports tokenisation as an added layer. The other supports it as part of the live credential itself.

Infrastructure many issuers first built out for tokenised wallets is likely to take on a wider role over the next few years. As wallet usage grows, the payment credential itself starts to look more like part of the control architecture. It may need tighter restrictions, clearer usage rules and faster updates than the market has historically applied.

Why Asia Pacific is watching
The Philippines offers one of the clearest early views of what tokenisation looks like once global wallets, fraud pressure, and tighter payment rails start arriving together. Recent reports have suggested that Meta has begun offering USDC payouts for select creators in the Philippines, placing the country among its first rollout markets. That is a different payment use case, but it points in the same direction.

Global players are treating the Philippines as a market worth building for, not one to circle later. For issuers and processors, that raises the value of infrastructure that can handle tokenised credentials, tighter controls and faster product change without relying on workarounds.

The institutions that gain most from that environment will be the ones treating tokenisation as part of the payments core, with the provisioning, controls, and lifecycle management to support it properly at volume.