Token Migration

Our token migration process securely transfers a single merchant’s vaulted payment data from their previous processor to their new EPX merchant account. The process involves receiving an encrypted file of your card data, converting it, and verifying the accounts with issuing banks to generate new EPX tokens (referred to as BRICs).

Migration Timeline and Parallel Processing

The standard turnaround time to complete a token migration is approximately 7 business days from the time we receive the encrypted data file from your previous processor.

Important Note on the "Data Gap"

Because this verification and conversion process takes several days, there will be a gap between the moment the file is exported by your old processor and the moment you receive your new EPX tokens.

To prevent data loss and ensure uninterrupted billing during this window, we recommend you:

• Continue using your legacy system for existing recurring billing/cards on file.
• Configure your software to route any new card entries or newly acquired tokens through your active EPX MID.

Once the migrated tokens are returned to you, you can fully sunset the legacy system.

The Migration Workflow

To ensure strict PCI compliance and maximum security, the migration follows a monitored end-to-end process:

1. Data Export Initiation: You will initiate the export process with your current payment provider.

   * Recommendation: When initiating this request, ask your previous processor to export only valid, actively billing tokens rather than a complete dump of your entire historical vault. This reduces processing time and minimizes decline rates.

2. PGP Key Request & Encryption: To ensure the data is safely transmitted, your current payment provider will request our Public PGP key from the EPX Integration team. The key will be used to encrypt the export file containing the Account Number (PAN), Expiration Date, Zip Code, and your old token.

3. Secure Receipt: The encrypted file is sent to EPX via an approved secure delivery channel that will be communicated to your current payment provider.

4. Secure Processing: The file is decrypted using our private PGP key within a secure, restricted environment.

5. Verification: The data is processed as an Account Verification to validate the account information directly with the card issuers.

6. File Return: Once complete, EPX generates a response file containing your new BRICs, the last 4 digits of the card, the expiration date, the zip code, and a data field mapping back to your previous unique identifier. This file is then distributed directly to you.

7. Data Wiping: All files and the secure machine's image are completely wiped immediately after processing.

Requirements

To proceed with token migration, ensure the following requirements are met:

• Active Merchant account
• CSV file format
• Minimum required data:

  • Account Number (PAN)
  • Expiration Date
  • Zip Code
  • Unique Identifier (Previous processor's token)
  • First Name
  • Last Name

Disclaimers on Approval Rates

While we securely map the incoming data and process the verifications, the final decision to approve or decline the new token request rests entirely with the issuing bank. You should expect a portion of the transactions to be declined due to several industry-standard factors:

• Missing CVV Security Flags: PCI compliance strictly prohibits storing and exporting CVV data. Many issuing banks categorize verifications without a CVV as higher risk and will decline them automatically.

• Stale or Inaccurate Account Info: Card vaults naturally decay over time. Even when requesting only active tokens, a percentage of the migrated file will inevitably contain cards that have recently expired, been replaced due to loss or theft, or belong to closed accounts.

• Unsupported Transaction Types: We validate the cards using an AVS-only Account Verification transaction. Some legacy issuing bank systems do not recognize zero-dollar verification requests as valid transaction types and will outright reject them.

• General Issuer Declines: Even if all the data is provided and is accurate, issuing banks could still decline the transaction.

  * Note: In the event of a general decline, the cardholder will need to contact their issuing bank directly to inquire about the reason. For security and privacy purposes, issuers will not disclose specific decline reasons to merchants or payment processors.

Next Steps for Declined Tokens: