Method and apparatus for establishing and maintaining PCI DSS compliant transaction flows for banking entities leveraging non-EMV tokens

1. A computer implemented method for establishing and maintaining Payment Card Industry Data Security Standard (PCI DSS) compliant transaction flows, comprising:

a payment processor or network receiving an incoming primary account number (PAN) pursuant to a payment card transaction between a merchant and a banking customer;

said payment processor or network generating a token by translating said PAN into a token, said translation producing a token value by replacing digits within a middle portion of the PAN with random values, said translation preserving a PAN value for four digits within a terminal portion of the PAN, wherein a one-to-one relationship is maintained between said PAN and said token, wherein any said token resolves to one and only one PAN, wherein said token uniquely and securely corresponds to said PAN for purposes of BIN processing and payment card identification;

pursuant to generation of said token, said payment processor or network performing bank identification number (BIN) substitution on said PAN by replacing a BIN within said PAN with a different BIN;

said payment processor or network sending said token to an issuer bank for processing of said transaction, wherein PAN data is not derivable by said issuer bank from said token, and wherein use of said token by said issuer bank for said transaction processing is PCI DSS compliant; and

upon completion of said issuer bank processing said transaction with said token downstream, said payment processor or network translating said token back into a PAN for further processing of said transaction upstream.

2. The method of claim 1 , further comprising:

said payment processor or network storing said token in a token vault.

3. The method of claim 2 , further comprising:

one or more issuer processors and issuers leveraging existing private connections with payment processors, wherein requests are made leveraging Web Services protocols (SOAP or JSON), requests are protected with TLS Link Layer encryption, and response data are serialized via SOAP or JSON objects.

4. The method of claim 1 , further comprising:

using any of access controls and encryption to secure said PANs and said tokens.

5. The method of claim 1 , further comprising:

using an application layer to process token exchange requests.

6. The method of claim 1 , further comprising:

providing one or more data tables within which both said PAN and a corresponding token are arrayed a single row.

7. The method of claim 1 , further comprising:

encrypting said PAN using a key stored on an attached hardware security module (HSM).

8. The method of claim 1 , further comprising:

logging de-token requests; and

analyzing said de-token requests for misuse and fraud.

9. The method of claim 1 , further comprising:

during token generation, said payment processor or network replacing a first number in said PAN with a replacement value to identify a resulting number uniquely as a token instead of a PAN.

10. The method of claim 1 , further comprising:

during token generation, said payment processor or network preserving an original value of the last four digits of the PAN for downstream processing and identification.

11. The method of claim 10 , further comprising:

during token generation, said payment processor or network combining said four digits with at least one other data element to identify an account and account holder positively without requiring a full PAN to do so.