Token.io Wants the Card Machine to Become a Bank Login

At the most consequential second in online shopping, Token.io prefers to disappear. A customer taps Pay by Bank, chooses a bank, authenticates there and returns to the merchant. The shop sees confirmation. The money travels from one account to another. Token.io sits in the middle, translating the merchant's tidy request into whichever API dialect, consent screen and status message that particular bank requires. Its logo need never trouble the receipt.

That invisibility is the product. Token.io sells infrastructure to banks, payment processors, gateways, acquirers and fintech platforms - companies that already own merchant relationships and would rather not surrender them to another checkout brand. HSBC uses the technology for Open Payments. BNP Paribas built Instanea on it. Global Payments, Santander, Computop and Paysafe are among the customers or partners named by the company. Each can present a bank-payment service in its own clothes.

Founded in 2015 by a group including Steve Kirsch, Marten Nelson, Todd Clyde and Yobie Benjamin, the company arrived just as Europe's second Payment Services Directive was turning bank access into a regulated right. The regulation opened a door. It did not make every door the same size, put the handle in the same place or guarantee that it would open on the first try. Token.io built a business out of that inconvenience.

The product is the mess you do not have to see

The phrase “one API” makes open banking sound suspiciously clean. Under it are hundreds of connections, expiring certificates, bank-specific authentication journeys, changing rulebooks and a redirect that must bring a distracted shopper back to the right basket. A merchant could connect to banks directly and secure its own payment-initiation permissions. It could also decide that maintaining an international collection of bank integrations is not why it got into the shoe business.

Token.io packages that work into several layers. Single Immediate Payments handle one-off purchases and account deposits. Variable Recurring Payments, or VRP, let a customer create a bounded, long-lived consent so future transfers can happen on a schedule, under rules or with one click. Data services return consented account, balance and transaction information. Settlement accounts add receipt confirmation, refunds and outbound payouts over Faster Payments in Britain and SEPA or SEPA Instant in Europe. A dashboard supplies reporting and configuration; hosted pages supply the bank-selection and consent journey.

The distinction from a gateway or card processor is important. Token.io is not primarily pitching a new wallet to consumers. It is an access point through which established payment companies can manufacture their own account-to-account product. Competitors such as TrueLayer, Yapily, Tink, Volt, Trustly, GoCardless and Salt Edge attack overlapping territory, with different balances of bank data, checkout, merchant distribution and geographic reach. Token.io's sharpest angle is white-label infrastructure for large payment providers and banks.

“Pay by Bank was important for us to develop for one reason: to make our customers' lives easier.”Abbas Rana · HSBC Commercial Banking

The cost pitch is simple. The operating math is not.

Cards charge for the extraordinary convenience of a mature, global network. Token.io says a direct bank payment costs a fraction as much because it carries no card-scheme or interchange fee. It also avoids chargebacks. For a high-volume merchant, a loan provider collecting repayments or a platform funding customer accounts, a thinner toll on every transaction is immediately interesting. Settlement can be faster, too.

Token.io does not publish a price card. Its model is enterprise software and regulated infrastructure sold through commercial agreements, with white-label flows, licensing coverage and advisory work in the bundle. The disclosed cost of building the company gives another perspective: it raised $15 million in 2021 and $40 million in 2022, and public company databases put total funding around $90 million before or including an undisclosed 2025 strategic investment from HSBC. Removing a card fee is cheap to describe. Building reliable replacements across a continent is capital-intensive.

This is why the company's 95%-plus success claim in its strongest markets matters more than its bank count. A failed bank redirect is not an infrastructure anecdote to the merchant; it is an abandoned cart. Coverage also varies by market. Token.io says it reaches more than 90% of accounts in most of its 21 countries, careful wording that leaves room for the stubborn local bank, the unsupported payment type and the customer who simply prefers a card.

The first idea became two companies

Token.io's early ambition was broader: “put a bank in every app.” Its smart-token architecture could represent assets, rules and state without exposing sensitive account information. Alongside open-banking access, the team incubated a digital-money standard. In 2019, that second effort became M10. Kirsch and Nelson moved with the digital-money research, while Clyde continued leading Token.io.

Calling this a failure would be too tidy; the project was spun out, not buried. But it does reveal what changed management's mind about where focus belonged. Open banking had crossed from policy paper to working market. Token.io had processed an early UK open-banking payment in 2018, and banks needed production connectivity immediately. Digital money still needed its own research runway. Giving each proposition a separate company prevented the speculative one from distracting the commercial one.

The years since look like a steady filling-in of the practical gaps. HSBC's Open Payments partnership began in 2019. A $40 million Series C in 2022 funded expansion across Europe. Settlement, payouts and VRP moved the offer beyond a one-off payment button. In May 2025, Token.io became the first third-party provider admitted to Germany's giroAPI, a bank-led scheme for premium services beyond PSD2. One month later, HSBC became an investor. A customer buying equity after six years of using the product is a notably expensive form of reference call.

Recurring payments are the next checkout argument

One-off Pay by Bank competes with a card consumers already know. Commercial VRP attacks a softer target: the awkward middle between direct debit and card-on-file. A customer can agree limits on amount, frequency and beneficiary, then allow one-click or automated bank payments without authenticating every transaction. The possible uses are familiar - utility bills, subscriptions, government payments, ecommerce, wallet top-ups and credit-card repayments - but the underlying consent is more adjustable.

Britain's UK Payments Initiative brings banks, payment companies and fintechs together to turn commercial VRP into a scheme. Token.io is a participant, and its chief product officer, Charles Damen, joined the board. This is strategically convenient: Token.io already sells the connectivity and consent machinery, while a shared scheme can supply rules and wider acceptance that no infrastructure vendor can declare into existence alone.

There is the catch. Pay by Bank thrives where bank coverage is high, transfers are instant, transaction values make card fees painful and consumers are comfortable authenticating in a banking app. It is weaker when shoppers value card rewards, credit, familiar dispute protections or a checkout that works the same way worldwide. Recurring use also depends on banks and schemes supporting the right form of VRP. A merchant should keep another payment method available rather than turn an infrastructure thesis into a locked door.

What a merchant can copy on Monday

Start with the customer base, not a continent-shaped coverage number. Rank the banks customers actually use. Test the complete mobile journey for each major bank, including the return from authentication. Measure success separately from initiation, and segment failures by institution and device. Decide when goods can ship: on bank acceptance, on settlement notification or after reconciliation. Write the refund experience before the first refund arrives.

Then choose the narrowest valuable use case. Account top-ups and loan repayments often make a clearer opening than replacing every card at retail checkout. Use a hosted page if speed and maintained compliance matter more than pixel-level control; use APIs and embedded components when the experience justifies the engineering. Treat white labelling as more than changing a logo. The customer must understand who will move the money, why the bank is asking for consent and where help lives when something goes sideways.

Token.io's wager is that the payment industry's next mainstream rail will be assembled backstage. The company has raised money, collected licenses and spent a decade sanding down bank-specific edges so its customers can present a simple button. The button is not yet universal, and cards will not politely retire. But every time Pay by Bank works without making the shopper think about infrastructure, Token.io gets exactly the kind of attention it wants: none.