Executive Summary
To enable new payment experiences like digital wallets, click to pay, and payment passkey, card issuers and processors meet growing regulatory and scheme mandates and manage large-scale releases across multiple use cases, wallets, and channels — all while guaranteeing frictionless, personalized, and cost-efficient payment experiences. To do so effectively, card issuers and processors need a cloud-based tokenization solution that increases speed and approval rates, decreases cost of ownership, and enhances the IT organization’s speed and flexibility.
Thales Tokenization is a scheme-agnostic, API-based cloud solution that enables card issuers and processors to manage the payment tokenization cycle end-to-end across all use cases. With a single integration, the platform deploys a set of capabilities and tools, including eligibility and user verification decision engines, token creation, management and reporting, and software development kit (SDK), to streamline UX across digital card tokenization, click to pay, push provisioning, and NFC payments through banking apps and mobile wallets. Card issuers and processors can use Thales Tokenization to quickly scale tokenization, reduce fraud, and free their internal IT team’s time to refocus on core value-added tasks.
Thales commissioned Forrester Consulting to conduct a Total Economic Impact™ (TEI) study and examine the potential return on investment (ROI) enterprises may realize by deploying Thales Tokenization.1 The purpose of this study is to provide readers with a framework to evaluate the potential financial impact of Thales Tokenization on their organizations.
To better understand the benefits, costs, and risks associated with this investment, Forrester interviewed four decision-makers with experience using Thales Tokenization. For the purposes of this study, Forrester aggregated the experiences of the interviewees and combined the results into a single composite organization, which is a card issuer/processor organization that has a legacy non-API tokenization solution, serves 10 million cardholders each with multiple tokens, and operates globally.
Interviewees said that prior to using Thales Tokenization, their organizations were struggling to triangulate the needs to comply with stricter card payment security regulations, reach the necessary go-to-market speed and scale, and keep ownership costs under control. The interviewees’ organizations were either not equipped to tokenize or using a non-API legacy tokenization solutions that yielded limited success, as they required inefficient, costly, and risky processes to adjust for any change in regulation or deploy for new use cases. This made the cost of scaling tokenization unsustainable, and the interviewees’ organizations feared they might start losing market share or halt growth if they did not find an alternative.
After the investment in Thales Tokenization, the interviewees’ organizations experienced faster deployment, easier integration, enhanced security, and more effective IT resource allocation to higher-value tasks. This resulted into enhanced capacity to fully sustain the steady growth of card tokenization across a number of use cases. Key results from the investment include gains from increased payment acceptance ratio, reduced fraud, and IT performance optimization.
Key Findings
Quantified benefits. Three-year, risk-adjusted present value (PV) quantified benefits for the composite organization include:
-
Increased payment acceptance ratio gains, leading to 10% more active tokens every year and more transaction fees gained. The single-integration, API-based, precertified platform eliminates the need for custom code and lengthy testing, which enables the composite organization to launch and implement Thales Tokenization faster across all existing use cases, open wallets, and domestic and global card schemes and allows the composite organization to have 10% more active tokens than with the in-house solution every year. Tokenized transactions have a 3.5% higher authorization rate than primary account number (PAN) transactions. Over three years and with the extra tokens enabling additional 52.5 million tokenized transactions by Year 3, the increased payment acceptance ratio gain is worth more than $434,000 to the composite organization.
-
Reduced fraud gains, leading to a 30% reduction of chargeback management costs yearly on all extra tokenized transactions. Fraud triggers chargebacks and card issuers and processors incur chargeback processing costs. Tokenized transactions reduce fraud by 30% with respect to PAN transactions, triggering 30% less chargeback requests. Over three years, with 3.7 million more active tokens in Year 3 enabling 52.5 million extra tokenized transactions and an average chargeback processing cost of $14 per transaction, the reduced fraud gain is worth about $1.2 million to the composite organization.
-
IT performance optimization gains, leading to progressive structural reallocation of six FTEs to higher-value activities. Moving from legacy-based tokenization to an API-driven tokenization platform like Thales Tokenization removes compliance infrastructure costs. Furthermore, it simplifies integration and deployment, eliminates ongoing friction deriving from manual code writing, and reduces maintenance overhead, reducing the IT team’s day-to-day work and freeing up their capacity across roles. The composite organization recaptures and reallocates this freed up time to higher-value activities, such as analyzing token transaction data for insights and improving user experience for cardholders. Over three years and with an initial tokenization team of 12 FTE, the IT performance optimization gain is worth more than $1.1 million to the composite organization.
Unquantified benefits. Benefits that provide value for the composite organization but are not quantified for this study include:
-
Increased revenue due to better card user experience. Frictionless and more secure payment experiences typically increase both card usage frequency and average transaction value, triggering more transaction processing fee revenue for the composite organization.
-
Enhanced innovation and strategic partnership enablement. By partnering with Thales, the composite organization gains early insight into upcoming technological and regulatory challenges as well as access to a set of best practices and use cases that transform those challenges into opportunities. This enables the composite organization to anticipate market trends and help its financial services customers stay a step ahead of emerging trends, thus helping the composite organization to position itself as a strategic partner to help its clients enhance customer experience and increase customer loyalty and retention.
-
Enhanced IT organization’s business literacy. By freeing up the time of the composite’s IT developers, testers, and operation team members to focus on more added-value projects and removing substantial resource allocation from low-value compliance tasks, the composite organization starts bridging the gap between IT and the business, enhancing the overall business literacy and capacity to collaborate effectively with business areas.
Costs. Three-year, risk-adjusted PV costs for the composite organization include:
-
Implementation costs. The costs encompass all internal resources dedicated to supporting the Thales Tokenization platform, including developers, testers, analysts, project managers, etc., as well as a fixed fee for the implementation. These costs amount to $462,000 and are incurred at the start of the project. They exclude the costs needed for digital wallet certifications since the composite organization would incur these costs anyway.
-
Subscription fee. These include the fee the composite organization pays for all the extra tokens enabled due to the Thales API-based solution, including compliance and maintenance, which adds up to $135,000 in Year 1, $225,000 in Year 2, and $337,000 in Year 3. These costs are calculated only on the extra tokens Thales enables because this study assumes that the composite organization is already using a legacy tokenization solution and would be tokenizing cards anyway.
The financial analysis that is based on the interviews found that a composite organization experiences benefits of $2.7 million over three years versus costs of $1.1 million, adding up to a net present value (NPV) of $1.6 million and an ROI of 150%.
$1.2M
Reduced fraud gains
Key Statistics
150%
Return on investment (ROI)
$2.7M
Benefits PV
$1.6M
Net present value (NPV)
11 months
Payback
Benefits (Three-Year)
The Thales Tokenization Customer Journey
Drivers leading to the Tokenization investment
Interviews
| Role | Industry | Function | Region | Cards Under Management |
|---|---|---|---|---|
| Payment product specialist | Financial services | Payments/card issuer | South Africa | 7 million |
| Product manager | Financial services | Payments/card issuer | Argentina | 10 million |
| Product owner, credit cards | Financial services | Payments/card issuer/processor | Argentina | 55 million |
| Head of product management and innovation | Financial services | Payments/card issuer/processor | Italy | 7 million |
Key Challenges
Interviewees noted that before using Thales, their organizations used legacy messaging-based solutions, did not implement tokenization at all, or implemented solutions that could only support one open wallet. Facing surging demand from the market, the interviewees’ organizations needed to push cards across all main digital wallets and to tokenize at speed and scale across a number of use cases while keeping token management costs under control. However, interviewees noted how their organizations struggled with common challenges, including:
-
Technical debt. Interviewees noted their non-API legacy systems did not support all card scheme requirements or supported them only at the cost of extended manual coding, lengthy testing, and separate integration efforts. The product owner of credit cards at a financial services organization noticed: “We had our own tokenization solution based on ISO messaging that couldn’t support the flow of open wallets, which involve additional user validation steps via ISO messaging. So we looked for a partner with an API-based solution to help us — all the things card schemes require regarding tokenization are supported way better by API than ISO.”
-
Unsustainable costs. Because the legacy systems did not support unified, multischeme protocols and standardized preintegrated connections, their costs were linked to tokens generated rather than active ones. Because of this, in order to scale and operate across applications, interviewees’ organizations would have to pay multiples of the total amount of cards under management. The head of product management and innovation at a financial services organization said: “Our cost structure was linked to the number of tokens that were created on every single card. As you can imagine, this could not support exponential growth of active tokens. So you may say that the model we had wasn’t suited anymore to the business context in which we were moving.”
-
Forced inefficient IT resource allocation. Interviewees noted that their legacy solutions forced internal teams to develop and test new modules within the card authorization switch and card management system (CMS) to handle token events (e.g., provisioning, wallet binding, cryptogram validation, lifecycle updates) in real time. Furthermore, it made internal teams responsible for navigating all the scheme certification processes. None of those activities were deemed core capabilities that internal IT teams should possess or develop. The payment product specialist at a financial services organization said: “We wanted to move some of the development required for a tokenization — both development and operational work — outside of our organization. The reason for this is that we wanted to free up some capacity within our IT team to do other, more business critical [for us] work.” The product owner of credit cards at a second financial services organization said: “If we were to migrate to our own API flow it would have taken longer and besides, APIs aren’t our core business. So if we were to do this by ourselves it would have required a lot of upfront investment and maintenance.”
Solution Requirements
The interviewees searched for a solution that could:
-
Support rapid scale. Interviewees wanted a solution that could support cross-application, cross-scheme, cross-wallet, and cross-channel tokenization at speed and that could support emerging or established use cases.
-
Contain cost and improve revenue. Interviewees wanted to reduce fraud at a faster pace, avoid card scheme penalty fees for nontokenized transactions, and decrease number of false positives to increase overall transaction margins and revenue.
-
Remove or decrease compliance burden and noncore IT work. Interviewees said they wanted to move the compliance and regulatory burden onto the vendor and abstract away integration complexity so that their IT teams could concentrate on higher-value activities while saving compliance costs.
Composite Organization
Based on the interviews, Forrester constructed a TEI framework, a composite company, and an ROI analysis that illustrates the areas financially affected. The composite organization is representative of the interviewees’ organizations, and it is used to present the aggregate financial analysis in the next section. The composite organization has the following characteristics:
-
Description of composite. The global, multimillion-dollar card issuer and processor manages the end-to-end card lifecycle, from digital and physical card issuance and transaction authorization to card lifecycle management and the orchestration of the technical flow of information to connect to global card networks. The composite organization has a strong brand, operates globally, and uses a non-API legacy tokenization solution. The composite serves 10 million cardholders, with an average five tokens per cardholder. Without Thales, the composite organization would be able to tokenize 30% of the overall cards under management in Year 1, 50% in Year 2, and 75% in Year 3. Each cardholder makes on average six tokenized transactions per month, with an average tokenized transaction value of $45.
-
Deployment characteristics. The composite organization begins using the solution in Year 1 following a six-month implementation period. After full rollout, the solution enables faster token provisioning. This results in 33% active tokens in Year 1, 55% in Year 2, and 82.5% in Year 3 — 10% more active tokens each year. The solution is deployed on all the global and national card schemes, geographies, applications, open wallets, and use cases.
KEY ASSUMPTIONS
-
10 million cardholders served
-
41,250,000 active tokens in Year 3
-
Six tokenized transactions per month per cardholder
-
$45 average tokenized transaction value
Analysis Of Benefits
Quantified benefit data as applied to the composite
Total Benefits
| Ref. | Benefit | Year 1 | Year 2 | Year 3 | Total | Present Value |
|---|---|---|---|---|---|---|
| Atr | Increased payment acceptance ratio gains | $104,186 | $173,644 | $260,466 | $538,296 | $433,914 |
| Btr | Reduced fraud gains | $277,830 | $463,050 | $694,575 | $1,435,455 | $1,157,103 |
| Ctr | IT performance optimization gains | $274,320 | $458,640 | $642,960 | $1,375,920 | $1,111,489 |
| Total benefits (risk-adjusted) | $656,336 | $1,095,334 | $1,598,001 | $3,349,671 | $2,702,506 |
Increased Payment Acceptance Ratio Gains
Evidence and data. Interviewees mentioned that their organizations’ legacy technical debt made it extremely lengthy to outright impossible to push cards into wallets, which slowed down tokenization onboarding. Adopting the Thales Tokenization platform streamlined engineering, reduced certification overhead, parallelized development, and precertified vendor support, which ultimately compressed integration and certification timelines to, in some cases, half the time. The head of product management and innovation at a financial services organization said: “We opted for Thales because it could be integrated with SDKs in our applications and apps, as well as in those of all our distributors — and that allowed us to manage layout customizations for each individual distributing bank. Thereby, we don’t have scalability and reliability issues, and it is natively secure, meaning it has security by design. This solution allowed us to decouple the legacy part from the digital front-end, massively reducing implementation times for new wallet and new features.”
Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:
-
The composite organization was tokenizing cards through a legacy solution, so the increased payment acceptance ratio gains are applied only to the yearly extra tokenized transactions enabled by the cloud-based, API-based Thales Tokenization platform.
-
The Thales API-based solution reduces the time needed for lengthy manual coding, resulting in a 10% active token uplift every year.
-
On average, cardholders make six tokenized transactions per month (72 tokenized transactions per year), with an average transaction value of $45.
-
On each transaction, a card issuer/payment processor gains a markup fee of 0.25% on average. Furthermore, false-decline processing costs amount to 0.1% of the overall transaction value.
-
Thales Tokenization increases acceptance rate (or decreased falsely-declined payments) by 3.5%, i.e., it enables a higher share of attempted transactions to be successfully completed.
Risks. Several factors may impact the level of incremental revenue that organizations realize from faster token onboarding performance, including the following:
-
The volume of active tokens and the share of transactions that are tokenized across channels and use cases might be lower as it ultimately depends on cardholders.
-
The average transaction value, transaction frequency per token, and the applicable processor markup fee might be lower.
-
Baseline authorization performance and the extent to which improved decisioning reduces false declines in the existing payments environment might be lower.
Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $434,000.
3.5%
Payment acceptance increase
Increased Payment Acceptance Ratio Gains
| Ref. | Metric | Source | Year 1 | Year 2 | Year 3 | |
|---|---|---|---|---|---|---|
| A1 | Total active cardholders | Composite | 10,000,000 | 10,000,000 | 10,000,000 | |
| A2 | Average token per cardholder | Composite | 5 | 5 | 5 | |
| A3 | Active token base without Thales API solution | Composite | 15,000,000 | 25,000,000 | 37,500,000 | |
| A4 | Total active token base with Thales API solution | A3+(A3*10%) | 16,500,000 | 27,500,000 | 41,250,000 | |
| A5 | Average yearly tokenized transaction per cardholder | Interviews | 72 | 72 | 72 | |
| A6 | Average CNP transactions per token per year | A5/A2 | 14 | 14 | 14 | |
| A7 | Annual CNP transactions through new tokens | (A4-A3)*A6 | 21,000,000 | 35,000,000 | 52,500,000 | |
| A8 | Average spend per tokenized transaction | Composite | $45 | $45 | $45 | |
| A9 | Transaction card markup and saved processing cost of falsely declined transactions | Composite | 0.35% | 0.35% | 0.35% | |
| A10 | Authorization uplift | Composite | 3.5% | 3.5% | 3.5% | |
| At | Increased payment acceptance ratio gains | A7*A8*A9*A10 | $115,763 | $192,938 | $289,406 | |
| Risk adjustment | ↓10% | |||||
| Atr | Increased payment acceptance ratio gains (risk-adjusted) | $104,186 | $173,644 | $260,466 | ||
| Three-year total: $538,296 | Three-year present value: $433,914 | |||||
Reduced Fraud Gains
Evidence and data. Interviewees mentioned that the increase of yearly tokenized transactions determined a sensible reduction of frauds and fraud-triggered chargebacks — all while guaranteeing a higher acceptance rate. The product manager at a financial services organization said: “Tokenization helps from a security standpoint because it adds an extra layer. It validates that the legitimate cardholder is the one who’s actually making the purchase.”
Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:
-
The composite organization was tokenizing transactions through a legacy solution, so the reduced fraud gains are applied only to the yearly extra tokenized transactions enabled by the cloud-based, API-based Thales Tokenization platform.
-
On average, 0.7% transactions trigger a chargeback, of which 50% are fraudulent.
-
A card issuer/processor has an average operating cost of $14 per chargeback request.
-
Thales Tokenization enables fraud prevention engines to more confidently identify legitime cardholders, reducing fraud-related chargebacks by 30%.
Risks. Several factors may impact the level of fraud-related cost savings that organizations realize from increases tokenization, including the following:
-
The actual proportion of transactions processed as tokenized transactions across channels and use cases.
-
Baseline fraud rates and chargeback levels prior to tokenization, which may vary by region, merchant mix, and card network.
-
Lower average operating costs per chargeback transaction.
Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $1.2 million.
30%
Reduction of fraud-related chargebacks
Reduced Fraud Gains
| Ref. | Metric | Source | Year 1 | Year 2 | Year 3 | |
|---|---|---|---|---|---|---|
| B1 | Annual CNP transactions through new tokens | A7 | 21,000,000 | 35,000,000 | 52,500,000 | |
| B2 | Transactions triggering chargebacks | Composite (B1*0.7%) | 147,000 | 245,000 | 367,500 | |
| B3 | Fraudulent chargeback transactions | Composite (B2*50%) | 73,500 | 122,500 | 183,750 | |
| B4 | Average chargeback transaction processing cost | Composite | $14 | $14 | $14 | |
| B5 | Delta fraud reduction for Thales API solution vs. PAN | Composite | 30% | 30% | 30% | |
| Bt | Reduced fraud gains | B3*B4*B5 | $308,700 | $514,500 | $771,750 | |
| Risk adjustment | ↓10% | |||||
| Btr | Reduced fraud gains (risk-adjusted) | $277,830 | $463,050 | $694,575 | ||
| Three-year total: $1,435,455 | Three-year present value: $1,157,103 | |||||
IT Performance Optimization Gains
Evidence and data. Interviewees mentioned that adopting the Thales API-based Tokenization platform meant simplified integration and lower maintenance overhead, leading to the substantial reduction of ongoing engineering and support personnel specifically dedicated to tokenization day to day. Time savings was driven by reduced coupling with the core authorization switch, lower change management and regression testing burdens, and improved error handling and version management provided by the Thales API and SDK. Interviewees noted that within the legacy environment, developers had to often write and maintain complex adapter code to translate between the core card processing switch and the interfaces; furthermore, every scheme update or new wallet introduction required code changes in the core authorization system or its interfaces. Finally, the tight coupling of the ISO interface with the core authorization system made operation teams face higher on-call and support burden as any issue in the tokenization chain directly impacted live transaction processing. Adopting the Thales platform meant abstracting away these complexities. Interviewees noted their developers could integrate via high-level API calls; testers could test the API calls and responses in isolation; and operations teams could monitor the integration points rather than manage low-level ISO link issues. The time personnel saved could be reallocated to drive innovation and deliver on the truly differentiating brand promise.
Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:
-
The composite organization has cross-functional team of 12 FTEs who were dedicated to tokenization. Furthermore, in the legacy environment, the entire processing stack is in scope for PCI DSS and needs bespoke controls and custom implementations.
-
The API environment allows structural reallocation of staff to other, higher-value activities.
-
The composite organization takes a phased approach to IT staff reallocation, moving two staff members to higher-value activities in Year 1, four in Year 2, and six in Year 3.
Risks. Several risk factors may impact the level of IT efficiency gains that organizations realize, including the following:
-
The degree of legacy complexity and the extent to which tokenization is fully decoupled from core authorization systems.
-
The speed at which organizations retire custom adapters and legacy integrations.
-
Differences in internal development practices and operational maturity that influence how quickly staffing efficiencies are realized.
Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $1.1 million.
6 FTEs
Number of personnel reallocated to higher-value activities
IT Performance Optimization Gains
| Ref. | Metric | Source | Year 1 | Year 2 | Year 3 | |
|---|---|---|---|---|---|---|
| C1 | Compliance infrastructure costs with legacy solution | Composite | $100,000 | $100,000 | $100,000 | |
| C2 | Structural FTEs reallocated to higher-value activities | Composite | 2 | 4 | 6 | |
| C3 | Fully burdened annual salary for an FTE | Composite | $128,000 | $128,000 | $128,000 | |
| C4 | Productivity recapture rate | TEI methodology | 80% | 80% | 80% | |
| C5 | IT productivity improvement | C3*C4 | $102,400 | $102,400 | $102,400 | |
| C6 | FTE savings | C2*C5 | $204,800 | $409,600 | $614,400 | |
| Ct | IT performance optimization gains | C1+C6 | $304,800 | $509,600 | $714,400 | |
| Risk adjustment | ↓10% | |||||
| Ctr | IT performance optimization gains (risk-adjusted) | $274,320 | $458,640 | $642,960 | ||
| Three-year total: $1,375,920 | Three-year present value: $1,111,489 | |||||
Unquantified Benefits
Interviewees mentioned the following additional benefits that their organizations experienced but were not able to quantify:
-
Increased revenue due to better card user experience. Interviewees noted that cardholders could choose the payment method they trust more. Two key components of trust were customer experience and security. Frictionless payment experiences impacted customer loyalty and retention by strengthening customer trust in the reliability of the payment method. Payment security impacted their organizations’ growth by making customers feel they could use a card to make higher-value payments. Interviewees noted that these elements combined trigger more transaction processing fee revenue — more transactions for an increased average value.
-
Enhanced innovation and strategic partnership enablement. In their competitive landscape, the interviewees’ financial service institutions needed their card issuing and processing providers to become strategic, innovation-driven partners that could help them retain and grow their customers through provision of better payment experiences. They expected card issuers to proactively provide personalization, speed, and enhanced security. By partnering with Thales, interviewees noted their organizations were able to gain early insight into upcoming technological and regulatory challenges as well as access to a set of best practices and use cases that transform those challenges into opportunities. This enabled the interviewees’ organizations to anticipate market trends and help their customers stay a step ahead of emerging trends, thus helping their organizations position itself as a strategic partner to help those clients enhance customer experience and increase customer loyalty and retention.
-
Enhanced IT organization’s business literacy. In the context of AI-driven disruption, IT talent is becoming a key asset to win and retain customers. However, many interviewees noted that IT talent attraction and retention is their organizations’ Achilles’ heel as IT operations are often still filled with low-value, administrative and manual tasks that harm IT teams’ capacity to meaningfully contribute to the innovation funnel. By freeing up the time of IT developers, testers, and operation team members to focus on more added-value tasks and removing substantial resource allocation to compliance tasks, the interviewees’ organizations could start closing the gap between IT and the business, enhancing overall business literacy and capacity to collaborate effectively with business areas.
Flexibility
The value of flexibility is unique to each customer. There are multiple scenarios in which a customer might implement Thales Tokenization and later realize additional uses and business opportunities, including:
-
Enabling enhanced services. The product owner of credit cards at a financial services organization said: “We’re migrating to their solution because it offers other benefits, in terms of possibilities and functionalities with the banks. For instance, it gives us better lifecycle tracking.”
-
Adding revenue-generating use cases. The payment product specialist at a financial services organization said: “Something that we were not initially thinking about when we got a supplier for tokenization was click to pay. We were just looking at pushing tokenization to merchants and to wallets — but now the click-to-pay component, which Thales has, is very attractive to us.”
-
Enhancing security. The product manager at a financial services organization said: “We also decided to implement the 3D secure protocol with them. We estimate that in our region, 3D secure protocol is going to be massively implemented, so we wanted to move ahead of the regulators and of the market.”
Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Total Economic Impact Approach).
Analysis Of Costs
Quantified cost data as applied to the composite
Total Costs
| Ref. | Cost | Initial | Year 1 | Year 2 | Year 3 | Total | Present Value |
|---|---|---|---|---|---|---|---|
| Dtr | Implementation costs | $462,000 | $0 | $0 | $0 | $462,000 | $462,000 |
| Etr | Subscription costs | $0 | $148,500 | $247,500 | $371,250 | $767,250 | $618,471 |
| Total costs (risk-adjusted) | $462,000 | $148,500 | $247,500 | $371,250 | $1,229,250 | $1,080,471 |
Implementation Costs
Evidence and data. Interviewees explained that deploying Thales Tokenization required coordinated effort across payments, IT security, and digital commerce teams. Initial implementation focused on defining tokenization scope and use cases, configuring Thales services, integrating with existing payment processors and card networks, and updating internal systems to consume tokenized data. Interviewees also noted their organizations invested time in governance design, security reviews, and operations enablement to support compliant token lifecycle management and monitoring. While Thales offers well-documented APIs and pre-integrated connections to major payment schemes, interviewees noted that internal effort was still required to adapt legacy payment flows, rationalize existing token solutions, and test transaction routing and acceptance at scale. Implementation timelines varied by transaction volume, payment channels, and regulatory complexity, with most interviewees’ organizations completing initial rollout within six months.
Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:
-
It incurs a one-time implementation cost of $100,000, primarily associated with the platform setup.
-
Five FTEs support the implementation of Thales Tokenization over six months.
-
These costs represent time spent by cross‑functional resources including payments architects, IT security specialists, application developers, and operations staff, partially offset by Thales’ prebuilt integrations and standardized tokenization APIs.
Risks. The following risks could impact the cost and duration of implementing Thales Tokenization:
-
Complexity of the legacy environment, which may lengthen the implementation period and/or integration efforts.
-
Variability in internal payment and security expertise.
-
Regulatory and geographic scope, where additional compliance reviews or local payment schemes could increase implementation effort.
Results. To account for these risks, Forrester adjusted this cost upward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $462,000.
6 months
Time for implementation
Implementation Costs
| Ref. | Metric | Source | Initial | Year 1 | Year 2 | Year 3 |
|---|---|---|---|---|---|---|
| D1 | Fixed implementation costs with Thales | Composite | $100,000 | |||
| D2 | Internal resources to support implementation (FTE) | Interviews | 5 | |||
| D3 | Months for implementation | Interviews | 6 | |||
| D4 | Fully burdened annual salary for an internal resource | Composite | $128,000 | |||
| D5 | Total internal support cost (FTE) | (D2/12)*D3*D4 | $320,000 | |||
| Dt | Implementation costs | D1+D5 | $420,000 | $0 | $0 | $0 |
| Risk adjustment | ↑10% | |||||
| Dtr | Implementation costs (risk-adjusted) | $462,000 | $0 | $0 | $0 | |
| Three-year total: $462,000 | Three-year present value: $462,000 | |||||
Subscription Costs
Evidence and data. Interviewees notes that their organizations’ Thales subscription costs were based primarily on the number of Tokens and the tiered pricing structure (given the number of tokens).
Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:
-
The composite organization was tokenizing transactions through a legacy solution, so the subscription costs apply only to the yearly extra tokens enabled by the Thales API-based Tokenization platform.
-
The legacy solution and the Thales Tokenization solution have an identical cost per token.
-
The composite incurs $135,000 subscription fees in Year 1, $225,000 in Year 2, and $337,500 in Year 3 to account for the increasing number of active tokens.
Risks. A risk that can potentially impact licensing costs is volume discounts and pricing changes over time.
Results. To account for these risks, Forrester adjusted this cost upward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $618,000.
Subscription Costs
| Ref. | Metric | Source | Initial | Year 1 | Year 2 | Year 3 |
|---|---|---|---|---|---|---|
| E1 | Extra active tokens with Thales | Composite | 1,500,000 | 2,500,000 | 3,750,000 | |
| E2 | Subscription fee | Composite | $135,000 | $225,000 | $337,500 | |
| Et | Subscription costs | E2 | $135,000 | $225,000 | $337,500 | |
| Risk adjustment | ↑10% | |||||
| Etr | Subscription costs (risk-adjusted) | $0 | $148,500 | $247,500 | $371,250 | |
| Three-year total: $767,250 | Three-year present value: $618,471 | |||||
Financial Summary
Consolidated Three-Year, Risk-Adjusted Metrics
Cash Flow Chart (Risk-Adjusted)
Cash Flow Analysis (Risk-Adjusted)
| Initial | Year 1 | Year 2 | Year 3 | Total | Present Value | |
|---|---|---|---|---|---|---|
| Total costs | ($462,000) | ($148,500) | ($247,500) | ($371,250) | ($1,229,250) | ($1,080,471) |
| Total benefits | $0 | $656,336 | $1,095,334 | $1,598,001 | $3,349,671 | $2,702,506 |
| Net benefits | ($462,000) | $507,836 | $847,834 | $1,226,751 | $2,120,421 | $1,622,035 |
| ROI | 150% | |||||
| Payback | 11 months |
Please Note
The financial results calculated in the Benefits and Costs sections can be used to determine the ROI, NPV, and payback period for the composite organization’s investment. Forrester assumes a yearly discount rate of 10% for this analysis.
These risk-adjusted ROI, NPV, and payback period values are determined by applying risk-adjustment factors to the unadjusted results in each Benefit and Cost section.
The initial investment column contains costs incurred at “time 0” or at the beginning of Year 1 that are not discounted. All other cash flows are discounted using the discount rate at the end of the year. PV calculations are calculated for each total cost and benefit estimate. NPV calculations in the summary tables are the sum of the initial investment and the discounted cash flows in each year. Sums and present value calculations of the Total Benefits, Total Costs, and Cash Flow tables may not exactly add up, as some rounding may occur.
From the information provided in the interviews, Forrester constructed a Total Economic Impact™ framework for those organizations considering an investment in Thales Tokenization.
The objective of the framework is to identify the cost, benefit, flexibility, and risk factors that affect the investment decision. Forrester took a multistep approach to evaluate the impact that Thales Tokenization can have on an organization.
Due Diligence
Interviewed Thales stakeholders and Forrester analysts to gather data relative to Thales Tokenization.
Interviews
Interviewed four decision-makers at organizations using Thales Tokenization to obtain data about costs, benefits, and risks.
Composite Organization
Designed a composite organization based on characteristics of the interviewees’ organizations.
Financial Model Framework
Constructed a financial model representative of the interviews using the TEI methodology and risk-adjusted the financial model based on issues and concerns of the interviewees.
Case Study
Employed four fundamental elements of TEI in modeling the investment impact: benefits, costs, flexibility, and risks. Given the increasing sophistication of ROI analyses related to IT investments, Forrester’s TEI methodology provides a complete picture of the total economic impact of purchase decisions. Please see Appendix A for additional information on the TEI methodology.
Total Economic Impact Approach
Benefits
Benefits represent the value the solution delivers to the business. The TEI methodology places equal weight on the measure of benefits and costs, allowing for a full examination of the solution’s effect on the entire organization.
Costs
Costs comprise all expenses necessary to deliver the proposed value, or benefits, of the solution. The methodology captures implementation and ongoing costs associated with the solution.
Flexibility
Flexibility represents the strategic value that can be obtained for some future additional investment building on top of the initial investment already made. The ability to capture that benefit has a PV that can be estimated.
Risks
Risks measure the uncertainty of benefit and cost estimates given: 1) the likelihood that estimates will meet original projections and 2) the likelihood that estimates will be tracked over time. TEI risk factors are based on “triangular distribution.”
Financial Terminology
Present value (PV)
The present or current value of (discounted) cost and benefit estimates given at an interest rate (the discount rate). The PVs of costs and benefits feed into the total NPV of cash flows.
Net present value (NPV)
The present or current value of (discounted) future net cash flows given an interest rate (the discount rate). A positive project NPV normally indicates that the investment should be made unless other projects have higher NPVs.
Return on investment (ROI)
A project’s expected return in percentage terms. ROI is calculated by dividing net benefits (benefits less costs) by costs.
Discount rate
The interest rate used in cash flow analysis to take into account the time value of money. Organizations typically use discount rates between 8% and 16%.
Payback
The breakeven point for an investment. This is the point in time at which net benefits (benefits minus costs) equal initial investment or cost.
Appendix A
Total Economic Impact
Total Economic Impact is a methodology developed by Forrester Research that enhances a company’s technology decision-making processes and assists solution providers in communicating their value proposition to clients. The TEI methodology helps companies demonstrate, justify, and realize the tangible value of business and technology initiatives to both senior management and other key stakeholders.
Appendix B
Endnotes
1 Total Economic Impact is a methodology developed by Forrester Research that enhances a company’s technology decision-making processes and assists solution providers in communicating their value proposition to clients. The TEI methodology helps companies demonstrate, justify, and realize the tangible value of business and technology initiatives to both senior management and other key stakeholders.
Disclosures
Readers should be aware of the following:
This study is commissioned by Thales and delivered by Forrester Consulting. It is not meant to be used as a competitive analysis.
Forrester makes no assumptions as to the potential ROI that other organizations will receive. Forrester strongly advises that readers use their own estimates within the framework provided in the study to determine the appropriateness of an investment in Thales Tokenization. For any interactive functionality, the intent is for the questions to solicit inputs specific to a prospect’s business. Forrester believes that this analysis is representative of what companies may achieve with Thales Tokenization based on the inputs provided and any assumptions made. Forrester does not endorse Thales or its offerings. Although great care has been taken to ensure the accuracy and completeness of this model, Thales and Forrester Research are unable to accept any legal responsibility for any actions taken on the basis of the information contained herein. The interactive tool is provided ‘AS IS,’ and Forrester and Thales make no warranties of any kind.
Thales reviewed and provided feedback to Forrester, but Forrester maintains editorial control over the study and its findings and does not accept changes to the study that contradict Forrester’s findings or obscure the meaning of the study.
Thales provided the customer names for the interviews but did not participate in the interviews.
Consulting Team:
Edoardo Zavarella
Emillianna Grootendorst
Published
July 2026
PDF