Payment tokenisation enhances the underlying security of digital payments by potentially limiting the risk typically associated with compromised, unauthorised or fraudulent use of primary account numbers (PANs) or IBANs. Payment tokenisation achieves this by substituting PANs or IBANs with payment tokens that differ significantly in terms of the ability to control or restrict usage to a particular transaction environment, device or other domain. Prior to issuance of a new token to a Payment Service User (PSU), a PSP is required to verify that that cardholder is the rightful user of the PAN / IBAN, and bind the payment token to the underlying PAN / IBAN and the PSU. Following verification of the cardholder, the PSP issues a new token linked to the cardholder and the respective PAN / IBAN, creating a new payment instrument that can be used by the PSU to make tokenised transactions. Article 70 of PSD2 sets out the obligations of a PSP in relation to payment instruments, including ensuring that personalised security credentials are not accessible by third parties, refraining from sending unsolicited payment instruments, and enabling blocking / unblocking of the payment instrument. The PSP bears the risk of sending a payment instrument or any other personalised security credentials relating to it to the PSU. Article 4(45) of PSD defines the “issuing of payment instruments” as “a payment service by a payment service provider contracting to provide a payer with a payment instrument to initiate and process the payer’s payment transactions”. The issuance of a payment token to a PSU falls under this definition of “issuing of payment instruments” in (Article 4(45) of PSD) as it involves a PSP providing a payer with a payment instrument to initiate and process payment transactions. The obligations of the PSP regarding issuance of the payment instrument (i.e., the token) are expressly and definitively set out in Article 70 of PSD rendering Article 97 inapplicable to issuance of payment tokens. It is noteworthy that Article 97 of PSD2 relates to actions undertaken by a payer in the course of making a payment transaction, i.e., accessing an account, initiating a payment or undertaking an action that implies risk of payment fraud or other abuse. The creation of a payment instrument is not undertaken during a payment transaction, but involves a PSP issuing a new payment instrument to the payer for subsequent use. The PSP remains under an obligation to correctly verify the PSU prior to issuing the payment instrument following the rules set out in Article 70 of PSD2 and not Article 97 of PSD2 or Articles 6-9 of the EBA RTS which apply to payment transactions. PSPs are required to follow the requirements set out in Article 70 of PSD2 in relation to issuing a payment instrument, including ensuring that the personalised security credentials are not accessible to parties other than the payment service user, refraining from sending unsolicited payment instruments, ensuring appropriate means are available to block the payment instrument following loss, theft, misappropriation or unauthorised use. PSPs continue to bear the risk, by virtue of Article 70(2) of PSD2, of sending a payment instrument or any personalised security credentials to the PSU. The requirements under Article 70 of PSD2 provide adequate protection to PSUs in relation to issuance of payment instruments (such as tokens).