A digital bank must reduce the systems that handle raw account numbers. What does tokenisation achieve, and what does it not?

What it achieves

Scope reduction. Systems that need to reference an account or card without needing its value hold a token instead, and those systems fall outside the compliance perimeter that handling the real value would impose.

The perimeter's size is the dominant cost of a compliance regime — every system inside inherits audit, retention, access control and assessment obligations — so shrinking it is the highest-leverage move available.

What it requires

• A vault that is the only system holding the mapping, with tightly controlled access, comprehensive audit, and its own high availability — because it is now a hard dependency of anything that needs the real value.
• Format-preserving tokens where downstream systems validate the format, since a token that fails a checksum breaks integrations that were never expecting to be given one.
• Deterministic tokenisation where joins are needed, so the same value always produces the same token and analytics can group without detokenising. This is what makes tokenised data useful rather than merely safe.
• A clear list of which systems may detokenise, enforced rather than documented, since the perimeter is defined by that list.

What it does not achieve

• It does not make the data non-personal. A deterministic token is a stable identifier for a person, which is still personal data under most regimes — so it reduces one obligation without removing another.
• It does not protect against a compromised system that can detokenise. If a service holds detokenisation rights, its compromise is equivalent to holding the values.
• It does not remove the retention obligation, which applies to the mapping.

The related pattern worth combining

Separating the record from the identity: keep regulated business facts under a pseudonymous reference and the reference-to-person mapping in a separately governed store. Deleting the mapping renders retained records non-identifying while preserving them for their regulatory purpose — which is how a retention obligation and an erasure right are both satisfied.

This must be designed early, because retrofitting it means rewriting every table that embedded an identifier, which in most systems is nearly every table.