There’s a payment problem coming in 2026 that most merchants won’t see until it costs them, customers. It looks like this: a card in your vault stops working, a recurring charge silently declines, and the first you hear about it is a support ticket or a churned subscriber. Multiply that across a portfolio of stored credentials, and you have a real revenue event, one that’s entirely avoidable with the right infrastructure in place.
Here’s what’s happening, why it matters, and what to do about it.
10 million cards are about to change, and your payments don’t know it yet
In 2026, Lloyds Banking Group is migrating roughly 10 million credit cards across Lloyds Bank, Halifax, Bank of Scotland, and MBNA from Mastercard to Visa. Peak activity runs from April 1 through December 31, 2026.
For merchants and payment platforms, that’s a ticking clock. Shoppers will receive brand-new Visa cards with new card numbers, and the old Mastercard credentials sitting in your system will go stale. The critical detail is that Lloyds Banking Group is not using account updater services for this migration. There’s no automated pipeline quietly refreshing the card details you have on file.
The result is predictable. Recurring payments, subscriptions, and Card on File (COF) charges linked to the old Mastercard BINs will begin to be declined.
Which BINs are affected?
The migration covers cards issued under Lloyds Banking Group’s UK portfolio, including BINs across Lloyds Bank, Halifax, Bank of Scotland, and MBNA credit cards.
If you run a subscription business or store cards for recurring billing in the UK, there’s a meaningful chance some of your stored credentials are in scope.
Why this matters: Card on File, CPAs, and the AU gap
Two payment patterns are especially exposed:
- Card on File (COF). If you store a card to charge a customer later, whether e-commerce, SaaS, or marketplaces, that stored PAN becomes wrong the moment the customer’s new Visa arrives.
- Continuous Payment Authorities (CPAs). Gym memberships, streaming services, insurance premiums, and utility autopay: all of these depend on the original card credentials staying valid. When the number changes and there’s no Account Updater bridge, the CPA fails silently until a customer notices they’ve lost access.
Without Account Updater and Network Tokenization in place, you’re flying blind. You won’t know a card changed until you get a hard decline, and by then, you’ve already produced a failed payment, a frustrated customer, and a support ticket.
VGS: the infrastructure layer that keeps you current
VGS sits between your platform and the card networks, turning this kind of disruption into a non-event.
Network Tokenization replaces the raw PANs in your system with network tokens, credentials managed and updated directly by Visa and Mastercard. When a card migrates, the token stays valid, and the underlying PAN is refreshed at the network level. No decline, no manual re-auth, no customer friction.
Account Updater proactively refreshes card credentials before you attempt a charge. Even when the issuer doesn’t opt into Account Updater, as in this Lloyds case, VGS can help you spot stale credentials early and prompt re-enrollment before a payment fails.
Vault Portability means your stored credentials aren’t locked to a single PSP or processor. As migrations force re-tokenization, VGS customers can route and update credentials without rearchitecting their stack thanks to the VGS Vault.
This isn’t a one-off
Lloyds isn’t the first, and it won’t be the last. Capital One’s large-scale portfolio shifts created similar disruption for merchants who weren’t prepared. The pattern is consistent: issuers migrate, networks change, and merchants without a tokenization and vault strategy absorb the pain.
The businesses that weather these events best are the ones that have decoupled their payment logic from raw card credentials, treating a stored PAN not as ground truth, but as a pointer that needs to stay current.
What to do now
If you process recurring payments or store cards for UK cardholders, the window to act is now, not after the first wave of December declines.
- Audit your stored credentials by identifying UK Lloyds-family BINs in your vault.
- Implement Network Tokenization to move from raw PANs to durable network tokens.
- Enable Account Updater flows so the re-auth and refresh logic is built before you need it.
- Partner with VGS to get the infrastructure layer that makes card migrations invisible to your business.
Protect recurring revenue before the next card migration hits.
See how VGS Network Tokenization, Account Updater, and Vault can keep credentials current and payments flowing.
Learn More
