Migrate saved cards from another payment provider

Transfer your card vault to Revolut - no re-entry required, subscriptions continue from day one.

When you switch payment providers, Revolut can import your existing customers' saved card data so subscriptions and one-click checkouts continue without interruption - no cardholder action required. The process uses PGP (Pretty Good Privacy)-encrypted file transfers over SFTP (SSH File Transfer Protocol) to maintain PCI DSS (Payment Card Industry Data Security Standard) Level 1 compliance throughout.

Card migration is available to PCI DSS (Payment Card Industry Data Security Standard) Level 1 certified merchants.

If your business is not directly PCI DSS Level 1 certified, you can coordinate the export directly between your current provider and Revolut.

Before starting migration, ensure your Revolut integration is live and tested for new customers. Processing new customers through Revolut while migration is in progress means you don't need to pause operations during the transition.

How it works

This migration is a coordinated manual process involving the following tools and parties:

Your integration team: initiates the migration request, coordinates between your current provider and Revolut, and updates your systems once the mapping file is received.
Your current payment provider (or relevant PCI compliant party): exports your customer card vault data in a Revolut-compatible CSV format, encrypts it with GPG, and uploads it to Revolut via SFTP. For listed providers (Stripe, Adyen, Braintree), the export format is handled automatically.
GPG: encrypts the payment data file with Revolut's public PGP (Pretty Good Privacy) key before transfer.
SFTP client: connects to Revolut's secure file transfer server via SFTP (SSH File Transfer Protocol) to upload the encrypted file.
Revolut: configures SFTP access for your provider, receives and imports the file, then delivers the mapping file to your team once migration completes.
Your database: updated using the mapping file to replace old provider IDs with new Revolut customer and payment method IDs.

The migration unfolds in three phases:

Prepare: Contact Revolut and your current provider. Your provider prepares and encrypts the payment data file.
Migrate: Your provider uploads the encrypted file via SFTP - migration starts automatically once Revolut receives it.
Resume: Apply the mapping file Revolut sends you, update your database with the new IDs, and resume charging migrated cards.

Encryption with GPG

GPG (GNU Privacy Guard) is a free implementation of the PGP encryption standard. It uses asymmetric cryptography - your provider encrypts the file with Revolut's public key, and only Revolut's servers hold the corresponding private key to decrypt it. This ensures the file is unreadable to anyone who intercepts it during transfer, including network operators and storage providers. PCI DSS Level 1 compliance requires card data to be encrypted whenever it leaves a secure environment.

Secure file transfer with SFTP

SFTP (SSH File Transfer Protocol) is a network protocol for secure file transfer over SSH. Revolut uses a dedicated SFTP server for card migration - access is restricted to your provider's IP address and authenticated with SSH keys, not passwords. This provides a private, encrypted channel for delivering the PGP-encrypted file. The combination of GPG encryption (file-level) and SFTP (transport-level) means the card data is protected both at rest and in transit.

Before you begin

PCI DSS Level 1 certification confirmed, or confirm Revolut can receive the export directly from your current provider
A Revolut point of contact, or reach out to merchant-integration@revolut.com
Access to your current provider's data export or migration process

The following prerequisites apply to your current provider (or the relevant PCI compliant party) who performs the file preparation, encryption, and upload steps:

GPG installed locally (brew install gnupg on macOS, apt install gnupg on Linux)
SFTP client installed locally (built-in on macOS, apt install openssh-client on Linux)

Migrate your payment data

The steps below walk through the migration in sequence. Each step represents a hand-off between the parties listed in the overview - from the initial agreement with providers, through file preparation and secure delivery, to applying the results to your database.

The file preparation, encryption, and upload steps below are performed by your current provider (or the relevant PCI compliant party). Share this guide with them so they can follow the process.

1. Contact Revolut and your current provider

Before any data moves, both parties need to agree on the scope and timing of the export. Revolut prepares your SFTP access; your current provider handles the card data export.

Reach out to Revolut to start the migration request, and tell your current provider you want to transfer customer card data to Revolut. Copy your Revolut point of contact into the conversation with your provider so both sides can coordinate directly.

Your current provider will need to know where to send the data. Your current provider (or the relevant PCI compliant party) exports the file to Revolut as described in this process.

The following providers have established migration processes:

2. Prepare the payment data file

This step produces the CSV file that will be encrypted and sent to Revolut in the next steps. The format depends on your current provider - providers listed below export a file compatible with Revolut's processing. All others should use the default format.

Supported provider formats

Revolut natively handles export files from Stripe, Adyen, and Braintree. No field mapping or format conversion is required on your side.

Stripe: Export file formats

Stripe's official documentation for card migration export file formats.

Adyen: Token migration export format

Adyen's official documentation for preparing token migration exports.

Braintree: Export file headers

Braintree's official documentation for data migration export file headers.

If your current provider is not listed, use the default format.

Default format

The default format mirrors the Stripe CSV structure. Required fields apply regardless of which provider format you use.

Column	Description	Required
`name`	Customer's name	No
`email`	Customer's email address	Yes
`id`	Unique customer identifier in your current payment provider	Yes
`card.id`	Unique card identifier in your current payment provider	Yes
`card.number`	Card PAN (Primary Account Number)	Yes
`card.exp_month`	Card expiry month	Yes
`card.exp_year`	Card expiry year	Yes
`card.address_city`	Billing address city	No
`card.address_country`	2-letter ISO country code for the billing address	No
`card.address_line1`	Billing address line 1	No
`card.address_line2`	Billing address line 2	No
`card.address_state`	Billing address region or state	No
`card.address_zip`	Billing address postal code	No
`card.name`	Cardholder name as it appears on the card	No
`card.transaction_ids`	Initial scheme network transaction ID for the saved payment method	No

card.transaction_ids is required if you plan to use migrated cards for merchant-initiated transactions (MITs) such as recurring billing or subscriptions. Without it, subsequent MIT payments may be declined.

See Charge a saved payment method for how MITs work.

The card.id value acts as the unique identifier throughout the migration. If the same card ID appears on multiple rows, only the first occurrence is imported.

The following example includes all available columns:

CSV example

name,email,id,card.id,card.number,card.exp_month,card.exp_year,card.address_city,card.address_country,card.address_line1,card.address_line2,card.address_state,card.address_zip,card.name,card.transaction_ids
"John Doe","john.doe@example.com","127383TTHJ838","484756GHJK4849","4242424242424242","12","2027","London","GB","1 Example Street","Apt 1","England","EC1A 1BB","John Doe","012345678901234"

name,email,id,card.id,card.number,card.exp_month,card.exp_year,card.address_city,card.address_country,card.address_line1,card.address_line2,card.address_state,card.address_zip,card.name,card.transaction_ids
"John Doe","john.doe@example.com","127383TTHJ838","484756GHJK4849","4242424242424242","12","2027","London","GB","1 Example Street","Apt 1","England","EC1A 1BB","John Doe","012345678901234"

Formatting requirements

Verify these requirements before encrypting the file. A file that doesn't conform will be rejected during import, and you won't be able to replace it after uploading.

The file is in CSV format
The file is UTF-8 encoded
The file includes a header row
Columns are delimited by ,
All field values are wrapped in double quotes - for example, the test, field becomes "the test, field"
Empty fields are empty strings: "" - do not use NULL, N/A, or similar placeholders
Double quotes within a field are escaped by doubling them - for example, the "test" field becomes "the ""test"" field"
Fields contain no newline characters
All rows have the same number of columns

3. Encrypt the file

This step protects the card data while it's in transit. Your provider encrypts the file with Revolut's public key using GPG so that only Revolut's servers can read the contents - the file is unreadable to anyone else, including during transfer over the network.

Revolut public PGP key (production)

To encrypt your payment data file:

Copy the public key above and save it to a local file, for example revolut_public_key.txt.

Import the key:

gpg --import revolut_public_key.txt

Verify the key was imported correctly:

gpg --list-keys

Confirm the output shows the following fingerprint:

pub   rsa4096 2026-04-13 [SCEAR]
      99C181067A35115F2881D5D37490E41245EF4501
uid           [ unknown] Autogenerated Key <unspecified@secret-generator-backend-f469c8d5-x6p56>

Encrypt the payment data file as a .csv:

gpg --encrypt \
  --recipient 7490E41245EF4501 \
  --output payment_data_encrypted.csv \
  payment_data.csv

4. Upload via SFTP

The SFTP server is how your provider delivers the encrypted file to Revolut. Access is restricted - Revolut creates a dedicated account for your migration, locked to your provider's IP address and authenticated with SSH keys. Once the file is uploaded, the import starts automatically.

Get SFTP username

Revolut needs your provider's SSH public key and their connection IP address to set up access. Share the following with your Revolut point of contact:

Your provider's SSH public key - they generate a key pair if they don't have one:
ssh-keygen -t ed25519
ssh-keygen -t ed25519
The IP address your provider will connect from - Revolut adds this to the list of addresses permitted to connect.

Once configured, Revolut provides your provider with an SFTP username.

Upload the file

Migration starts automatically once the file is uploaded. The file is locked immediately after upload - it cannot be changed or deleted. Verify your data is complete and correct before uploading.

Connect to the Revolut SFTP server:

sftp -i <path-to-private-key> -P 2233 <username>@34.105.229.101

Upload the encrypted file to the upload folder:

put <path-to-encrypted-file> upload/<filename>.csv

Confirm the file was received:
ls upload
ls upload

Your Revolut point of contact communicates the expected processing time once the upload is confirmed.

5. Apply the mapping file

After Revolut processes your upload, your point of contact sends you a mapping file. This file is the link between your old provider's identifiers and the new Revolut IDs - use it to update your database so that future charges reach the correct payment methods. The mapping file is in CSV format. Only successfully imported cards appear in the file.

Column	Description
`old_customer_id`	Customer ID from your payment data file
`old_payment_method_id`	Card identifier from your payment data file
`customer_id`	Your customer's ID in Revolut
`payment_method_id`	Your payment method ID in Revolut
`method_details_fingerprint`	Fingerprint of the migrated card

Use this file to update your database, replacing your old provider's customer and card IDs with the corresponding Revolut IDs.

If you use subscriptions or recurring billing, update your recurring job configuration to reference the new payment_method_id values before processing the next charge cycle. Any jobs still referencing your old provider's card IDs will fail after migration.

Once updated, you can begin charging migrated payment methods through Revolut. Your Revolut point of contact confirms the expected processing time for the mapping file delivery.

Post-migration checklist

Before processing your first charge cycle with migrated cards, complete the following:

Mapping file received from Revolut point of contact
Database updated with new Revolut customer and payment method IDs
Recurring billing jobs updated to reference new payment_method_id values
First charge cycle monitored for unusual decline rates
Missing cards investigated with Revolut point of contact
Declined or expired cards handled per Charge a saved payment method

You've completed the card migration! Your customers' saved cards are now in Revolut and ready for charging - no re-enrollment required.

What's next

Charge a saved payment method

Charge migrated cards for one-time or merchant-initiated payments.

Set up a subscription management process

Resume recurring billing using migrated cards.

Migrate saved cards from another payment provider

How it works​

Encryption with GPG​

Secure file transfer with SFTP​

Before you begin​

Migrate your payment data​

1. Contact Revolut and your current provider​

2. Prepare the payment data file​

Supported provider formats​

Default format​

Formatting requirements​

3. Encrypt the file​

4. Upload via SFTP​

Get SFTP username​

Upload the file​

5. Apply the mapping file​

Post-migration checklist​

What's next​