Like the others commenting I wonder if we are simply trying to develop a solution to mask the real problem? If we stop and reflect on reality we will remember that the PAN like a Social Security number or Passport number are simply Unique numbers we use as Digital Identifiers.

What we need is a means of providing strong authentication so that the relying party is assured that the individual presenting themselves, using that digital identifier, is the right party.

Simply tokenizing the account number does not solve the problem. It simply adds complexity and cost.

Solutions that help Merchants and Acquirers eliminate the PCI DSS requirements are great. Solutions that add dynamic data, unique to each transactions, sometimes called a Cryptogram, work. The challenge in creating this cryptogram requires a device, phone card or wearable with a secure element embedded within. A secure element capable of providing the necessary digital security through unique and positive authentication.

EMV, ICAO, NIST, FIDO and others have defined standards to achieve this result. Let's just commit to using what we know works and not try once again to invent a new mouse trap.