I reviewed a couple of e-commerce applications that use the same payment processor. In both cases the merchants store credit card tokens generated by the payment processor, in order to offer a 'remember this credit card' feature.
During the review I noticed that the same token is generated for both merchants for the same test credit card number. So it seems that the token generation is deterministic across different merchants. For me that would be a red flag, as it means the tokens themselves have the same value as the credit card numbers, i.e. if they are stolen from one merchant database they can be reused with other merchants.
Does such a deterministic token generation scheme conform to the pci standard? I've read the Tokenization Guidelines but didn't find any phrasing to explicitly forbid or discourage it.