I’m working on a project involving Visa Tokenization Services where nonce is used. However, the no replay aspect is not there in Visa’s use of nonce. Instead there is just a signed expiring token (nonce) that must be verified.