diff --git a/addons/payment/security/payment_security.xml b/addons/payment/security/payment_security.xml
index 4e63760ada3..e51b25f981a 100644
--- a/addons/payment/security/payment_security.xml
+++ b/addons/payment/security/payment_security.xml
@@ -10,7 +10,7 @@
     <record id="payment_token_user_rule" model="ir.rule">
         <field name="name">Access own payment tokens only</field>
         <field name="model_id" ref="payment.model_payment_token"/>
-        <field name="domain_force">['|', ('partner_id','=',user.partner_id.id), ('partner_id', '=', user.partner_id.commercial_partner_id.id)]</field>
+        <field name="domain_force">[('partner_id', 'child_of', user.partner_id.commercial_partner_id.id)]</field>
         <field name="groups" eval="[(4, ref('base.group_user')), (4, ref('base.group_portal')), (4, ref('base.group_public'))]"/>
     </record>
 
diff --git a/addons/website_sale/controllers/main.py b/addons/website_sale/controllers/main.py
index 29caf458371..49ec6300129 100644
--- a/addons/website_sale/controllers/main.py
+++ b/addons/website_sale/controllers/main.py
@@ -838,8 +838,9 @@ class WebsiteSale(http.Controller):
         values['access_token'] = order.access_token
         values['acquirers'] = [acq for acq in acquirers if (acq.payment_flow == 'form' and acq.view_template_id) or
                                     (acq.payment_flow == 's2s' and acq.registration_view_template_id)]
-        values['tokens'] = request.env['payment.token'].search(
-            [('acquirer_id', 'in', acquirers.ids)])
+        values['tokens'] = request.env['payment.token'].search([
+            ('acquirer_id', 'in', acquirers.ids),
+            ('partner_id', 'child_of', order.partner_id.commercial_partner_id.id)])
 
         if order:
             values['acq_extra_fees'] = acquirers.get_acquirer_extra_fees(order.amount_total, order.currency_id, order.partner_id.country_id.id)