It's both. Issuing banks can generate the payment tokens, but often, the networks can "stand-in" for the issuer, and generate the token for them on their behalf (the same way that networks can stand-in and do authorization of payments on behalf of the issuer).