diff --git a/src/include/taler_crypto_lib.h b/src/include/taler_crypto_lib.h
index fc3cb1667..95974e20d 100644
--- a/src/include/taler_crypto_lib.h
+++ b/src/include/taler_crypto_lib.h
@@ -2612,14 +2612,14 @@ struct TALER_AgeCommitment
    * generation of this age commitment */
   struct TALER_AgeMask mask;
 
-  /* The number of public keys, which must be the same as the number of groups
-   * in the mask
+  /* The number of public keys, which must be the same as the number of
+   * groups in the mask
    */
-  size_t num_keys;
+  size_t num_pub_keys;
 
   /* A NULL-terminated list of public keys.
-   * The list must be exactly of length num_keys, i. e. the same as the number
-   * of age groups defined in the mask.
+   * The list must be exactly of length @a num_pub_keys, i. e. the same as the
+   * number of age groups defined in the mask.
    *
    * A hash of this list is the hashed commitment that goes into FDC
    * calculation during the withdraw and refresh operations for new coins. That
@@ -2628,7 +2628,7 @@ struct TALER_AgeCommitment
   struct TALER_AgeCommitmentPublicKeyP *pub;
 
   /* A NULL-terminated list of private keys.
-   * Note that the list can be smaller than the corresponding list of public
+   * Note that the list can be _smaller_ than the corresponding list of public
    * keys! In that case, the wallet can sign off only for a subset of the age
    * groups.
    */
diff --git a/src/include/taler_exchange_service.h b/src/include/taler_exchange_service.h
index 83bd00d67..2c964b582 100644
--- a/src/include/taler_exchange_service.h
+++ b/src/include/taler_exchange_service.h
@@ -1481,6 +1481,8 @@ TALER_EXCHANGE_withdraw2_cancel (struct TALER_EXCHANGE_Withdraw2Handle *wh);
  * @param melt_pk denomination key information
  *                   record corresponding to the @a melt_sig
  *                   validity of the keys
+ * @param age_commitment (optional) age commitment that went into the original
+ *                   coin.  Maybe NULL, if no age commitment was provided.
  * @param fresh_pks_len length of the @a pks array
  * @param fresh_pks array of @a pks_len denominations of fresh coins to create
  * @return NULL
@@ -1495,6 +1497,7 @@ TALER_EXCHANGE_refresh_prepare (
   const struct TALER_Amount *melt_amount,
   const struct TALER_DenominationSignature *melt_sig,
   const struct TALER_EXCHANGE_DenomPublicKey *melt_pk,
+  const struct TALER_AgeCommitment *age_commitment,
   unsigned int fresh_pks_len,
   const struct TALER_EXCHANGE_DenomPublicKey *fresh_pks);
 
diff --git a/src/lib/exchange_api_refresh_common.c b/src/lib/exchange_api_refresh_common.c
index ecb5c0152..978d3e275 100644
--- a/src/lib/exchange_api_refresh_common.c
+++ b/src/lib/exchange_api_refresh_common.c
@@ -343,6 +343,7 @@ TALER_EXCHANGE_refresh_prepare (
   const struct TALER_Amount *melt_amount,
   const struct TALER_DenominationSignature *melt_sig,
   const struct TALER_EXCHANGE_DenomPublicKey *melt_pk,
+  const struct TALER_AgeCommitment *age_commitment,
   unsigned int fresh_pks_len,
   const struct TALER_EXCHANGE_DenomPublicKey *fresh_pks)
 {
@@ -375,6 +376,7 @@ TALER_EXCHANGE_refresh_prepare (
                              melt_sig);
   md.fresh_pks = GNUNET_new_array (fresh_pks_len,
                                    struct TALER_DenominationPublicKey);
+
   for (unsigned int i = 0; i<fresh_pks_len; i++)
   {
     TALER_denom_pub_deep_copy (&md.fresh_pks[i],
@@ -393,6 +395,7 @@ TALER_EXCHANGE_refresh_prepare (
       return NULL;
     }
   }
+
   /* verify that melt_amount is above total cost */
   if (1 ==
       TALER_amount_cmp (&total,
@@ -416,10 +419,16 @@ TALER_EXCHANGE_refresh_prepare (
     TALER_link_derive_transfer_secret  (melt_priv,
                                         &md.melted_coin.transfer_priv[i],
                                         &trans_sec[i]);
+
     md.fresh_coins[i] = GNUNET_new_array (fresh_pks_len,
                                           struct TALER_PlanchetSecretsP);
+
     rce[i].new_coins = GNUNET_new_array (fresh_pks_len,
                                          struct TALER_RefreshCoinData);
+
+    md.fresh_ach[i] = GNUNET_new_array (fresh_pks_len,
+                                        struct TALER_AgeCommitment);
+
     for (unsigned int j = 0; j<fresh_pks_len; j++)
     {
       struct TALER_PlanchetSecretsP *fc = &md.fresh_coins[i][j];
@@ -433,7 +442,7 @@ TALER_EXCHANGE_refresh_prepare (
       if (GNUNET_OK !=
           TALER_planchet_prepare (&md.fresh_pks[j],
                                   fc,
-                                  NULL, /* FIXME-oec: struct TALER_AgeCommitmentHash * */
+                                  &md.fresh_ach[j],
                                   &c_hash,
                                   &pd))
       {
@@ -454,6 +463,7 @@ TALER_EXCHANGE_refresh_prepare (
                                 rce,
                                 &coin_pub,
                                 melt_amount);
+
   /* finally, serialize everything */
   ret = serialize_melt_data (&md);
   for (unsigned int i = 0; i < TALER_CNC_KAPPA; i++)
@@ -462,6 +472,7 @@ TALER_EXCHANGE_refresh_prepare (
       GNUNET_free (rce[i].new_coins[j].coin_ev);
     GNUNET_free (rce[i].new_coins);
   }
+
   TALER_EXCHANGE_free_melt_data_ (&md);
   return ret;
 }
diff --git a/src/testing/testing_api_cmd_refresh.c b/src/testing/testing_api_cmd_refresh.c
index d2c2c714c..4d2fa803f 100644
--- a/src/testing/testing_api_cmd_refresh.c
+++ b/src/testing/testing_api_cmd_refresh.c
@@ -1076,6 +1076,7 @@ melt_run (void *cls,
                                         &melt_amount,
                                         melt_sig,
                                         melt_denom_pub,
+                                        NULL, /* FIXME-oec */
                                         num_fresh_coins,
                                         rms->fresh_pks);
     if (NULL == rms->refresh_data)
diff --git a/src/util/crypto.c b/src/util/crypto.c
index 18503b88f..eb8ed89c7 100644
--- a/src/util/crypto.c
+++ b/src/util/crypto.c
@@ -375,11 +375,11 @@ TALER_age_commitment_hash (
   struct GNUNET_HashCode hash;
   GNUNET_assert (NULL != commitment);
   GNUNET_assert (__builtin_popcount (commitment->mask.mask) ==
-                 commitment->num_keys);
+                 commitment->num_pub_keys);
 
   hash_context = GNUNET_CRYPTO_hash_context_start ();
 
-  for (size_t i = 0; i < commitment->num_keys; i++)
+  for (size_t i = 0; i < commitment->num_pub_keys; i++)
   {
     GNUNET_CRYPTO_hash_context_read (hash_context,
                                      &commitment->pub[i],