Card limits, MCC blocks and approvals: a spend control setup that works

Start with the card transaction lifecycle

Card controls work best when finance understands what happens between a purchase request and the final ledger entry. A card limit is not simply a monthly budget, and the amount authorized at checkout may not equal the amount ultimately settled.

• Funding: Decide how much company liquidity can support card spending without competing with payroll, supplier payments, taxes or treasury transfers. For stablecoin-funded cards, include the timing and amount of any conversion required to settle card activity.
• Authorization: The merchant requests approval from the card network. The request may be declined because the card is frozen, a limit has been reached, the MCC is blocked or the available funding balance is insufficient.
• Settlement: The final charge may differ from the authorization. Tips, exchange-rate changes, partial captures and merchant adjustments can change the amount.
• Release or reversal: Cancelled purchases, refunds and unused authorizations may remain pending until the merchant or network releases them. The release is not always immediate.

Hotels and car rental companies commonly place holds above the expected bill. An employee can therefore have enough monthly budget but insufficient available card capacity. Offline or delayed presentment can also mean a charge arrives after finance expected it. Limits should leave room for these mechanics without granting materially more ongoing authority than the role requires.

Build limits from expected spending, not seniority

A single company-wide limit is usually too blunt. It can block legitimate travel or purchasing while giving occasional spenders more access than they need. Start with the employee's business purpose, expected transaction size, spending frequency and the operational cost of a decline.

Use several limit types where the card platform supports them. A per-transaction limit restricts individual purchases, a daily limit reduces short-term exposure and a monthly limit controls aggregate use. Block ATM withdrawals unless cash is genuinely required. Permanent limits should cover normal activity with reasonable headroom; temporary increases are preferable to leaving every card sized for a rare worst-case purchase.

Document the basis for each higher-risk limit. Finance should be able to explain who owns the budget, why the amount is needed and when it will be reviewed. Limits should be reconsidered when an employee changes role, a project ends or a supplier relationship is terminated.

Use MCC blocks as guardrails, not proof of purpose

A merchant category code is a four-digit classification associated with a merchant's primary business activity. MCC controls can prevent card use at categories with no credible business purpose, such as gambling or cash-like services. They cannot confirm what was purchased.

A hotel restaurant may be classified as lodging, and a marketplace selling office equipment may appear under a broad retail code. A purchase can therefore comply with an MCC rule but violate expense policy, or be legitimate and still be declined. MCC rules operate at merchant level rather than checking each item in the basket.

Classify categories in three groups:

• Normally allowed: categories routinely needed by the role.
• Normally blocked: categories with no expected business use, including ATM access where cash is prohibited.
• Exception only: categories enabled for selected cards or a defined purchase after review.

Avoid copying one MCC profile to every employee. Travel categories may be appropriate for field teams but unnecessary for remote employees. Broad retail may be required by an office manager but not by a software buyer. Review legitimate declines after the first statement cycle and periodically thereafter. If the same valid purchase repeatedly needs an override, adjust the control design or issue a dedicated card instead of normalizing manual workarounds.

Apply approvals to changes in authority

Card authorization and internal approval are different controls. The network decides whether a transaction can proceed under the card settings; the company decides whether the employee should make the purchase. Requiring a person to approve every routine card swipe creates a queue without necessarily improving oversight.

Place approvals around actions that create or expand spending authority:

For small teams, finance may manage exceptions centrally. As cardholder numbers grow, department budget owners can handle defined approvals while finance retains control over card issuance, material increases and exceptions outside delegated thresholds. Preserve the request, approver, timestamp, reason, previous setting and revised setting so the audit trail shows both authorization and implementation.

Use separate cards for separate jobs

Issuing more cards does not automatically increase risk. Several narrowly configured cards can be safer and easier to reconcile than one high-limit card shared across unrelated uses.

• A physical travel card can allow lodging, airlines, restaurants and local transport.
• A virtual software card can isolate recurring online subscriptions from general purchasing.
• A project card can have a fixed budget, named owner and documented closing date.
• A supplier-specific virtual card can make unexpected charges and duplicate subscriptions easier to identify.

Do not share card credentials among employees. Every card should have an accountable holder or owner, a stated purpose and a budget source. When a recurring card is replaced, update the supplier record and monitor the old card for delayed credits or attempted charges.

Stablerail supports virtual and physical corporate cards connected to a company's own treasury funds, alongside configurable card limits and merchant category controls. Finance teams managing USDC or USDT should still separate card liquidity from funds reserved for transfers, global payouts and other obligations.

Connect technical controls to the expense policy

Technical controls define what a card can do; the expense policy defines what an employee may do. Both are necessary. A transaction may pass its limit and MCC checks while still being personal, inadequately documented or outside the approved budget.

The policy should state permitted and prohibited spending, pre-approval thresholds, receipt and invoice requirements, submission deadlines, treatment of tips and alcohol, travel booking rules, subscription ownership and the process for reporting a lost or compromised card. It should also explain how to request a temporary increase or category exception and who can approve it.

Make the process easy to find. Informal requests in private messages are difficult to evidence and easy to miss. Use a consistent request channel and require enough information to make a decision without repeated follow-up.

Run a monthly card control review

A monthly review should focus on exceptions and changes, not merely total spend. Finance can use the following checklist:

1. Review declines and distinguish valid control outcomes from false declines.
2. Restore expired temporary limits and MCC exceptions.
3. Investigate repeated limit-increase requests and adjust the permanent design if justified.
4. Chase missing receipts, invoices and business-purpose descriptions.
5. Identify unused cards, departed employees and role changes; freeze or close cards promptly.
6. Compare recurring charges with the approved supplier list and investigate duplicates or forgotten subscriptions.
7. Review cards with unusually high permanent limits and document why they remain necessary.
8. Reconcile pending authorizations, settled charges, refunds and card funding movements to the ledger.

When launching a card programme, pilot the controls with cardholders from different roles for one statement cycle. Record false declines, pending holds, exception volume and approval bottlenecks before wider rollout. A successful setup makes routine spending easy, unusual activity visible and every change to spending authority traceable.