Card limits, MCC blocks and approvals: a spend control setup that works

Corporate cards are easiest to manage when controls are designed around how employees actually spend. A single company-wide limit is usually too blunt: it blocks legitimate purchases for some roles while giving others more access than they need.

For a team of 10–100 cardholders, a workable setup has four layers: funding controls, card limits, merchant category restrictions and approval rules. The expense policy then explains what employees must do before and after a purchase.

Stablerail supports virtual and physical corporate cards funded from the company treasury balance, with configurable limits and merchant category code controls. This guide explains how finance teams can structure those controls without creating an approval queue for every routine transaction.

Start with how card transactions work

Before selecting limits, finance should map the path from treasury funds to a completed card expense.

• Funding: Cards draw from the available corporate treasury balance. Finance should decide how much liquidity remains available for card spending rather than payments, payroll or transfers.
• Authorization: When an employee pays, the merchant requests authorization. The transaction may be declined if the card is frozen, the amount exceeds a limit, the merchant category is blocked or the available balance is insufficient.
• Settlement: An authorization is not always the final charge. Hotels, car rental companies and other merchants may place temporary holds. Tips, partial captures and currency conversion can also cause the settled amount to differ.
• Reversal: A declined, cancelled or refunded transaction may remain visible as pending until the card network or merchant releases it.

Finance teams should account for pending authorizations when setting card limits. A card with a monthly limit of €2,000 may have less than €2,000 available if a hotel has placed a temporary deposit against it.

Build card limits by role

Card limits should reflect expected spending, transaction size and the cost of disruption if a legitimate purchase is declined. Avoid starting every employee at the same level.

The figures below are illustrative rather than recommended defaults. Actual limits should be based on your budget, operating model and transaction history.

Use more than a monthly ceiling where available. Useful card limits include:

• Per-transaction limits to restrict the size of any single purchase.
• Daily limits to reduce exposure if card details are compromised.
• Monthly limits to keep aggregate spending within budget.
• Cash withdrawal limits or a complete ATM block where cash is not required.

Set the normal limit slightly above expected legitimate usage, not at the maximum amount the employee could conceivably need. Temporary increases are safer than maintaining high permanent limits.

Use MCC blocking carefully

A merchant category code, or MCC, is a four-digit classification assigned to a merchant based on its primary business activity. MCC blocking allows finance to decline purchases from categories that do not fit the company’s operating needs.

Common categories to review include gambling, cash withdrawals, money transfer services, jewellery, entertainment and consumer retail. A company with no physical travel may also block airlines, hotels and car rental merchants.

MCC data is useful but imperfect. A hotel restaurant may be classified as lodging, while a large online marketplace may use a broad retail category even when the employee is buying office equipment. Blocking too many categories creates false declines and manual exceptions.

A practical approach is to divide categories into three groups:

• Always allowed: categories routinely required by the cardholder’s role.
• Always blocked: categories with no credible business purpose under the expense policy.
• Exception only: categories enabled temporarily or approved for selected cards.

Review decline data after the first 30 days. If legitimate transactions repeatedly fail because of merchant classification, change the rule or issue a dedicated card rather than asking employees to retry purchases.

Match approvals to the type of spend

Requiring approval for every card transaction creates work without necessarily reducing risk. Approvals are most useful before an unusual purchase, a limit increase or the creation of a new recurring commitment.

For a 10-person team, finance may handle most exceptions directly. At 50–100 cardholders, assign department budget owners and define approval thresholds. Keep evidence of who requested the change, who approved it, the reason and whether the control should expire automatically.

Create different cards for different jobs

Virtual cards can separate recurring suppliers, online purchases and short-term projects. Physical cards are more useful for travel and in-person spending. More cards do not necessarily mean more risk if each card has a narrow purpose and appropriately low limits.

For example, finance could issue:

• A physical travel card with airline, hotel, restaurant and transport categories enabled.
• A virtual software card restricted to approved recurring subscriptions.
• A project card with a fixed budget and an end date.
• A vendor-specific virtual card for a recurring supplier.

This structure makes reconciliation clearer and reduces the need to expose one high-limit card across many merchants. Learn more about corporate cards funded from the treasury balance.

Connect controls to the expense policy

The system controls what a cardholder can do. The expense policy explains what they are allowed to do. Both are necessary because a transaction can pass every technical rule and still be outside company policy.

Keep the policy operational. It should state:

• Which expenses are permitted and which are prohibited.
• When pre-approval is required.
• Receipt and invoice requirements.
• The deadline for submitting supporting documents.
• Rules for travel, tips, alcohol, subscriptions and personal expenses.
• How employees request a temporary limit increase or MCC exception.
• What happens when a card is lost, compromised or no longer needed.

Employees should know where to request changes and how quickly finance normally responds. Publish the process in the same place as the expense policy rather than relying on informal messages.

Run a monthly control routine

Good card spend controls need periodic adjustment. Each month, finance should review declined transactions, unused cards, repeated limit increases, missing receipts, dormant subscriptions and cardholders who have changed roles.

Freeze or close cards promptly when an employee leaves. Review high permanent limits and replace them with lower limits plus temporary exceptions where possible. Compare recurring card charges with the current supplier list to identify duplicate or forgotten services.

For a new card programme, start with a small pilot across different roles. Run it for one statement cycle, record false declines and approval bottlenecks, then adjust the rules before issuing cards across the company. The goal is not to prevent every exception. It is to make routine spending easy, unusual spending visible and changes to spending authority deliberate.