Card Spend Controls Every Finance Team Should Set

Corporate cards make purchasing faster, but they should not give every cardholder unrestricted access to the company treasury. A workable card programme starts with limits matched to each person’s role, clear rules for exceptional purchases and a record of every settings change.

Stablerail supports virtual and physical corporate cards funded from the company’s treasury balance, with configurable limits and merchant category controls. Exact card availability, currencies and settings can depend on the card programme and the company’s jurisdiction.

This guide explains the core card spend controls finance teams should configure: per-card limits, single-transaction caps, merchant restrictions, freeze and unfreeze permissions, and approval requirements for sensitive changes.

Start with the card’s purpose

Do not issue a general-purpose card when a narrowly defined card will work. Before creating one, record:

• Cardholder or owner: the employee, contractor or team responsible for the card.
• Business purpose: for example, software subscriptions, travel, online advertising or office supplies.
• Expected spend: the normal amount and frequency of transactions.
• Card type: virtual for online payments or physical where in-person use is required.
• End date: when the card should be reviewed, frozen or closed.

A virtual card dedicated to one supplier is generally easier to control than a shared card used for many expenses. Separate cards also make reconciliation clearer: finance can identify the intended budget and owner without relying only on transaction descriptions.

See Stablerail corporate cards for an overview of cards funded from the treasury balance.

Set corporate card limits at several levels

A monthly limit alone is not enough. Finance teams should combine several controls so that one unusual payment cannot consume the entire budget.

Period limits

Set the period to match the expense. A recurring software card may need a monthly limit, while a travel card may need a temporary budget covering the trip. Avoid setting every card to the same default amount.

A practical starting point is expected spend plus a modest operating buffer. If normal monthly spend is €2,000, a €20,000 limit is difficult to justify. Equally, setting a limit exactly equal to the forecast can create avoidable declines when exchange rates, taxes or supplier prices change.

Review whether limits reset by calendar period or on another schedule. Finance should also understand how pending authorisations affect the remaining amount. A hotel or car rental company may place a temporary hold that is higher than the final charge.

Single-transaction caps

A single-transaction cap limits the size of any one authorisation. It is useful even when a card has a monthly budget. For example, a card could have a €5,000 monthly limit but a €1,000 transaction cap.

Set the cap above the card’s largest expected routine purchase, not at the full period limit. Create an exception process for unusual payments rather than permanently increasing the cap. Where the platform supports temporary changes, finance can raise the limit for an approved purchase and restore it afterwards.

Use merchant category controls carefully

Merchant category controls use merchant category codes, or MCCs. Card networks assign these codes to describe a merchant’s main business, such as airlines, restaurants, advertising services or gambling.

Finance teams can use an allowlist, permitting selected categories, or a blocklist, rejecting prohibited categories. An allowlist is usually appropriate for narrowly defined cards. A travel card, for example, might allow airlines, hotels, ground transport and restaurants while blocking unrelated categories.

MCC controls are useful but imperfect. The code describes the merchant, not the exact item purchased. A supermarket may sell both business supplies and personal goods, and a large online marketplace may process many product types under one category. MCC rules should therefore complement receipts, approval policies and transaction review rather than replace them.

Test new restrictions before rolling them out broadly. Ask cardholders which merchants they regularly use and review recent transaction categories. Keep a documented route for resolving legitimate declines.

Define freeze and unfreeze permissions

Cardholders should be able to report a lost card immediately. Depending on the programme’s available roles, they may also be allowed to freeze their own card. Unfreezing deserves tighter treatment because it re-enables spending.

A sensible permissions model is:

• Cardholder: can view transactions, report loss and request a freeze or limit change.
• Finance operator: can issue cards, freeze cards and make routine changes within a defined policy.
• Finance approver: approves high limits, sensitive merchant categories and exceptional unfreezes.
• Administrator: manages user roles and other high-impact account settings.

Freeze cards when an employee leaves, a card is missing, suspicious activity appears or a temporary project ends. Freezing is not the same as closing a card: it is normally reversible. Also note that a freeze may not cancel transactions already authorised, and some offline or delayed transactions can appear later.

Require approval for high-impact changes

Not every adjustment needs the CFO’s approval. Routine changes within an agreed policy can be handled by finance operations. High-impact actions should require a second approver or an approval quorum.

A quorum means that more than one authorised person must approve an action. Consider requiring it for:

• Creating cards with limits above a defined threshold.
• Increasing a card’s period or transaction limit materially.
• Allowing high-risk or normally prohibited merchant categories.
• Unfreezing a card after suspected fraud or compromise.
• Changing who can issue cards or edit controls.

Set named backups so urgent requests do not depend on one unavailable executive. The approval path should cover both the purchase and the control change: an approved invoice should not automatically let one operator remove every restriction from a card.

Keep an audit log of settings changes

The audit log should show who created, changed, froze or closed a card; what the previous and new settings were; when the action occurred; and who approved it. Attach the business reason or ticket reference where possible.

Review the log alongside card transactions. Useful checks include limit increases followed by immediate spending, repeated freeze and unfreeze activity, cards created outside the normal process, and changes made by administrators to their own permissions.

For month-end evidence, retain cardholder ownership, current limits, MCC settings, approvals, receipts and change history. This gives finance and auditors a clear path from policy to configuration to actual spend.

A practical setup checklist

• Assign every card to a named owner and documented purpose.
• Use separate virtual cards for major suppliers or recurring subscriptions.
• Set period limits from expected spend rather than a universal default.
• Add a single-transaction cap below the total period limit.
• Apply merchant category restrictions appropriate to the card’s purpose.
• Define who can freeze, unfreeze, issue and close cards.
• Require quorum approval for exceptional limits and sensitive changes.
• Review inactive cards and unused limits at least quarterly.
• Reconcile pending, settled and reversed transactions correctly.
• Retain the audit log and supporting approvals as finance evidence.

The best card control framework is not the most restrictive one. It is the one that lets employees make legitimate purchases without giving any single cardholder, operator or compromised card unnecessary access to company funds.