Finance Index
What card controls should every program have - limits, MCC restrictions, locks, and expiry?
Reference guide to corporate card controls mcc limits locks, including card controls, policy design, employee spend workflows, receipt capture, and reconciliation.
The minimum day-one control set: per-transaction and monthly limits on every card, default merchant category (MCC) blocks for obvious categories, real-time decline rules rather than after-the-fact review, and expiry or auto-pause on dormancy. Controls that operate before authorization are worth ten policies that operate at month-end.
At a Glance
| Aspect | Short Answer | Why It Matters |
|---|---|---|
| What card controls should every | The minimum day-one control set: per-transaction and monthly limits on every card, default merchant category (MCC) blocks for obvious categories, real-time decline rules rather than after-the-fact review, and expiry or auto-pause on dormancy. | Keeps evidence clear and reduces control risk. |
| Related terms | Hard-block what is never legitimate (cash advances, gambling, clearly personal categories) and what is structurally risky (spend over the pre-approval threshold without an approval attached). | Reduces payment errors, timing issues, and reconciliation cleanup. |
| MCC restrictions and how do | Every merchant has a four-digit category code assigned by its acquirer; MCC restrictions allow or block authorizations by category at the network level, before the transaction completes. | Helps finance decide what to do next. |
| Mccs should be blocked | Cash advances and quasi-cash, gambling, dating, crypto, jewelry, and money transfer - categories with no plausible business purpose for most companies. | Keeps vendor records and payment decisions reliable. |
| Spend control | Merchants are sometimes miscategorized by their acquirer. | Helps finance decide what to do next. |
Hard blocks vs soft alerts - when should a violation decline vs flag?
Hard-block what is never legitimate (cash advances, gambling, clearly personal categories) and what is structurally risky (spend over the pre-approval threshold without an approval attached). Soft-flag what is usually legitimate but worth a look - out-of-pattern merchants, weekend spend, near-limit velocity. The test: if a false positive would strand an employee mid-trip, it should flag; if a false negative would embarrass you in an audit, it should block.
What are MCC restrictions and how do they work?
Every merchant has a four-digit category code assigned by its acquirer; MCC restrictions allow or block authorizations by category at the network level, before the transaction completes.
Which mccs should be blocked by default?
Cash advances and quasi-cash, gambling, dating, crypto, jewelry, and money transfer - categories with no plausible business purpose for most companies. Everything else is a per-program judgment.
MCC restrictions keep blocking legitimate purchases - how do teams handle false positives?
Merchants are sometimes miscategorized by their acquirer. Handle it with a fast exception path (temporary category unblock or a one-time approval) rather than loosening the rule globally - and merchant-lock recurring offenders so the rule doesn't touch them.
How do amount limits layer - per-transaction, daily, monthly?
Per-transaction caps catch single large purchases; daily caps catch velocity (including split transactions); monthly caps bound total exposure. Layer all three on expense cards; AP cards sized to a specific approved purchase need only the transaction-level control.
What are real-time card controls vs after-the-fact review?
Real-time controls evaluate the authorization itself - limit, merchant, category, rule - and decline violations before money moves. After-the-fact review finds problems weeks later, when the only remedies are awkward: repayment requests and policy emails.
How do I set cards to auto-expire or auto-pause?
Set expiry dates at issuance (project end, contract end, a default 12 months), and pause on inactivity - 60 - 90 days dormant is a reasonable trigger. Reactivation should be a request, not automatic.
What is a merchant lock?
A control restricting a card to a single supplier, by merchant identifier rather than category - the strongest structural control available for recurring vendor and subscription cards.
Minimum day-one controls vs maturity additions?
Day one: limits, default MCC blocks, expiry, real-time declines. As the program matures: pre-approval thresholds, budget-linked controls, receipt-required rules, and velocity/anomaly alerting.
Budget-linked card controls - spend that draws down a department budget?
The control checks remaining budget at authorization and declines when it's exhausted, which converts the budget from a report into a constraint. It requires the card platform to know budgets - which is an argument for cards living inside the spend workflow rather than beside it.
An employee's card keeps declining on legitimate travel - how do I tune without removing controls?
Use trip-aware adjustments: a temporary geographic allowance and raised velocity threshold scoped to travel dates, reverting automatically. Tuning means narrowing the rule's scope, not deleting it.
How should controls differ for AP cards vs expense cards vs executive cards?
AP cards: locked to vendor and amount - the approval already happened. Expense cards: layered limits, MCC blocks, receipt rules. Executive cards: same rules as everyone (the cultural signal matters more than the dollar risk), with higher limits where genuinely needed.
Which controls are table stakes vs differentiated when evaluating platforms?
Table stakes: limits, MCC blocks, instant freeze, virtual issuance. Differentiated: approval-before-spend tied to an actual request workflow, pre-coded GL inheritance, budget-linked declines, and receipt-compliance rules that affect card behavior.
Stampli perspective
Stampli Card enforces spending limits by cardholder, merchant category, or vendor, configured by finance at issuance - controls are set before the card exists, not retrofitted after spend appears. Because transactions post in real time into approval workflows, review happens continuously instead of at statement close.