Mastercard on July 23, 2026 announced new features for In Control, its virtual card number platform for companies and financial institutions. Issuers can now set guardrails when a card is created, spending checks extend from authorization into clearing, and a single commercial API ties the pieces together. Citi is the first issuer to deploy the new controls globally. The changes look technical, but they go to the central question in corporate payments: who sets the rules, and at which point in the transaction.
A virtual card has no plastic. It is a card number generated on demand, often for a single supplier, a single invoice, or a short validity window, with spending limits and reconciliation data attached. Companies use them to pay hotels, carriers, and contractors without exposing a reusable card number or keying in a bank transfer by hand.
Three changes, from card creation to clearing
| Feature | What it does | Intended effect |
|---|---|---|
| Issuer Enforced Controls | The issuer sets baseline guardrails, such as a spend limit, a cap on the number of transactions, and a validity period, when the virtual card is created. | Reduce risk at issuance instead of fixing it after the fact. |
| Clearing Controls | Checks no longer stop at authorization. A noncompliant transaction can be blocked before settlement, and payment timing can be managed. | Catch what slips through authorization and centralize spending policy. |
| Commercial Connect API | A single entry point for payment initiation, remittance data, reconciliation, consent, and controls, with controls extended to the underlying real card. | Lower integration costs for issuers and platforms. |
Embedded cards become a distribution channel
The second part of the announcement is commercial. Mastercard is expanding the embedded virtual card program it launched in March 2025. Instead of sending buyers to a bank portal to create a card, the program generates it inside software they already use: a travel booking tool, an expense management platform, or an ERP system. The press release names SAP, HSBC, Emburse, HBX Group, TravelSoft, and Juniper Travel among the partners. It also cites the consultancy Kaiser Associates, which says In Control and the Commercial Connect API give banks “a differentiated foundation for scaling virtual card programs.” Mastercard itself bills the API as “the market’s only single‑API front door.”
“As payments become more digitized and embedded into business workflows, expectations for performance, security and control are higher than ever,” said Marc Pettican, global head of corporate solutions at Mastercard. The practical upshot: as payments get built into business processes, control shifts into the infrastructure and away from the individual user.
Virtual cards gain ground in B2B on control and data
- Control per payment: one number per expense, with its own limit and validity period, whereas a physical card shared by several employees concentrates the risk.
- Reconciliation: the transaction data can carry the invoice or purchase order number, automating accounting work that is still done by hand.
- Acceptance without new processes: the supplier takes the card like any other payment and doesn’t have to change its systems.
- Working capital: the card opens a gap between the day the supplier is paid and the day the buyer is debited, which a bank transfer can’t do.
The announcement shows where competition in corporate payments now lies. It is less about the price of a transaction than about ease of integration and finer-grained control. By positioning a single API as the entry point, a card network aims to become the foundation on which banks, software vendors, and travel platforms build their programs. The same shift has already played out in e-commerce, where the fight is over the tools as much as the rails. Two things to watch: how quickly other issuers adopt the new controls, and whether checks at clearing actually move dispute rates.