Mastercard expands virtual card controls with Citi

Mastercard has expanded its virtual card platform with new security controls, broader access to embedded payments and a single API connection. Citi is the first bank to launch the new controls.

The changes affect Mastercard In Control, its virtual card number platform for business-to-business payments. The update adds new issuer-level controls when a card is created, extends checks at the clearing stage of a transaction and broadens partner access through the Commercial Connect API.

Companies are increasingly using virtual cards for supplier payments, travel spending and procurement because they can be set with limits and restricted to specific uses. Mastercard said its virtual card network now includes issuers, direct platforms and corporate users across 43 countries and 174 currencies.

Marc Pettican, Global Head of Corporate Solutions at Mastercard, said the company was responding to rising demand for tighter oversight as payment processes move further into software workflows.

"As payments become more digitized and embedded into business workflows, expectations for performance, security and control are higher than ever," Pettican said. "We're expanding our virtual card capabilities to deliver more unified and scalable experiences, helping partners simplify how they implement and scale virtual card programs with greater security, control and consistency."

Security controls

One of the main additions is a function Mastercard calls Issuer Enforced Controls. It allows card issuers to set baseline restrictions when a virtual card number is created, including spending limits, transaction caps and validity periods.

The aim is to place controls at the start of the payment process rather than relying only on later checks. Mastercard said the measure is intended to reduce fraud risk and ensure programme rules are in place from the outset.

Mastercard has also expanded its existing Clearing Controls, introduced earlier. These checks operate after authorisation and before final settlement, allowing corporates and platforms to block transactions that do not meet policy, tighten control settings and manage payment timing more precisely.

Both tools are designed to support centralised policy management as virtual card programmes expand across teams, geographies and suppliers. Citi has already gone live with both functions and is expected to be the first issuer to roll them out globally.

"As virtual card adoption accelerates, our clients need smarter, stronger tools to manage risk," said Scott Southall, Global Head of Citi Commercial Cards & Domestic Payments at Citi. "Our deep collaboration with Mastercard makes Citi the first issuer to deliver these advanced security capabilities to the market on a global scale, further reinforcing our industry leadership in this space. This is a direct reflection of our commitment to helping clients streamline payments and operate more securely and efficiently around the world."

Mastercard cited its own data showing fraud rates on virtual cards are less than one-fifth of those on non-virtual cards, with even lower levels for cards issued through In Control. The wider controls sit alongside tokenisation, fraud monitoring and network security tools.

Single connection

Another part of the expansion centres on integration. Mastercard said the Commercial Connect API provides a single access point for customers that want to create virtual cards and initiate payments without linking to multiple systems.

The update includes broader card controls at the real card level, so one set of rules can apply across linked virtual cards without exposing sensitive credentials. It also combines card creation and payment initiation in one step, which Mastercard said should simplify implementation for banks, corporate users and software platforms.

Kaiser Associates, which Mastercard cited in support of its market position, said competition in virtual cards has shifted toward operational proof rather than broad product claims.

"Kaiser's analysis shows that virtual card providers increasingly compete on operational proof: platform maturity, configurable controls, ERP connectivity, and implementation paths that reduce friction for issuers and corporates," said Spencer Dunham, Vice President of Financial Services & Payments Practise at Kaiser Associates. "Against that backdrop, Mastercard's In Control capabilities and Commercial Connect API give banks a differentiated foundation for scaling virtual card programs with greater control and less integration friction."

Embedded payments

Mastercard is also extending the platform's embedded payments capabilities, aimed at software providers in areas such as expense management, enterprise resource planning, accounts payable, travel, healthcare and eCommerce. The model allows virtual card payments to sit inside the business systems companies already use.

Dozens of partners have signed up since the embedded virtual card programme launched, according to Mastercard. SAP is among those that have enabled the partnership, which Mastercard described as a step toward broader use of virtual cards in finance workflows.

The move reflects a wider push across the payments industry to embed commercial payments more deeply into business software, where companies manage invoices, travel bookings and purchasing. By integrating card issuance and payment steps directly into those systems, providers aim to reduce manual processes and give finance teams tighter control over spending.

Mastercard also pointed to sector-specific use cases, particularly in travel, where bookings often involve multiple parties and fragmented payment flows. It highlighted work with partners including HBX Group, Juniper Travel and TravelSoft.

"Travel has unique payment requirements, with complex booking journeys and multiple stakeholders involved in every transaction," said Sofoklis Limniotis, Director of Strategy & Solutions at HBX Group. "At HBX Group, we are connecting bookings and payments more intelligently to simplify payment processes across the travel value chain. That's why our collaboration with Mastercard is so important: by combining our deep travel expertise with the scale and security of a global payments network, we can help deliver more seamless payment experiences for our partners."