B2B payments: spend management

Money going out through employees: corporate cards, expenses and reimbursements in the US and Canada, how a fintech card program is built, what each instrument costs and earns, and who pays when a card is misused or a receipt never arrives.

Last reviewed October 2026

The industry on one page

The parties and the two flows. The company gives an employee a card and its limits; the employee buys, and the charge runs on a card network to the card issuer (a bank, with the platform running the program). The receipt comes back separately, if at all. The expense exists only where the two meet.

Spend management is the third way money leaves a business. In procure to pay, the company pays suppliers against invoices. Here it pays through its own people: an employee books a flight, renews a software subscription or takes a client to dinner, on a company card or with their own money. For every line, finance needs to know what was bought, why, by whom, against which GL account, and whether it was allowed. Moving the money is the easy part. Collecting the reason is the job.

Commercial card purchase volume on the three big US brands was $2.23T in 2024, about a fifth of their total (Nilson). Businesses made 9% of US credit card payments by number but 26% by value in 2022 (Atlanta Fed). In Canada, Visa and Mastercard commercial credit cards carried $101B in 2025, three quarters of it on small-business cards (Nilson; currency not stated). How much still runs through employees' own cards is unpublished: the newest non-vendor figure is GBTA's 2017 survey, in which 54% of companies had employees pay for travel on personal cards (GBTA).

Four ideas organize what I've learned so far, all hypotheses I'm testing with experts.

The money and the justification travel separately. (Strong for card spend.) The card network carries an amount, a merchant name and a category code, not what was bought or why. US tax law wants the why anyway: a receipt for any lodging and any other expense of $75 or more, plus time, place and business purpose; a card statement proves only that you paid. The CRA won't accept one for an input tax credit either. So every card line waits for its receipt, the way a payment waits for its remittance in order to cash. Against: out-of-pocket claims arrive with their receipt, per diems need no meal receipts, and richer card data is starting to ride along. The split is a card problem, which is why it's the product.
The merchant pays for the "free" software, the customer gets about half back, and settlement terms decide what's left. (True for card-first platforms only.) One public SMB spend platform's card fees came to about 2.56% of card volume in FY2026, and it returned about 51% of that interchange as rewards. The largest closed-loop charge-card issuer's commercial rewards ran at about 1.32% of billed business in 2025. What remains pays for losses, the bank, the processor and funding the balance until the customer pays: on monthly terms, close to nothing. Against: a public travel-and-expense suite earns about 90% of revenue from booking and partner fees, and a public expense-software company gets only about 15% from interchange.
The employee is a counterparty, not just a user. (Strong in law, unmeasured in money.) On a company card the employee spends the company's credit; out of pocket, they lend the company money until it pays them back, and the law treats that loan like wages. New York calls an agreed reimbursement a "wage supplement", and California owes interest from the day the employee spent the money. Employees are also the fraud vector: expense schemes were 15% of occupational fraud cases in the US and Canada in ACFE's 2026 report. Against: under corporate liability the company owes the bank, and the employee is only its agent.
A fintech card program is a bank's program run by a non-bank. (Fits US credit and charge programs.) The bank holds the charter, the BIN (the card number range) and the regulator's attention; Visa's rules call the fintech a Third Party Agent. One public platform's filing says it buys participations in its card receivables and bears "the entire credit risk", while the banks keep "ultimate authority" over each card and transaction. The split is a contract, not a law, and banks are buying in: in April 2026 a large US card bank closed a $5.15B purchase of a venture-backed spend fintech.

Put together, the product is a control system that acts at authorization and a matching engine that runs after it, paid for by merchants and priced by how fast the customer pays the card. Two more hypotheses sit further down: settlement terms as the hidden price (Money flows), and ledger owners taking the customer (The power map).

Three things make this harder than the B2B platforms you know:

Controls work only at authorization. After that, approved authorizations always capture, merchants can force-post charges, refunds land on canceled cards, and finance is chasing receipts.
Your user isn't your customer, or your debtor. The bank issues the card, the company usually owes for it, the employee carries it, and out of pocket the company owes the employee under labor law.
You have about two seconds. Issuer processors give the platform 2 to 3 seconds to answer an authorization; miss it, and a default rule or the network's stand-in decides, at the issuer's risk.

Supplier payments and supplier virtual cards are in B2B payments: procure to pay; the mirror of the card-and-receipt match, payment and remittance arriving separately, is in B2B payments: order to cash.

The spend map

A card expense in five stages. Controls work only at authorization; once a charge clears, finance can only chase it. The receipt and the coding arrive later, and a charge that never gets a receipt can end up as the employee's taxable wages.

Two paths end in the same ledger, and on the card path the decision comes before the evidence.

The card path

Company onboarded by the program manager under the bank's policy: KYB, underwriting, a liability model (who owes the bank), a limit and settlement terms. Breaks: a decline or a lower limit than asked, which can need a Reg B notice.
Card issued. Physical cards ship; virtual cards are live on creation. Controls attach: merchant categories allowed or blocked, amounts per transaction, day or month, merchant lock, expiry, single use.
Authorized. Merchant, acquirer, network, then the issuer processor, which checks balance, limit, card status and static controls before asking the platform, which has 2 to 3 seconds to approve, partly approve or decline. Breaks: a decline for limit or merchant type; or a timeout, where the processor's default or the network's stand-in decides. This is the last chance to say no.
Held. The authorization holds part of the limit; hotels add incremental authorizations. Breaks: a hotel hold eats the limit and the next swipe is declined.
Cleared. The merchant captures, usually within a day, hotels and airlines up to about a month later. The amount can differ (tips, fuel, currency). On a charge card, the bank's receivable starts now. Breaks: a late or forced capture arrives after the card was canceled, and posts anyway.
Matched. Receipt, business purpose, attendees and GL code attached to the line. Breaks: no receipt; the receipt's merchant name doesn't match the card descriptor; the totals differ.
Approved. Manager for purpose, budget owner, finance audit if a rule flags it. Breaks: out of policy, and the employee owes the company.
Settled. The company pays the card daily or on the statement date; under individual liability the employee pays the bank and claims it back. Breaks: past due after a short grace period (about five days at one public platform, which charges off at 120 days).
In the ledger. A journal to the ERP: GL account, cost center, tax code (recoverable GST/HST, the 50% meals split); statement reconciled; period closed. Breaks: uncoded card spend at month end.

The out-of-pocket path

Employee pays with a personal card or cash. Their float starts, and so does any legal clock.
Captured: receipt photo, e-receipt or mileage log. Breaks: a lost receipt needs a signed statement plus corroboration.
Submitted. Breaks: late. Illinois expects claims within 30 days unless the employer's policy allows longer; the IRS safe harbor wants substantiation within 60 days of the expense.
Approved and audited, plus a duplicate check against card lines.
Paid by ACH or EFT, in the next payroll, or by check. Breaks: a payroll-cycle rail adds one to two weeks; an ACH return; a check never cashed.
In the ledger, coded like a card line.

APQC's top quartile approves and schedules T&E reimbursements in 3 days or less and the bottom quartile takes a week or more, at a median $7.88 per disbursement (CFO.com on APQC, July 2023). Controls only work before the money moves; after authorization the product collects evidence, and the law wants the same evidence whichever path the money took.

Instrument cheat sheet: paying through employees

Instrument	Who funds it	Who owes	Controls	Receipt burden (US)	Cost and earnings	Speed
Corporate charge card	Bank; company pays in full	Company (fintechs); employee or both (many bank programs)	Category, amount, merchant, at authorization	Lodging always, other items from $75	Merchant pays 2.50% to 2.70% + $0.10; rebate about 1% to 1.5%	Instant; clears in 1 to 3 days
Revolving business card	Bank lends	Company, often with a personal guarantee	Card-level limits	Same	Merchant pays 2.65% to 3.00% + $0.10 online; interest income	Instant
Purchasing card	Bank; Visa requires credit	Company	Category blocks	Line items via Level 3 data, or the invoice	Merchant pays 1.75% + $0.10 with validated Level 3	Instant
Virtual card	Bank, or the company's own funds	Company	Merchant lock, amount, expiry	Emailed online receipt	Merchant pays 2.70% + $0.10 online	Issued in seconds
Prepaid or just-in-time card	Company cash in a pooled account	Company	Balance plus controls	Same as any card	2.65% + $0.10 at a bank under $10B; about $0.72 on $1,000 above	Instant
Out-of-pocket reimbursement	Employee, until repaid	Company owes the employee	Policy, after the fact	Same, all from the employee	About $58 per report (2015); employee keeps card rewards	Days to weeks
Per diem or mileage allowance	Company, at a set rate	Company	Rate tables, day counts	Amount deemed proved; purpose still needed	IRS, GSA or CRA rates; low admin; employee keeps savings	With the claim
Central travel account	Bank; billed to the company	Company	Booking policy at the agency	The agency's invoice	Card interchange; no employee float	Billed directly

Corporate charge card

Who funds it: Bank; company pays in full
Who owes: Company (fintechs); employee or both (many bank programs)
Controls: Category, amount, merchant, at authorization
Receipt burden (US): Lodging always, other items from $75
Cost and earnings: Merchant pays 2.50% to 2.70% + $0.10; rebate about 1% to 1.5%
Speed: Instant; clears in 1 to 3 days

Revolving business card

Who funds it: Bank lends
Who owes: Company, often with a personal guarantee
Controls: Card-level limits
Receipt burden (US): Same
Cost and earnings: Merchant pays 2.65% to 3.00% + $0.10 online; interest income
Speed: Instant

Purchasing card

Who funds it: Bank; Visa requires credit
Who owes: Company
Controls: Category blocks
Receipt burden (US): Line items via Level 3 data, or the invoice
Cost and earnings: Merchant pays 1.75% + $0.10 with validated Level 3
Speed: Instant

Virtual card

Who funds it: Bank, or the company's own funds
Who owes: Company
Controls: Merchant lock, amount, expiry
Receipt burden (US): Emailed online receipt
Cost and earnings: Merchant pays 2.70% + $0.10 online
Speed: Issued in seconds

Prepaid or just-in-time card

Who funds it: Company cash in a pooled account
Who owes: Company
Controls: Balance plus controls
Receipt burden (US): Same as any card
Cost and earnings: 2.65% + $0.10 at a bank under $10B; about $0.72 on $1,000 above
Speed: Instant

Out-of-pocket reimbursement

Who funds it: Employee, until repaid
Who owes: Company owes the employee
Controls: Policy, after the fact
Receipt burden (US): Same, all from the employee
Cost and earnings: About $58 per report (2015); employee keeps card rewards
Speed: Days to weeks

Per diem or mileage allowance

Who funds it: Company, at a set rate
Who owes: Company
Controls: Rate tables, day counts
Receipt burden (US): Amount deemed proved; purpose still needed
Cost and earnings: IRS, GSA or CRA rates; low admin; employee keeps savings
Speed: With the claim

Central travel account

Who funds it: Bank; billed to the company
Who owes: Company
Controls: Booking policy at the agency
Receipt burden (US): The agency's invoice
Cost and earnings: Card interchange; no employee float
Speed: Billed directly

Sources (as of Oct 2026): Visa US interchange (April 18, 2026), Visa Rules, Treas. Reg. 1.274-5, GBTA (2015), GSA SmartPay. Rebates are benchmarks from filings and public contracts. The regulated debit and prepaid cap applies at issuers with $10B or more in assets.

Why do personal cards survive? The employee keeps the points, and the IRS doesn't tax personal use of business-travel miles unless they're cashed in. Bank programs at large companies still use individual liability, where the employee owes the bank; the US federal travel card works that way, paying the card's share of each reimbursement straight to the bank. Each instrument decides who lends to whom: the bank to the company, the company to the employee, or the employee to the company.

Which instrument? Five questions

Who should owe the bank? Corporate liability spares employees a credit check and leaves misuse with the company. Individual liability moves the debt to the employee, but in California the employer still owes the business expense, and in Canada only a card the employee is liable for qualifies for the simpler GST/HST card method.
Can you name the merchant in advance? Software, ads and AI agents: a merchant-locked virtual card per vendor. Supplies bought on account: a purchasing card with category blocks. Travel and meals: a physical card with limits.
Is it travel? A per diem removes the meal receipts; airfare on a central account removes the employee.
How fast can the company pay the card? Daily settlement shrinks the balance the platform funds, which is what a better rebate usually buys.
US or Canada, and which state or province? California, Illinois and a handful of states set reimbursement duties; Canada adds GST/HST recovery, and Quebec its own sales tax and slip.

My defaults: corporate-liability charge cards on daily settlement for regular spenders; a merchant-locked virtual card per software vendor; per diems for travel meals; mileage at the IRS or CRA rate with a log; out-of-pocket only as the exception, paid by ACH or EFT within days, not with payroll; airfare on a central account; anything with an invoice goes to AP.

The primitives

Entity & identity

What is the unit of record, and how do we know it is the same one?

Each card carries three identities, and each expense adds two more.

Entity	Who issues the identity	Where it breaks
Legal issuer	The sponsor bank, as BIN licensee and creditor	The brand on the card isn't the issuer
Company (account)	The bank's KYB, done by the program manager: owners of 25% or more, a control person	Refresh is a bank duty pushed onto the fintech
Employee cardholder	The company's HR records	Leavers keep cards; work state and province drive tax and labor rules
Merchant	The acquirer assigns the category code; the name is cut to 25 characters	The code describes the merchant, not the item
Receipt issuer	The merchant's own name and, in Canada, its GST/HST number	The receipt name doesn't match the card descriptor

Reg Z counts organizations as cardholders, so on a corporate account the company is the cardholder. The employee becomes a debtor only under individual liability ("the cardholder will be solely liable", in Mastercard's definitions) or joint liability, and then needs a credit check. The employee's attributes still drive rules under every model: work state, province (which HST factor), Quebec (a second tax slip), owning 10% or more of the company (no lodging per diem for related parties), and a federally regulated Canadian employer (a 30-day reimbursement rule).

Visa's merchant data standards have the acquirer assign the code for the merchant's primary business, cut the name to 25 characters, and let marketplaces use one code (5262) for everything they sell. The network knows roughly who was paid; it never knows what was bought. US companies no longer report beneficial owners to FinCEN (since March 2025), but banks must still collect them, and sponsor banks push that work onto the program manager.

Sources: Reg Z interpretation, Visa Merchant Data Standards Manual (April 2026), Rev. Proc. 2019-48, FinCEN; Mastercard's definitions via a US bank's brochure (undated).

The bank issues the card, the company owes for it, the employee carries it, and the merchant is a 25-character string: model all four, because each answers a different question.

Ask an expert: for KYB refresh, employee sanctions screening and beneficial-owner changes, who is the customer of record: us, the bank, or both?

State & lifecycle

What states exist, and what moves an entity between them?

Four machines run on one purchase, and they end at different times:

Card: unactivated, active (a virtual card counts once viewed), suspended, terminated.
Authorization: approved or declined, held, increased or partly reversed, then cleared or expired. Visa gives merchants 10 days to clear an online authorization and 30 for lodging and car rental.
Expense: draft, submitted, returned or approved, audited, exported, paid, archived.
The employee's obligation: an advance or personal charge, then repaid, or treated as wages after the IRS's 120 days.

A transaction can outlive its card. Refunds post to canceled cards, late captures land after cancellation, and one issuer processor allows recurring authorizations on expired cards unless the card is canceled. When an employee leaves, cancel rather than reissue: a reissued number flows to every merchant storing the old one through Visa Account Updater.

The word that causes the most trouble is "done":

Who says "done"	What they mean
Employee	The money is in my account
Issuer	Cleared and posted
Finance	Receipt matched, coded and approved
Payroll and tax	Substantiated within 60 days, excess returned within 120
Auditor	Receipt kept 3 to 4 years (US) or 6 (Canada)

Legal clocks hang on these states. Illinois' 30-day submission window and the IRS's 60 days run from the expense date. Payment deadlines run from the claim: 30 days in Iowa, New Hampshire and federally regulated Canadian workplaces. New York makes an unpaid agreed reimbursement a misdemeanor 30 days after it's due.

Model the card, the authorization, the expense and the employee's obligation as four machines; the bugs live where one has ended and another hasn't.

Ask an expert: which state transitions generate the most tickets: hold releases, late captures after cancellation, or refunds to canceled cards?

System of record & ledger

Who owns the truth, and how do systems reconcile?

Every fact has an owner, and few of them are the platform.

Fact	System of record
Authorizations, clearing records, card status	The issuer processor
The legal receivable; settlement with the network	The sponsor bank
Balances, limits, rewards; the participation in the receivable	The program manager's ledger
Prepaid and just-in-time funds	A pooled for-benefit-of (FBO) account at the bank, sub-ledgered by the platform
Purpose, approvals, receipts, coding	The expense tool
Books, accruals, close	The ERP
Taxable amounts (W-2, T4, Quebec's RL-1)	Payroll

The classic breaks: processor and bank disagree on what settled; card spend is still uncoded at close; unsubmitted out-of-pocket spend is accrued as a guess, or ignored. And pooled funds stop adding up. Synapse, a banking-as-a-service middleware company, failed in April 2024 with its ledger out of step with its banks'. Shortfall estimates ran from $60M to $95M; after suing and reaching a stipulated judgment in 2025, the CFPB allocated $46.2M from its Civil Penalty Fund to those affected. Prepaid cards and spend-platform cash accounts use the same pooled structure.

The FDIC proposed daily reconciliation of custodial accounts in 2024; its agenda lists the final rule as "To Be Determined". Banks demand it by contract anyway: a law firm's August 2026 summary lists real-time, auditable ledger reconciliation among sponsor banks' standard asks.

Sources: American Banker and Banking Dive on Synapse, FDIC proposal and agenda, National Law Review (Aug 2026).

Four ledgers describe one purchase: the bank's wins for what's owed, the expense tool's for why, the ERP's for the books, and someone has to reconcile them every day.

Ask an expert: what daily reconciliation break do you watch most, and who wins when the processor and the bank disagree?

Rules & policy

What logic decides outcomes, and who can change it?

The company writes the spend policy; five other parties fence it in.

Who sets	Rules that decide outcomes (as of Oct 2026)
Card network	Product rules (a purchasing card must be credit); category codes; interchange qualification; dispute windows; zero-liability exclusions; payments by AI agents
Sponsor bank	Credit box, prohibited industries, KYB depth, collateral, final say on each card and transaction
Program manager	Underwriting inside the bank's policy, limits, rewards tiers, settlement terms
Company	Spend policy (categories, limits) and expense policy (receipts, per diem caps, approvals)
Tax law	US accountable plans and substantiation; per diem and mileage rates; 50% meals; Canada's reasonable allowances and tax credit documents
Employment law	State reimbursement laws; the FLSA floor; the Canada Labour Code

The accountable plan. US reimbursements are tax-free only if the plan passes three tests: business connection, substantiation and return of any excess (Treas. Reg. 1.62-2). Paying whether or not the employee spends fails the first, so a flat car allowance with no log is wages. The safe harbor: advances no more than 30 days ahead, substantiation within 60 days, excess back within 120. Fail, and the amount goes on the W-2 with withholding and payroll taxes. Most employees can no longer deduct unreimbursed expenses themselves (made permanent in 2025), so the plan is the only tax-free route.

Law versus policy. US law requires a receipt for lodging and other expenses from $75; most policies ask for more. Illinois lets a written policy cut off late claims; California's rights can't be waived. Travel and client meals are 50% deductible, convenience meals 0% since 2026, so the GL needs separate codes. A Canadian kilometre allowance paid alongside a fuel card for the same use becomes taxable in full: a design error, not an employee's.

Canadian sales tax. Input tax credit evidence scales with the amount: under $100, supplier, date and total; from $100, the tax and the supplier's GST/HST number; from $500, also the buyer's name, a description and terms. Reimbursements can use a factor (4/104 for GST, 12/112 to 14/114 for HST) if 90% of the total bore one tax. Meals get half the credit. The company-card shortcut needs the cardholder to be "solely or jointly and severally liable", so a pure corporate-liability program may not qualify.

Sources: Treas. Reg. 1.62-2, Pub 463, Pub 15-B (2026), Notice 2026-10, CRA, RC4022, Memorandum 8.4 (its HTML still shows pre-2021 thresholds).

The company writes the policy, but the bank, the network, the tax code and labor law each hold a veto, and only the card controls act at the moment of purchase.

Ask an expert: which controls do customers keep after 90 days, and which do they switch off because of false declines?

Effective dating

Which version of the rule applied at that moment?

Every rate in an expense has an effective date, and the IRS mileage rate has two. It rose from 72.5¢ to 76¢ a mile on July 1, 2026, citing fuel prices, the first mid-year change since 2022. The 76¢ applies only if the miles were driven and the allowance paid on or after July 1: a June trip reimbursed in July stays at 72.5¢. The IRS per diem year starts October 1; through December, an employer on the high-low method keeps that method and uses old or new rates consistently for everyone.

Change	Effective	Status (Oct 2026)
Canada: small-merchant interchange cuts, consumer credit only	October 19, 2024, for five years	Live; commercial cards not covered
Visa validates Level 3 data	October 17, 2025	Live
No deduction for employer-convenience meals	Amounts after December 31, 2025	Live
CRA kilometre allowance $0.73 / $0.67	January 1, 2026	Live; 2027 rates due in January
Nacha: wage credits must say "PAYROLL"	March 20, 2026	Live
Visa US interchange table	April 18, 2026	Live; updates in April and October
IRS business mileage 72.5¢ → 76¢	July 1, 2026	Live; 2027 rate due mid-December
IRS high-low per diem $319 / $225 → $329 / $230	October 1, 2026	Live
GSA standard per diem $181 ($113 lodging, $68 meals and incidentals)	October 1, 2026	Live
NJC travel meals $123.20 plus $25 incidentals a day	October 1, 2026	Live
Visa and Mastercard merchant settlement	Preliminary approval June 9, 2026	Final approval pending
CFPB Section 1071 small-business data	Compliance January 1, 2028	Revised rule live; card coverage to confirm

Sources: Announcement 2026-11, Notice 2026-60, Rev. Proc. 2019-48, GSA, NJC, Nacha, Finance Canada, CFPB; Visa entries in Sources.

Key every rate to the expense date and the jurisdiction, and US mileage to the payment date too; store the rate you applied, not a pointer to today's table.

Ask an expert: when a rate changes mid-period, do customers re-rate claims that were submitted but not yet paid?

Interfaces & standards

What format and protocol do counterparties speak?

A spend platform speaks four families of standards.

Authorization: ISO 8583 messages through the issuer processor, turned into webhooks the platform answers in 2 to 3 seconds; just-in-time funding moves the company's money at the same moment.
Merchant data: category codes (ISO 18245, though each network keeps its own list), 25-character names, and Level 2 and 3 data (tax, then line items), which only the merchant can send. In the US, Level II no longer earns a lower rate except on fuel, and Level 3 counts only once Visa validates it.
Bank card files for outside software: Visa Commercial Format (VCF 4.x) or Mastercard's CDF3, sent by SFTP after the company authorizes its bank. One Canadian bank charges $1,000 to set it up plus $0.35 a transaction.
Out to finance: ERP journals through accounting APIs; payroll files; Nacha PPD files for reimbursements. Since March 20, 2026, Nacha requires wage credits to say "PAYROLL"; reimbursements aren't wages, so banks advise a different description.

Accounting APIs now cost money: two accounting vendors started charging for API access in 2025 and 2026 (trade-press reports).

Where the receipt gets lost

The rail doesn't carry it. An authorization has an amount, a merchant and a code, not items or purpose.
The bank file comes late. A bank card reaches expense software as a daily file after clearing. A platform that sees each authorization can ask for the receipt while the employee is still at the counter (my inference).
The names don't match. The receipt shows a trading name; the card shows a 25-character descriptor, sometimes behind a payment facilitator's prefix.
Line items are optional, and patchy in travel. I found no e-receipt standard with real North American adoption.

Sources: Visa Merchant Data Standards Manual, Visa US interchange, Nacha; webhook timings from two issuer processors' documentation, file fees from a Canadian bank's FAQ.

Card rails move money and a merchant's identity, not a purchase's purpose; the product is the bridge from authorization data to a receipt and a GL code.

Ask an expert: for customers who keep their bank card and use our software, how late and how lossy are the VCF and CDF3 feeds compared with our own authorization stream?

Networks & counterparties

Who sits between us and the outcome, and what do they want?

A card program is a chain of contracts: network to bank, bank to program manager, processor to bank, bank to company, and bank to employee only under individual liability.

Party	What they control	What they earn
Sponsor bank	Charter, BIN, cardholder agreement, credit box, collateral, termination	A few basis points; one fintech-focused bank about 8 (2025)
Program manager (the spend fintech)	Customer, product, credit model inside bank policy, rewards	Interchange after rebates, software, float
Issuer processor	Authorizations, card records, controls; may hold the interchange contract	Basis points; one public processor about 16 (2025)
Card network	Rules, interchange tables, incentives, uptime, misuse insurance	Fees both sides; Visa paid $15.75B in client incentives in FY2025
Funders	Advance rates and covenants on facilities secured by card receivables	Interest
Merchant and acquirer	Category code, data; soon, whether to take commercial cards	Pay interchange
Travel agency or T&E suite	Booking channel, itinerary, duty-of-care data	Booking fees, commissions
Accounting and HR platforms	API access and price, the employee list, increasingly their own cards	API fees, bundles

Three surprises. Single points of failure: on October 20, 2025, a change on Visa's side stopped North American traffic reaching one issuer processor, and stand-in rates stayed high until a fix by October 30. Migrations happen: one public expense company moved its card to a new sponsor bank in 2024, keeping its processor and network. The interchange contract may not be yours: one public processor's bank contracts give it all the interchange, which it shares with customers.

Sources: Visa 10-K (FY2025); processor, bank and platform figures from their filings and the processor's status page (company-reported; basis points are my arithmetic).

A spend fintech owns the customer but rents the license, the rails and sometimes the interchange contract, and each landlord can change the terms without asking.

Ask an expert: if our sponsor bank froze new accounts tomorrow, how long would a BIN migration take and what would break?

Regulatory layering

Jurisdiction × activity × entity type: is it a license or a certification?

Business cards fall through most of the consumer law PMs expect.

Layer	US	Canada	Enforced by
Card law	Reg Z §1026.12: $50 cap on unauthorized use of any credit card; contracts differ at 10+ cards. No billing-error rights, CARD Act or Reg E for business accounts	Bank Act: $50 cap; unclear for business cardholders	CFPB, courts; FCAC
Credit law	Reg B (a limit cut can be adverse action); Section 1071 from 2028	No equivalent found	CFPB
Tax and employment law	IRC 62 and 274; FLSA; state reimbursement laws	Income Tax Act; Excise Tax Act; Canada Labour Code; Quebec labour law	IRS, DOL, states; CRA, ESDC, Quebec
Anti-money laundering, money movement	Bank Secrecy Act, through the bank; state money transmission if the platform holds funds	FINTRAC registration; RPAA registration	FinCEN, states; FINTRAC, Bank of Canada
License	The bank's charter; money transmitter licenses or an exemption; Visa agent registration	A bank or trust company issuer, or a fintech under its own Visa licence	Regulators; the network
Network rules	No zero liability on Corporate and Purchasing cards; misuse insurance; dispute windows	Same; misuse insurance of at least CAD 100,000 per cardholder	Networks, through issuers
Attestation	PCI DSS v4.0.1 for issuers and their agents; SOC 1 and 2	Same	Networks; customers
Bank policy	Credit box, KYB depth, reserves, prohibited industries	Same	The sponsor bank

Card law

US: Reg Z §1026.12: $50 cap on unauthorized use of any credit card; contracts differ at 10+ cards. No billing-error rights, CARD Act or Reg E for business accounts
Canada: Bank Act: $50 cap; unclear for business cardholders
Enforced by: CFPB, courts; FCAC

Credit law

US: Reg B (a limit cut can be adverse action); Section 1071 from 2028
Canada: No equivalent found
Enforced by: CFPB

Tax and employment law

US: IRC 62 and 274; FLSA; state reimbursement laws
Canada: Income Tax Act; Excise Tax Act; Canada Labour Code; Quebec labour law
Enforced by: IRS, DOL, states; CRA, ESDC, Quebec

Anti-money laundering, money movement

US: Bank Secrecy Act, through the bank; state money transmission if the platform holds funds
Canada: FINTRAC registration; RPAA registration
Enforced by: FinCEN, states; FINTRAC, Bank of Canada

License

US: The bank's charter; money transmitter licenses or an exemption; Visa agent registration
Canada: A bank or trust company issuer, or a fintech under its own Visa licence
Enforced by: Regulators; the network

Network rules

US: No zero liability on Corporate and Purchasing cards; misuse insurance; dispute windows
Canada: Same; misuse insurance of at least CAD 100,000 per cardholder
Enforced by: Networks, through issuers

Attestation

US: PCI DSS v4.0.1 for issuers and their agents; SOC 1 and 2
Canada: Same
Enforced by: Networks; customers

Bank policy

US: Credit box, KYB depth, reserves, prohibited industries
Canada: Same
Enforced by: The sponsor bank

Three things to know. Reg Z's $50 cap reaches business credit cards, but at 10 or more cards the company and issuer may agree other terms, and employees keep the cap only against use by someone else. Business debit, prepaid and just-in-time cards have no statutory cap, because Reg E covers only consumer accounts. And where a bank has primary oversight and control of a prepaid program, FinCEN says no participant must register as the provider of prepaid access.

In Canada, a platform that holds end-user funds or moves reimbursements likely needs FINTRAC registration (since April 2022) and RPAA registration (since September 8, 2025). Banks are excluded from the RPAA, and so are agents of registered payment service providers, but agents of banks aren't named. My reading: "we act for the issuing bank" is no obvious exclusion for a Canadian card program manager. That needs counsel.

Sources: 15 U.S.C. 1645, Reg Z 1026.12 and 1026.3, Reg E, Reg B, FinCEN (search result), Bank Act, RPAA, Bank of Canada, FINTRAC, Visa Rules.

Ask an expert: which bank requirement costs us the most growth, and is it a legal rule or the bank's own risk appetite?

Exceptions & reversals

What goes wrong, and how is it undone?

Card exceptions run on network clocks; expense exceptions are conversations with an employee.

Exception	Who starts it	Clock (as of Oct 2026)	The way back
Decline: limit, category, prepaid balance	Processor or platform	2 to 3 seconds	New limit or card; one decline isn't Reg B adverse action
Stand-in approval against policy	The network, if the processor is down	At authorization	None at network level; recover from the employee, or absorb
Forced, late or larger capture	Merchant	Up to the clearing window: 10 days online, 30 for lodging	A dispute; controls can't block it
Refund	Merchant	Within 3 business days of settlement (Visa US), even to a canceled card	Match it to the original sale yourself
Third-party fraud	Cardholder, through the issuer	Visa 120 days; processors sooner; one bank contract 60 days after billing	Chargeback
Missing receipt	Expense tool	Company reminders; the IRS's 60 days	Signed statement plus corroboration; suspend the card
Out of policy or personal charge	Approver or audit	120 days to repay before it's wages	Employee repays; payroll deductions limited by law
Refund to a personal card after reimbursement	Merchant	Any time	Detect it and recover
Reimbursement ACH returned (R02, R03)	Employee's bank	2 banking days	Fix the account and resend
Uncashed reimbursement check	Employee	State dormancy rules	Void, reissue, or report as unclaimed property

Decline: limit, category, prepaid balance

Who starts it: Processor or platform
Clock (as of Oct 2026): 2 to 3 seconds
The way back: New limit or card; one decline isn't Reg B adverse action

Stand-in approval against policy

Who starts it: The network, if the processor is down
Clock (as of Oct 2026): At authorization
The way back: None at network level; recover from the employee, or absorb

Forced, late or larger capture

Who starts it: Merchant
Clock (as of Oct 2026): Up to the clearing window: 10 days online, 30 for lodging
The way back: A dispute; controls can't block it

Refund

Who starts it: Merchant
Clock (as of Oct 2026): Within 3 business days of settlement (Visa US), even to a canceled card
The way back: Match it to the original sale yourself

Third-party fraud

Who starts it: Cardholder, through the issuer
Clock (as of Oct 2026): Visa 120 days; processors sooner; one bank contract 60 days after billing
The way back: Chargeback

Missing receipt

Who starts it: Expense tool
Clock (as of Oct 2026): Company reminders; the IRS's 60 days
The way back: Signed statement plus corroboration; suspend the card

Out of policy or personal charge

Who starts it: Approver or audit
Clock (as of Oct 2026): 120 days to repay before it's wages
The way back: Employee repays; payroll deductions limited by law

Refund to a personal card after reimbursement

Who starts it: Merchant
Clock (as of Oct 2026): Any time
The way back: Detect it and recover

Reimbursement ACH returned (R02, R03)

Who starts it: Employee's bank
Clock (as of Oct 2026): 2 banking days
The way back: Fix the account and resend

Uncashed reimbursement check

Who starts it: Employee
Clock (as of Oct 2026): State dormancy rules
The way back: Void, reissue, or report as unclaimed property

Sources: Visa Rules (April 2026), Reg B, Treas. Reg. 1.62-2, 29 CFR 531.35; capture behavior and processor deadlines from issuer processors' documentation; dormancy periods vary by state.

Two rules surprise newcomers: you can't dispute an authorization, only a cleared transaction, and a platform can't stop a cardholder from filing a fraud dispute. Card reversals belong to the merchant or the network, on their clocks; expense reversals belong to the employee relationship, under employment law.

Ask an expert: what share of our corporate-card disputes are third-party fraud, merchant disputes and employee "friendly fraud", and how many do we write off without filing?

Liability allocation

When it fails, who pays?

Strangers' fraud has a legal cap and a dispute process; your own people's misuse has neither.

Failure	Who absorbs it	Mechanism
Stolen card, third-party fraud (credit or charge)	The merchant if the dispute is won; else the company, or an individually liable employee up to $50	Reg Z; at 10+ cards the contract decides
Same, on a prepaid or business debit card	The company or the program manager	No Reg E; Visa's zero liability excludes Corporate and Purchasing
Employee misuse	Company, employee or both, by liability model	Not "unauthorized use": the employee had authority
Misuse by an employee who has left	Network misuse insurance, if the card was canceled in time	See below
Business expense on an individual card, California	The employer	Labor Code 2802
Stand-in approval	The issuer at network level, passed down by contract	Visa Rules
Customer can't pay its charge balance	Whoever holds the receivable, often the fintech and its funders	Participation agreements
Unsubstantiated charge never repaid	The employee, as wages; the employer owes payroll tax	Treas. Reg. 1.62-2
Late reimbursement	The employer	California interest and fees; New York misdemeanor
Purchase made by an AI agent	The cardholder, as if it had made it	Visa rule on agentic payment providers

The waivers. Visa's US program covers misuse by employees who've left: up to $100,000 per cardholder at five or more cards ($5,000 at one to four), for charges billed up to 75 days before the termination notice or made up to 14 days after, if the card was canceled within two business days, and only one paid claim per person. Mastercard's covers $25,000 per cardholder at two to four cards and $100,000 at five or more, but not one-card companies, lost or stolen cards, or owners and shareholders above 5%. The Visa text I found dates from 2004 to 2007, though bank pages repeat its figures. In Canada, Visa requires misuse insurance of at least CAD 100,000 per cardholder.

Sources: Reg Z 1026.12 and interpretation, Visa Liability Waiver Program (copy hosted by the State of Alaska), Visa Rules, California 2802; Mastercard terms from a US bank's brochure.

The law caps what strangers can cost a company, not what its own employees can, and the waiver covers only leavers cut off within two days.

Ask an expert: on individual-liability programs, who really eats it when a leaver owes the issuer, and does the issuer have recourse to the company?

What doesn't transfer

Money flows

Five streams decide whether a card program makes money: the interchange merchants pay, the rebate the company earns, the cost of funding the balance until the company pays, losses, and the cost of processing receipts. A sixth sits off the books: the float employees lend when they pay out of pocket.

What the merchant pays on $1,000 (US Visa unless noted)	Interchange	Amount
Purchasing or corporate, online	2.70% + $0.10	$27.10
Same, card present	2.50% + $0.10	$25.10
Same, with validated Level 3 data	1.75% + $0.10	$17.60
Business credit, online	2.65% to 3.00% + $0.10	$26.60 to $30.10
Regulated debit or prepaid, bank of $10B or more	$0.21 + 0.05% + $0.01	About $0.72
Consumer traditional credit, online (for contrast)	1.89% + $0.10	$19.00
Canada: corporate or purchasing, standard	2.00%	$20.00

Sources: Visa US (April 18, 2026), Visa Canada (September 2026). Merchants also pay network fees and acquirer markup. The debit cap is why fintech prepaid programs favor banks under $10B.

Who gets the $27.10

A fintech-run Visa Corporate charge card, online, monthly statement. Illustrative; filings and analysts disagree by an order of magnitude on the bank, network and processor shares.

Line	Amount	Basis
Merchant's total cost (interchange, network fees, markup)	About $29 to $31	Visa table; fees estimated
Sponsor bank, network issuer fees, issuer processor	About $1 to $6 together	Low
Rebate to the company (1.32%)	About $13.20	Two public issuers' rates
Fraud and credit losses (0.23% to 0.25%)	About $2.30 to $2.50	Two public issuers' rates
Funding about 35 days at an assumed 4%	About $3.80; $0.10 on daily settlement	Assumption
Left for the program manager, before its own costs	About $2 to $7; $5 to $10 on daily settlement	My arithmetic

With validated Level 3 data, interchange drops to $17.60, the pool loses $9.50, and the residual goes negative unless rewards fall. With a 3% merchant surcharge, the company pays $1,030 to get about $13 back. For a cross-check, the largest closed-loop issuer's commercial business earned pretax about 0.68% of billed business in 2025.

A company spending $10M a year on cards

Assumptions, mine unless marked: 60% online and 40% card present; a $330 average ticket (one public platform's reported average); a 6% all-in cost of funds.

Line	Rate	Per year	Status
Interchange paid by merchants	About 2.55% blended	About $255,000	Visa rates; one platform realizes about 2.56%
Rebate to the company	1.25%	−$125,000	Assumption; benchmarks 1.0% to 1.5%
Network fees, sponsor bank, processor	About 0.30% together	−$30,000	Assumption, low
Fraud and credit losses	0.23%	−$23,000	One platform's FY2026 rate
Funding the balance, monthly statement (about 35 days)	About 0.58%	−$57,500	Assumption; about −$2,000 with daily settlement
Left, monthly settlement	About 0.2%	About $19,500	My arithmetic
Left, daily settlement	About 0.75%	About $75,000	My arithmetic
Optional software fee	200 users at $12 a month	+$28,800	Assumption from public per-seat prices

Interchange paid by merchants

Rate: About 2.55% blended
Per year: About $255,000
Status: Visa rates; one platform realizes about 2.56%

Rebate to the company

Rate: 1.25%
Per year: −$125,000
Status: Assumption; benchmarks 1.0% to 1.5%

Network fees, sponsor bank, processor

Rate: About 0.30% together
Per year: −$30,000
Status: Assumption, low

Fraud and credit losses

Rate: 0.23%
Per year: −$23,000
Status: One platform's FY2026 rate

Funding the balance, monthly statement (about 35 days)

Rate: About 0.58%
Per year: −$57,500
Status: Assumption; about −$2,000 with daily settlement

Left, monthly settlement

Rate: About 0.2%
Per year: About $19,500
Status: My arithmetic

Left, daily settlement

Rate: About 0.75%
Per year: About $75,000
Status: My arithmetic

Optional software fee

Rate: 200 users at $12 a month
Per year: +$28,800
Status: Assumption from public per-seat prices

On monthly terms the program is near break-even before the platform pays its own staff, and each 10 basis points of interchange or rebate is $10,000, half that margin. On these assumptions, moving the customer from monthly to daily settlement is worth about $55,000 a year to the platform, as much as a 55-basis-point change in interchange (my arithmetic; the two examples use different funding assumptions and point the same way).

The same $10M, out of pocket

Employees lend the company about $822,000, interest-free, if repaid 30 days after purchase: about $49,000 a year at 6%.
Rewards go to employees' personal cards, funded by consumer interchange, not to the company.
Processing: at GBTA's $58 per report and an assumed $800 report, 12,500 reports cost about $725,000, plus about $124,000 to fix the 19% with errors at $52 each: about 8.5% of spend, an upper bound from 2015.
Paying by ACH costs $0.26 to $0.50 each (AFP, 2021 data): about $5,000.

Even if the processing benchmark is five times too high, the card wins for the company.

How spend platforms make money

Public filings show four businesses under one label: card-first platforms on interchange, T&E suites on travel fees, expense software on seats, the closed-loop issuer on merchant discount. The table in "Free" software paid by interchange compares them.

Tax is money too. A $10,000 car allowance under a nonaccountable plan carries 22% withholding plus 7.65% employee and 7.65% employer FICA. In Canada, GST/HST recovery on a reasonable allowance is worth 4.8% (5/105) to 13% (15/115) of it, plus about 9% QST in Quebec.

Sources: GBTA (2015), Pub 15, RC4022; AFP's ACH cost is in procure to pay; platform and issuer figures from 10-K and 10-Q filings, ratios my arithmetic.

"Free software" on a card-first platform means the merchant pays interchange, the customer gets about half back, and the platform lives on what's left after losses and funding.

The power map

Power follows the license, the interchange table and the ledger, and a spend fintech holds none of them.

Card networks reprice everyone twice a year without negotiation and pay incentives to issuers.
Sponsor banks hold the most day-to-day power: onboarding, prohibited industries, KYB depth, reserves, revenue share at renewal, termination. Under a regulator's order they can be required to drop partners.
Bank issuers and the closed-loop issuer set rebates and credit, and now own spend software. One bank, which bought a card network in 2025, could in principle move commercial volume onto it (my inference).
Issuer processors decide what happens in an outage and may hold the interchange contract.
Program managers own the customer, the data and the credit model, and carry the losses; rewards squeeze them (one platform's reached 51% of interchange, up from under half).
Funders set covenants that cap how fast a charge-card book can grow.
Accounting and HR platforms own the CFO's workflow and the employee list. Two accounting vendors started charging for API access in 2025 and 2026, and one launched a business card with 2% cash back in July 2026, underwritten on the customer's ledger data.
CFOs trade rebate against settlement terms. Large buyers get rebates near the interchange ceiling (135 basis points in one state contract, see procure to pay); mid-size buyers don't.
Employees have few rights as cardholders and strong ones as claimants, and can route around any program with a personal card.
Merchants pay interchange, and once the card settlement is final may refuse or surcharge commercial cards.

The last two years were a buying spree: an HR software company bought a spend startup for about $325M (2024), the largest closed-loop issuer bought expense software (2025), and a large card bank paid $5.15B for a spend fintech (2026). My hypothesis: whoever owns the ledger, the bank account or the employee list is taking the customer, and standalone spend platforms are the ones being bought. Counter-evidence: private spend fintechs still raise money at high valuations (vendor-reported).

Sources: buyers' SEC filings and releases (2024 to 2026), trade press on the accounting vendors (2025 and 2026), Visa US interchange.

Regulation in practice

Almost everything written reaches a spend fintech through its bank.

Anti-money laundering is enforced, through banks. In 2024 the Fed issued a cease-and-desist order to Synapse's main partner bank, the FDIC issued consent orders to four banks over fintech partners, and one bank was ordered to end relationships with "significant" fintech partners. In April 2026 the OCC ordered a payments-heavy New York savings association to fix monitoring that auto-closed alerts. Trackers show more orders ending than starting, but findings keep coming.
Guidance is loosening. The OCC and FDIC dropped reputation risk (final rule effective June 9, 2026), and the FDIC's custodial-account rule has no date. On September 11, 2026, the bank agencies proposed non-binding third-party guidance under which deviation "will not alone support supervisory criticism" (comments due November 10). Whether banks relax their contracts is open.
Money transmission bites when the platform holds money. Holding a company's funds to pay employees or suppliers needs money transmitter licenses, an exemption or a bank structure (my reading). States are adding exemptions for payroll processors (Maryland's starts October 1, 2026); reimbursements are similar but not named. Florida fined a software company $155,000 for unlicensed money transmission in March 2026.
Section 1071 arrives in 2028, maybe for cards. The CFPB re-finalized its small-business lending data rule on May 1, 2026: compliance from January 1, 2028, only for lenders with 1,000 covered originations in each of two years, where "small business" means $1M revenue or less. Summaries list credit cards as covered, and one reading suggests business charge cards stay in; I couldn't confirm card coverage in the rule text, and who reports in a sponsor-bank model is open. Treat it as a design question for counsel, not a settled duty.
Tax and labor law are enforced in bulk: employment-tax audits that reclassify a whole plan, and California class actions, rarely one claim (my synthesis, to confirm).

Jurisdiction	Rule	Deadline
California	Reimburse "all necessary expenditures or losses"; unwaivable	None; interest from the day spent, plus attorney's fees
Illinois	Necessary expenses within the scope of employment	Employee submits within 30 days, unless policy allows more
Iowa	Authorized expenses	Within 30 days of the claim
New Hampshire	Expenses at the employer's request	Within 30 days of proof of payment
New York	A "wage supplement", if agreed	Misdemeanor 30 days after due
North Dakota, South Dakota, Montana	Indemnify necessary expenditures	None
Canada, federally regulated employers	Reasonable work-related expenses (since 2023)	Within 30 days of the claim

California's labor agency treats the IRS mileage rate as reasonable and says employers can't force reimbursement by direct deposit (a 1997 opinion, still published). I found no general duty in Massachusetts, Minnesota or DC. In Canada, the Bank of Canada has published RPAA notices of violation since June 12, 2026.

Sources: Federal Reserve (2024) and 2026 proposal, Bradley, CSBS, JD Supra, Mayer Brown and Husch Blackwell (May 2026), 12 CFR 1002.9, National Law Review (Aug 2025) and the statutes and opinions in Sources.

US regulators loosened guidance in 2025 and 2026 and kept enforcing anti-money-laundering rules; a spend fintech feels both through its bank's contract, and tax and labor law through its customers.

The cost of being wrong

Spend mistakes cost in five currencies.

Cash. Expense reimbursement schemes were 15% of 876 fraud cases in the US and Canada in ACFE's 2026 report. Globally they ran a median of about $35,000 over 18 months, at about $1,900 a month: low and slow. Tips caught 36% of US and Canadian frauds, automated monitoring 4%. One expense-audit vendor reports AI-generated documents went from almost none of the fake receipts it flagged in early 2025 to 70.8% by mid-May 2026; trust the trend more than the level.
Tax. Unsubstantiated charges become wages; a badly designed allowance is taxable in full; a card statement instead of a receipt loses a Canadian tax credit.
Wage claims. A late reimbursement in California accrues interest from the day of the expense, plus attorney's fees.
Bank access. A consent order on the sponsor bank can freeze onboarding overnight or force a migration that reissues every card.
Customers. In 2020 a venture-backed spend fintech cut limits without warning; in 2022 it dropped tens of thousands of small-business customers. When a startup-focused bank failed in March 2023, cash-balance underwriting suddenly depended on where that cash sat. The underwriting model defines the market and decides who gets cut when funding tightens.

Sources: ACFE 2026 (full text via a chapter site), PYMNTS (vendor data), Orrick InfoBytes (Feb 2024); the 2020 to 2023 episodes from trade press in Sources.

"Free" software paid by interchange: what's real

My verdict as of October 2026: "free" describes the price of the software, not the economics. On card-first platforms the merchant pays 2.5% to 2.7%, the customer gets about 1% to 1.5% back, and the platform's margin depends on losses and on how fast the customer pays the card. Ask any vendor who pays for the software, and what happens to your price if interchange falls.

Who actually funds it

Model	Who pays	How, per public filings
Card-first SMB platform	Merchants, through interchange	Card fees about 2.56% of volume and 41% of revenue; about half returned as rewards
Travel-and-expense suite	Travel suppliers and payment partners	About 90% of revenue from booking fees and commissions; its bring-your-own-card product earns no interchange
Expense software	Customers, per seat	Interchange about 15% of revenue, up 24% in 2025 as paid members fell 5%; card spend buys a seat discount
Closed-loop charge issuer	Merchants, plus card fees	Rewards about half of discount revenue
Accounting vendor's own card	Merchants	2% cash back, underwritten on ledger data; economics not public

Compare carefully: one filer books rewards as a marketing expense and another against revenue, and card volume, billed business and total payment volume are different denominators.

Rebates are priced by settlement speed

A public multi-state card contract pays up to 44 extra basis points for paying the balance within a day, falling one basis point a day to zero at 45 days (procure to pay has the full stack). One public expense company pays 2% cash back above $250,000 of monthly settled spend, 1% below, and offers daily settlement. In the $10M example, the platform keeps about $19,500 on monthly terms and about $75,000 on daily. Settlement speed is the price nobody puts on the pricing page, and it's the hypothesis I most want an operator to confirm or kill.

What could change it

Visa's enhanced-data program. Validated Level 3 data cuts corporate interchange online from 2.70% to 1.75%; one public issuer processor's filing says it "results in lower interchange revenue" for it and its commercial customers.
The Visa and Mastercard settlement. Preliminarily approved on June 9, 2026, it would let merchants decline credit cards by category, commercial among them, and surcharge more freely (up to the lower of 3% or cost, per one consultancy). It cuts average credit interchange by 10 basis points for five years, but has no commercial-specific cap, and it's unclear whether the cut reaches commercial cards. Trade press reports a fairness hearing on November 16, 2026, and repricing no earlier than October 2027. My reading: hotels and airlines are unlikely to refuse corporate cards; B2B suppliers may refuse or surcharge, at the company's cost.
The Credit Card Competition Act (S.3623, January 2026) would make banks over $100B in assets enable a second network on credit cards, with no business-card carve-out; closed-loop cards are exempt. No floor vote yet. My inference: it hits big banks' commercial books, not the smaller sponsor banks behind most fintech programs.
Illinois' law barring interchange on tax and tips is enjoined for national banks and networks; a delay to July 1, 2027 passed the legislature (signature unconfirmed).
Canada and the EU, for contrast. Canada's 2024 cuts cover consumer credit only, so a commercial card costs a small merchant 2.00% against a 0.95% in-store average for consumer credit. The EU caps consumer cards at 0.2% and 0.3% and excludes commercial cards; merchants there called for a commercial cap in May 2026.

If interchange fell, every 10 basis points would cost $10,000 a year on a $10M program. Rewards go first: after Durbin capped debit interchange, debit rewards largely disappeared and banks recovered about 30% of the lost revenue through deposit fees (Fed, 2014). Then shorter settlement terms, fees on the free tier, and more bill pay, currency and float.

Questions to ask a vendor

What's your revenue mix? Interchange, subscriptions, travel fees, float, add-ons.
What share of interchange do you give back, and how do you book it?
What does my rebate depend on? Volume, settlement frequency, Level 3 data.
Who holds the interchange contract: you, your processor or the bank?
If suppliers surcharge or refuse commercial cards, what happens to my rebate and policy?
Which bank issues the card, and what happens to my card numbers if you change banks?
Who funds my balance until I pay, and what can your funders change?
If interchange falls 10 basis points, what do you change first?

Sources (as of Oct 2026): Visa 8-K (Nov 2025), Payments Dive, L.E.K. (Jan 2026), PYMNTS (search result), S.3623, PYMNTS on Illinois, Visa Canada, Finance Canada, Proskauer, EuroCommerce (search result), Federal Reserve (2014); company figures from public filings.

Top failure modes

Symptom	Likely cause	Reversal path	Who absorbs it
Off-policy spend approved during an outage	Decision webhook timed out; default rule or network stand-in approved	Recover from the employee; review fallback rules	The issuer at network level; the program manager by contract
Charges keep posting to a canceled card	Late or forced captures; recurring charges	Dispute; cancel rather than suspend; tell merchants	The company until a dispute is won
Card declined at the hotel desk	A hold or incremental authorization used up the limit; a category block	Raise the limit; release the hold	The employee's evening; the company's goodwill
Close waits on receipts	Missing receipts, uncoded card lines	Reminders; suspend cards until receipts arrive; accrue	Finance
A leaver's card still in use	Not canceled within two business days; subscriptions on the card	Cancel, written notice, waiver claim within 90 days	The company, unless the waiver pays
Same expense paid twice	A card line and an out-of-pocket claim; two reports	Duplicate checks across card and claims; recover	The employer
Fake or inflated receipts	Fictitious, overstated or AI-generated documents	Check against card data, itinerary and e-receipts; audit	The employer
Late reimbursement becomes a wage claim	Approval backlog; paid through payroll	Pay with interest; move to ACH or EFT	The employer
Allowance taxed after an audit	Flat car allowance with no log; kilometre allowance plus fuel card	Redesign the plan; payroll catch-up	Employer and employee
Canadian input tax credits denied	Card statement only; invalid GST/HST number; meals not halved	Capture tax fields and supplier numbers	The company
Sponsor bank freezes onboarding or exits	Consent order on the bank	Second sponsor; BIN migration and reissue	The program manager; customers get new card numbers
Limits cut across the book	Funder covenants; customers' cash falling	Reg B notices; daily settlement	Customers; the program manager

Off-policy spend approved during an outage

Likely cause: Decision webhook timed out; default rule or network stand-in approved
Reversal path: Recover from the employee; review fallback rules
Who absorbs it: The issuer at network level; the program manager by contract

Charges keep posting to a canceled card

Likely cause: Late or forced captures; recurring charges
Reversal path: Dispute; cancel rather than suspend; tell merchants
Who absorbs it: The company until a dispute is won

Card declined at the hotel desk

Likely cause: A hold or incremental authorization used up the limit; a category block
Reversal path: Raise the limit; release the hold
Who absorbs it: The employee's evening; the company's goodwill

Close waits on receipts

Likely cause: Missing receipts, uncoded card lines
Reversal path: Reminders; suspend cards until receipts arrive; accrue
Who absorbs it: Finance

A leaver's card still in use

Likely cause: Not canceled within two business days; subscriptions on the card
Reversal path: Cancel, written notice, waiver claim within 90 days
Who absorbs it: The company, unless the waiver pays

Same expense paid twice

Likely cause: A card line and an out-of-pocket claim; two reports
Reversal path: Duplicate checks across card and claims; recover
Who absorbs it: The employer

Fake or inflated receipts

Likely cause: Fictitious, overstated or AI-generated documents
Reversal path: Check against card data, itinerary and e-receipts; audit
Who absorbs it: The employer

Late reimbursement becomes a wage claim

Likely cause: Approval backlog; paid through payroll
Reversal path: Pay with interest; move to ACH or EFT
Who absorbs it: The employer

Allowance taxed after an audit

Likely cause: Flat car allowance with no log; kilometre allowance plus fuel card
Reversal path: Redesign the plan; payroll catch-up
Who absorbs it: Employer and employee

Canadian input tax credits denied

Likely cause: Card statement only; invalid GST/HST number; meals not halved
Reversal path: Capture tax fields and supplier numbers
Who absorbs it: The company

Sponsor bank freezes onboarding or exits

Likely cause: Consent order on the bank
Reversal path: Second sponsor; BIN migration and reissue
Who absorbs it: The program manager; customers get new card numbers

Limits cut across the book

Likely cause: Funder covenants; customers' cash falling
Reversal path: Reg B notices; daily settlement
Who absorbs it: Customers; the program manager

Sources: Visa Rules, Visa Liability Waiver Program, ACFE, CRA, Memorandum 8.4. Ranking these by volume or cost needs an operator's data; I haven't found any public.

False friends

Term	What you'd assume	What it means here
Issuer	The brand on the card	The bank. "We issue cards" usually means the fintech runs a bank's program
Corporate card	Any company card	Also a specific Visa product, separate from Business and Purchasing, with its own interchange and rules
Charge card	Debit, or no limit	A credit card under Reg Z with no periodic rate, paid in full
Zero liability	Fraud costs the company nothing	Visa's excludes Corporate and Purchasing cards and covers Visa Business
Liability waiver	Fraud insurance	Insurance for misuse by employees who have left, if canceled in time
Unauthorized use	Any charge the company didn't want	Use by someone without authority. Most employee misuse doesn't count
Authorization	The purchase was approved	A hold where controls act. Stand-in can approve what you'd decline, and you can't dispute one
Rebate, rewards, cash back	A discount	A share of the merchant's interchange, booked differently by each filer
Card statement	A receipt	Proof of payment only in the US; not enough for an input tax credit in Canada
Per diem	A daily cap	An IRS amount deemed proved, the GSA federal maximum, an NJC allowance paid regardless, or a company cap
Allowance	A reimbursement	Canada: paid without accounting, tax-free only if reasonable. US: wages unless substantiated
Mileage rate	What employees must be paid	IRS 76¢ a mile and CRA $0.73 a km are tax ceilings, not mandates
Reimbursement deadline	One clock	Illinois: the employee's 30 days to submit. Iowa, New Hampshire, Canada Labour Code: the employer's 30 days to pay. IRS: 60 and 120-day safe harbors
50% meals	Employees get half	The employer's deduction limit; 0% for convenience meals from 2026
Small business	One definition	A Visa card tier; a Section 1071 applicant ($1M revenue or less); the Reg B notice line ($1M)

Sources: Reg Z 1026.2, Visa Rules, Pub 463, CRA travel expenses, DLSE (search result).

Where my analogy broke

"The receipt is remittance." Writing the order-to-cash guide, I learned that a payment and its explanation arrive separately and that matching them is the job. I expected the same here, and it is, with one difference. A payer sends remittance because it wants its invoice closed. The employee already has the dinner. Nobody on the other side wants the match to happen, so the product has to tie the receipt to something the employee does want: a card that keeps working.

"A decline is a carrier filter." In telco, filtering was something carriers did to my traffic, and I learned to read their verdicts. Here the filter is mine, it has two seconds to decide, and if I'm late the network decides for me and the issuer owns the result.

"The user is just the customer's employee." Every B2B product I've worked on had admins and users, both on the customer's side of the table. Here the same person can be the customer's debtor, its creditor protected by wage law, or the likeliest fraudster, depending on which instrument they're holding that day.

"Rebates are a bonus." In procure to pay, the virtual card rebate was a pleasant extra on top of the buyer's float. Here the rebate is half the revenue, handed back to win the customer, and how fast the customer pays decides whether the program makes money at all.

"Approval is a three-way match." In AP, the purchase order and the goods receipt exist before the invoice, so approval can check something. With a card, the purchase happens first and the justification arrives later, if at all. The only check that can stop the money is the card control at authorization; the rest is evidence for auditors.

Self-check: 20 questions

Trace an employee purchase to a closed period on the card path and the out-of-pocket path. Where does each break? Answer
Why do the card transaction and the receipt travel separately, and why doesn't that happen out of pocket? Answer
Who pays for "free" spend software, and why is the answer different for a T&E suite? Answer
On a $1,000 online corporate-card purchase, who gets the $27.10? Answer
Why does daily settlement change whether a $10M card program makes money? Answer
Name the parties behind one corporate card. Under Reg Z, who is the cardholder? Answer
Why can a refund land on a canceled card, and what should happen to cards when an employee leaves? Answer
What failed at Synapse, and why does it matter to a platform holding prepaid balances? Answer
What are the three tests of a US accountable plan, and what happens when one fails? Answer
Why might a Canadian corporate-liability program miss the GST/HST card method? Answer
A June 2026 trip is reimbursed in July. Which IRS mileage rate applies, and why? Answer
How does a bank card's data reach third-party expense software, and how late? Answer
What can a sponsor bank, a processor and a network each change without the program manager's consent? Answer
Which registrations might a spend platform that pays reimbursements need in the US and Canada? Answer
Your authorization webhook times out. Who decides, and who owns the result? Answer
A corporate card is stolen and used online. Who absorbs the loss on a credit card, and on a prepaid card? Answer
A leaver's card is still in use two weeks later. What does the network insurance cover, and when? Answer
Which states make a late reimbursement a wage problem, and what does California add? Answer
What would the Visa and Mastercard settlement and the Credit Card Competition Act change for commercial cards? Answer
Why are banks, accounting vendors and HR platforms buying or building spend products? Answer

Sources

Undated entries were read on October 1, 2026.

Card and credit law, US regulators

CFPB: Reg Z 1026.2, 1026.3, interpretation of 1026.12, Reg E 1005.2, Reg B 1002.2 and 1002.9, small-business lending rule (May 2026)
Cornell LII: 12 CFR 1026.12, 15 U.S.C. 1645
FDIC: custodial account proposal (Oct 2024), agenda entry (Fall 2025), reputation risk rule (Apr 2026)
Federal Reserve: enforcement action (Jun 2024), third-party risk proposal (Sep 2026)
FinCEN: prepaid access ruling (search result), beneficial ownership; CSBS, MTMA update (Aug 2026)
S.3623, Credit Card Competition Act, Jan 2026

US tax, travel and labor rules

IRS: Treas. Reg. 1.62-2 and 1.274-5, Pub 463 (2025), Pub 15 and Pub 15-B (2026), Notice 2026-10, Announcement 2026-11, Notice 2026-60, Rev. Proc. 2019-48
GSA: FY2027 per diem (Sep 2026), SmartPay travel training
29 CFR 531.35 (Cornell LII); Nacha, Company Entry Descriptions
States: California Labor Code 2802, New York 198-c, Iowa 91A.3; DLSE opinions 1997 and 1993

Canada

CRA: kilometre allowance (Jan 2026), travel expenses, RC4022, Memorandum 8.4
NJC Travel Directive, Appendix C (Oct 2026); ESDC, work-related expenses (May 2025)
Justice Laws: Bank Act, RPAA; Bank of Canada, supervision FAQ (Aug 2026); FINTRAC (Jul 2022); Finance Canada, card fee cuts (Oct 2024)

Card networks

Visa: Core and Product Rules (Apr 2026), US interchange (Apr 2026), Canada interchange (Sep 2026), Merchant Data Standards Manual (Apr 2026), Liability Waiver Program (2004, modified 2007), 10-K (FY2025), 8-K on the settlement (Nov 2025)

Data and research

Federal Reserve: Durbin working paper (2014); Atlanta Fed, business card use (Nov 2024)
Nilson Report: US commercial cards 2024, Canada commercial credit 2025 (public summaries)
ACFE, Occupational Fraud 2026 (full text)
GBTA: expense reporting study (2015), travel payment methods (2017); CFO.com on APQC, T&E reimbursement (Jul 2023)

Law firms, consultancies and trade press

Mayer Brown and Husch Blackwell on Section 1071 (May 2026); National Law Review on bank-fintech liability (Aug 2026) and on state reimbursement laws (Aug 2025)
Bradley (Aug 2026), Orrick InfoBytes (Feb 2024), JD Supra (Mar 2026)
Synapse: American Banker, Banking Dive (2025)
Interchange: Payments Dive (Jun 2026), L.E.K. (Jan 2026), PYMNTS on the hearing and Illinois, ABA Banking Journal (Jun 2026), Proskauer, EuroCommerce (May 2026)
AI receipts: PYMNTS (Jun 2026, vendor data)

Cited without links (the source URL carries a company's name or ticker)

Forms 10-K and 10-Q (FY2025 and FY2026) of a public SMB payables and spend platform, a public travel-and-expense platform, a public expense-software company, the largest closed-loop charge-card issuer, a public issuer processor and a fintech-focused sponsor bank (company-reported)
Acquisition filings and releases (Sep 2024 to Apr 2026)
Issuer processors' developer documentation and one processor's incident report (Oct 2025) (secondary: vendor)
Bank documents: an individual-liability cardholder agreement (Oct 2024), a coverage brochure with Mastercard terms, a Visa Commercial Format FAQ
Trade press on an accounting vendor's card, accounting API pricing, and a spend fintech's 2020 limit cuts, 2022 small-business exit and 2023 bank-failure response

Field Guides are learning notes, not legal or compliance advice. Rules and fees change; check the cited primary sources before you act on anything here.