Key concepts

Each card carries three identities, and each expense adds two more.

Reg Z (the US credit card rule) counts organizations as cardholders, so on a corporate account the company is the cardholder. The employee becomes a debtor, and needs a credit check, only under individual ("the cardholder will be solely liable", in Mastercard's definitions) or joint liability. Under every model, though, the employee's details drive rules: work state, province (which HST factor), Quebec (a second tax slip), owning 10% or more of the company (no lodging per diem for related parties), and a federally regulated Canadian employer (a 30-day reimbursement rule).

Visa's merchant data rules have the acquirer pick a code for the merchant's main business and cut the name to 25 characters; marketplaces use one code (5262) for everything they sell. So the network knows roughly who was paid, never what was bought. US companies stopped reporting beneficial owners to FinCEN in March 2025, but banks still collect them, and sponsor banks push that work onto the program manager. I'd model the bank, the company, the employee and the merchant as separate identities, because each answers a different question.

Four machines run on one purchase, and they end at different times:

• Card: unactivated, active (a virtual card counts once viewed), suspended, terminated.
• Authorization: approved or declined, held, increased or partly reversed, then cleared or expired (Visa allows 10 days online, 30 for lodging and car rental).
• Expense: draft, submitted, returned or approved, audited, exported, paid, archived.
• The employee's obligation: an advance or personal charge, then repaid, or treated as wages after the IRS's 120 days.

A transaction can outlive its card: refunds and late captures land after cancellation. A salesperson leaves on a Friday and her card is canceled; on Monday the hotel's final bill and a software renewal still arrive against it. And one issuer processor allows recurring authorizations on expired cards unless they're canceled. When someone leaves, cancel rather than reissue, or Visa Account Updater sends the new number to every merchant that stored the old one.

The word that causes the most trouble is "done":

Legal clocks hang on these states. Illinois' 30 days to submit and the IRS's 60 days run from the expense date. Payment deadlines run from the claim: 30 days in Iowa, New Hampshire and federally regulated Canadian workplaces. In New York, an unpaid agreed reimbursement is a misdemeanor 30 days after it's due. Because the four machines end at different times, most of the bugs sit where one has ended and another hasn't.

Every fact has an owner, and few of them are the platform.

The classic breaks: the processor and the bank disagree on what settled; card spend is uncoded at close; unsubmitted out-of-pocket spend is accrued as a guess, or ignored. And pooled funds stop adding up. Synapse, a banking-as-a-service middleware company, failed in April 2024 with its ledger out of step with its banks'. The shortfall was estimated at up to $95M, and the CFPB later paid about $46M from its penalty fund to the people affected. Prepaid cards and spend-platform cash accounts use the same pooled structure.

The FDIC's 2024 proposal for daily reconciliation of custodial accounts has no final date ("To Be Determined"), but banks demand it by contract anyway: a law firm's August 2026 summary lists real-time, auditable ledger reconciliation among sponsor banks' standard asks. So four ledgers describe one purchase: the bank's wins for what's owed, the expense tool's for why and the ERP's for the books, and someone has to reconcile them every day.

The company writes the spend policy; five other parties fence it in.

The accountable plan. US reimbursements are tax-free only if the plan passes three tests: business connection, substantiation (proof of what was spent and why) and return of any excess (Treas. Reg. 1.62-2). Paying whether or not the employee spends fails the business-connection test, so a flat car allowance with no log is wages. The safe harbor: advances at most 30 days ahead, proof within 60 days, excess back within 120. Fail, and the amount goes on the W-2 with withholding and payroll taxes. Most employees can no longer deduct unreimbursed expenses (made permanent in 2025), so the plan is the only tax-free route.

Law versus policy. US law wants a receipt for lodging and anything else from $75; most policies ask for more. Illinois lets a written policy cut off late claims; California's rights can't be waived. Travel and client meals are 50% deductible, convenience meals 0% since 2026, so the GL needs separate codes. In Canada, a kilometre allowance paid alongside a fuel card for the same use becomes fully taxable, and that comes from how the company designed the plan.

Canadian sales tax. The evidence for an input tax credit grows with the amount: under $100, supplier, date and total; from $100, the tax and the supplier's GST/HST number; from $500, also the buyer's name, a description and terms. Reimbursements can use a factor (4/104 for GST, 12/112 to 14/114 for HST) if 90% of the total bore one tax. Meals get half the credit: on a $226 team dinner in Toronto, $26 of it 13% HST, the company claims back $13. The company-card shortcut needs the cardholder to be "solely or jointly and severally liable", so a pure corporate-liability program may not qualify.

The company writes the policy, but the bank, the network, the tax code and labor law can each overrule it, and only the card controls act at the moment of purchase.

Every rate in an expense has an effective date, and the IRS mileage rate has two. It rose from 72.5¢ to 76¢ a mile on July 1, 2026, the first mid-year change since 2022, but only for miles driven and paid on or after that date: a June trip reimbursed in July stays at 72.5¢. The IRS per diem year starts October 1; through December, an employer on the high-low method uses old or new rates, consistently for everyone.

I'd key every rate to the expense date and the jurisdiction, and US mileage to the payment date too, and store the rate actually applied rather than a pointer to today's table.

A spend platform speaks four families of standards.

• Authorization: ISO 8583 messages through the issuer processor, turned into webhooks the platform must answer in seconds; just-in-time funding moves the company's money at the same moment.
• Merchant data: category codes (ISO 18245, though each network keeps its own list), 25-character names, and Level 2 and 3 data (tax, then line items), which only the merchant can send. In the US, Level II no longer earns a lower rate except on fuel, and Level 3 counts only once Visa validates it.
• Bank card files for outside software: Visa Commercial Format (VCF 4.x) or Mastercard's CDF3, sent by SFTP once the company authorizes its bank. One Canadian bank charges around a thousand dollars to set it up plus a fraction of a dollar per transaction.
• Out to finance: ERP journals through accounting APIs, payroll files, and Nacha PPD files for reimbursements. Since March 20, 2026, Nacha wants wage credits labeled "PAYROLL"; reimbursements aren't wages, so banks advise a different description.

Accounting APIs now cost money: trade press reports two accounting vendors started charging for access in 2025 and 2026.

Where the receipt gets lost

1. The rail doesn't carry it. An authorization has an amount, a merchant and a code. Items and purpose aren't in it.
2. The bank file comes late. A bank card reaches expense software as a daily file after clearing. A platform that sees each authorization can, I'd infer, ask for the receipt while the employee is still at the counter.
3. The names don't match. The receipt shows a trading name; the card shows a 25-character descriptor, sometimes behind a payment facilitator's prefix.
4. Line items are optional, and patchy in travel. I found no e-receipt standard with real adoption in North America.

Card rails move money and the merchant's identity and say nothing about why something was bought, so the product has to bridge from authorization data to a receipt and a GL code.

A card program is a chain of contracts: network to bank, bank to program manager, processor to bank, bank to company, and bank to employee only under individual liability.

A few things here surprised me. One processor can be a single point of failure: on October 20, 2025, a change on Visa's side stopped North American traffic reaching one issuer processor, and stand-in rates stayed high until a fix by October 30. Migrations happen too; one public expense company moved its card to a new sponsor bank in 2024, keeping its processor and network. And the interchange contract may not be yours. One public processor's bank contracts give it all the interchange, which it shares with customers. The basis points in the table are my arithmetic from the companies' filings.

A spend fintech owns the customer but rents the license, the rails and sometimes the interchange contract, and any of those landlords can change the terms without asking.

Business cards fall outside most consumer card law.

Reg Z's $50 cap reaches business credit cards, but at 10 or more cards the company and issuer can agree other terms, and employees keep the cap only against use by someone else. Business debit, prepaid and just-in-time cards have no legal cap, because Reg E covers only consumer accounts. And where a bank has primary oversight and control of a prepaid program, FinCEN says no participant has to register as the provider of prepaid access.

In Canada, a platform that holds end users' funds or moves reimbursements likely needs FINTRAC registration (since April 2022) and registration under the Retail Payment Activities Act, or RPAA (since September 8, 2025). The RPAA excludes banks and agents of registered payment service providers, but doesn't name agents of banks. As I read it, "we act for the issuing bank" doesn't obviously fit any exclusion for a Canadian card program manager. I'm not a lawyer, and I'd take this one to counsel.

Card exceptions run on network clocks; expense exceptions are conversations with an employee.

Two rules surprised me: you can only dispute a cleared transaction, not an authorization, and a platform can't stop a cardholder from filing a fraud dispute. Card reversals belong to the merchant or the network and run on their clocks, while expense reversals are part of the employee relationship and fall under employment law.

Strangers' fraud has a legal cap and a dispute process; your own people's misuse has neither.

The waivers. Visa's US program covers misuse by employees who've left: up to $100,000 per cardholder at five or more cards ($5,000 at one to four), for charges billed up to 75 days before the termination notice or made up to 14 days after, if the card was canceled within two business days, with one paid claim per person. Mastercard's covers $25,000 per cardholder at two to four cards and $100,000 at five or more, but not one-card companies, lost or stolen cards, or owners and shareholders above 5%. The Visa text I found dates from 2004 to 2007, though bank pages repeat its figures. In Canada, Visa requires misuse insurance of at least CAD 100,000 per cardholder.

So the law limits what a stranger's fraud can cost a company, misuse by its own staff has no cap, and the waiver covers only leavers cut off within two days.