Mastercard Virtual Cards Lock Down B2B Spend Controls

Mastercard is treating Mastercard In Control less like a back-office card tool and more like programmable infrastructure for B2B spend, adding new controls, single API access and embedded payments features to its virtual card number platform.

The company announced the enhancements in a Thursday (July 23) press release emailed to PYMNTS, saying the update is aimed at enterprises and financial institutions that manage virtual card programs and need more security, visibility and scale.

Mastercard In Control gets tighter controls, not just more card issuance

The headline feature is control. Mastercard added new Issuer Enforced Controls, which let issuers set baseline guardrails when creating a virtual card number. Those guardrails can include spend limits and other program rules, according to the release.

The company also enhanced Clearing Controls, which extend validation deeper into the transaction flow. Mastercard said the updated controls allow corporates and platforms to block invalid transactions, apply more precise controls and better manage payment timing.

That matters because virtual card programs can fail in the messy middle of B2B payments: approval rules, reconciliation data, timing, credentials and policy compliance. Mastercard’s update is designed to move more of that logic into the payment layer itself.

“As payments become more digitized and embedded into business workflows, expectations for performance, security and control are higher than ever,” Marc Pettican, global head of corporate solutions at Mastercard, said. “We’re expanding our virtual card capabilities to deliver more unified and scalable experiences — helping partners simplify how they implement and scale virtual card programs with greater security, control and consistency.”

Mastercard said its virtual card number network now includes issuers, direct platforms and corporates transacting across 43 countries and 174 currencies. The company also said fraud rates are less than one-fifth on virtual cards compared with non-virtual cards, and even lower when those virtual cards are issued through Mastercard In Control.

Single API access targets the integration mess in B2B payments

The second major piece is Commercial Connect API, Mastercard’s single API access point for commercial payment capabilities. The new enhancements include expanded card controls, simplified integration and faster access to end-to-end payment functions.

Mastercard has described Commercial Connect API as “the one front door to Mastercard,” designed to connect payment initiation, remittance data, reconciliation, consent and controls across platforms and acquirers. Pettican told PYMNTS in a January interview that card-based B2B payments scale most effectively when they fit into existing workflows rather than asking suppliers to change how they operate.

That is the real tension in this update. Enterprises want more control, but they don’t want another disconnected finance tool. Banks and platforms want richer virtual card products, but long integration cycles can slow rollout.

A Mastercard announcement cited 69% of companies as struggling to integrate payment and business systems. The company is using Commercial Connect API to attack that bottleneck directly.

Before vs. after the Mastercard In Control update:

• Before: Virtual card programs could require more separate integration work across payment initiation, controls, reconciliation and remittance data.
• After: Commercial Connect API is positioned as a single front door for expanded controls and payment capabilities.
• Before: Controls were more dependent on how each program handled authorization and downstream validation.
• After: Issuer Enforced Controls and enhanced Clearing Controls add more rule-setting at creation and clearing stages.
• Before: Embedded virtual cards depended on platform-by-platform onboarding.
• After: Mastercard says its embedded payment model reduces onboarding complexity for issuers, platforms and corporates.

XOOMAR analysis: Mastercard is not trying to make virtual cards attractive by card economics alone. The pitch is operational. If the same virtual card can carry controls, timing rules and reconciliation data inside the systems finance teams already use, the payment becomes easier to supervise and harder to misuse.

Embedded payments put virtual cards inside business software workflows

Mastercard also expanded embedded payments capabilities for Mastercard In Control. The company said the additions are meant to create a simpler corporate payment experience and reduce onboarding complexity for issuers, platforms and corporates.

The embedded push matters because many B2B payments begin inside software, not inside a banking portal. Expense management systems, ERP tools, accounts payable platforms and travel systems are often where purchase decisions, approvals and invoice workflows already sit.

Mastercard said that since launching its embedded virtual card number program in March 2025, dozens of partners across expense management, ERP, accounts payable, travel, hospitality, healthcare and e-commerce platforms have signed up. SAP recently enabled its partnership through the program, which Mastercard described as a foundational step in scaling embedded virtual cards.

The company also pointed to a mobile virtual card solution launched with HSBC in the UAE, enabling tokenized virtual card numbers in digital wallets. That use case shows how Mastercard is extending the same controlled-card logic into mobile and wallet-based payment flows.

This follows Mastercard and J.P. Morgan Payments announcing in March that they launched a virtual card in Europe designed to support traditional accounts payable needs in industries including insurance, healthcare, travel and commercial real estate. At the time, Karen Ions, head of commercial card client management and delivery at J.P. Morgan Payments, said “virtual cards bring clarity, security and agility to the process.”

Citi’s rollout will test whether the new controls scale globally

The first major adoption signal is Citi. Mastercard said Citi is already live with both Issuer Enforced Controls and Clearing Controls and is expected to be the first issuer to roll out these virtual card number capabilities globally later this year.

That rollout will be an early test of whether Mastercard’s control layer can move from product announcement to large-scale bank deployment. The practical questions are straightforward: Can issuers integrate quickly? Can platforms support the controls cleanly? Can corporates see better reconciliation and fraud control without adding more manual work?

For readers tracking payment infrastructure, XOOMAR’s coverage of Capital One Puts $254B Card Flow on Discover Network and Treasury Platforms Steal Lending's Spotlight at Banks offers adjacent context on how financial institutions are reworking payment and software capabilities. This Mastercard story is narrower, but the adoption test is just as concrete.

Mastercard In Control now has more security controls, a more unified API route and broader embedded payment distribution. The next signal is whether banks, fintech partners and enterprise clients turn those tools into live virtual card programs that cut reconciliation pain, tighten spend policy and reduce credential exposure at scale.

Disclaimer: This XOOMAR analysis is for informational and educational purposes only. It is not financial, investment, legal, tax, or professional advice. It does not provide buy, sell, hold, price-target, portfolio, or personalized recommendations. Verify information independently and consult qualified professionals before making decisions.

The Bottom Line

• Mastercard is positioning virtual cards as programmable infrastructure for enterprise payments, not just a card-issuance tool.
• Stronger issuer and clearing controls could reduce invalid transactions and improve B2B payment compliance.
• Single API access and embedded payment features may help companies scale virtual card programs with less operational complexity.