Mastercard virtual card programme adds controls and API access

Mastercard virtual card programme capabilities are being expanded through new controls, API access and embedded payment features for business-to-business payments, the company said on July 24. Mastercard said its virtual card number ecosystem now covers issuers, platforms and corporates across 43 countries and territories, including 14 in Asia Pacific, and supports transactions in 174 currencies.

The enhancements apply to Mastercard In Control, its virtual card number platform, and are aimed at companies, financial institutions and software platforms that use virtual cards to manage supplier payments, travel, procurement and other commercial flows. Kaiser Associates has described Mastercard In Control as an industry-leading VCN platform, according to Mastercard.

Mastercard said the changes include broader card controls across the payment lifecycle and one connection to its embedded partner network. The company said the goal is to give enterprises and banks a more consistent way to create virtual cards, initiate payments and apply controls without adding separate integration work for each use case.

What is Mastercard In Control?

Mastercard In Control is a platform for issuing and managing virtual card numbers, which are card credentials generated for specific business payments rather than a permanent plastic card. Virtual cards can be configured with limits, dates and merchant-related controls, giving companies a way to pay suppliers while reducing exposure of sensitive card details.

Mastercard said its Commercial Connect API is designed to act as a single entry point for customers using virtual card capabilities. Kaiser Associates has described the API as the market's only single API front door, according to Mastercard.

The company said the API enhancements include expanded card controls that can apply multiple control sets at the real card level, allowing controls to cover associated virtual cards without handling sensitive credentials. Mastercard also said the system can now combine virtual card creation and payment initiation in one step.

Mastercard cited a figure that 69% of companies have difficulty integrating payment and business systems, framing the API work as a response to a long-running operational problem for corporate payments teams.

How is Mastercard embedding virtual cards into business software?

Mastercard said dozens of partners have joined its global embedded VCN programme since its launch in March 2025, including companies in expense management, enterprise resource planning, accounts payable, travel, hospitality, healthcare and e-commerce.

In Asia Pacific, Mastercard said it recently completed its first live fully embedded finance virtual card transaction in the region with Coupa and HSBC. The transaction enabled Pact Group to make supplier payments using virtual cards inside its procurement platform, according to Mastercard.

The company also cited work with Emburse, which named Mastercard its Innovation Partner of the Year, and travel-related partnerships with Juniper Travel, HBX Group and TravelSoft. In India, Mastercard said its collaboration with Volo Health is intended to automate payment, collection and reconciliation processes for payors and providers.

Anouska Ladds, Mastercard's executive vice president for commercial and new payment flows in Asia Pacific, said virtual cards can help finance and procurement teams manage supplier relationships and working capital in cross-border operations while limiting added risk or friction.

What new risk controls are being added?

Mastercard said its data show fraud rates on virtual cards are less than one-fifth of those on non-virtual cards, and lower still when the virtual cards are issued through Mastercard In Control.

The company announced Issuer Enforced Controls, a new capability that lets issuers set baseline rules when a virtual card number is created. Mastercard said those rules can include spending limits, transaction caps and validity periods.

Mastercard also said it has enhanced Clearing Controls, which were introduced last year. Those controls extend validation beyond authorization into clearing, allowing corporates and platforms to block invalid transactions, apply more precise controls and manage payment timing.

Citi is already live with both Issuer Enforced Controls and Clearing Controls, according to Mastercard. The company said Citi is expected to be the first issuer to roll out those VCN capabilities globally later this year.

This story draws on original reporting from Finextra Research.