How to launch a business account with expense cards for SMEs

The account, the cards and the controls around them: what a business account with expense cards needs, from licensed partners and KYB to SCA and the interchange rules for commercial cards.

· Head of IT
· 8 min read
A receipt beside a dark business card, with ledger and check blocks and a gold euro coin

A business account with expense cards gives a company an IBAN (international bank account number) in its own name, a card for each employee with its own limits, and every card payment booked with its receipt. A licensed institution holds the money, a card issuer issues the cards, and your spend management software runs the controls, receipts and accounting sync.

This guide is general information, not legal advice: the details depend on your services and your market, so confirm them with a lawyer and the regulator before you apply.

How it works, step by step

For the company:

  1. Sign-up. Directors and owners verify their identity from their phones while the company is checked against registers and sanctions lists.

  2. The account. Payments arrive at the company's IBAN, and suppliers are paid by transfer.

  3. Cards. An admin issues virtual and physical cards, each with a monthly limit and controls by merchant category and country.

  4. Spending. The employee pays and photographs the receipt. Once a manager approves, the expense reaches the accounting software with its category, VAT and receipt.

For you, the operator, each card payment arrives as an authorisation from the issuer processor, which links your cards to Visa or Mastercard. Your platform answers in real time, checking the balance, the card's limits, the company's policy and your fraud rules. A ledger records every movement, reconciled daily against partner and processor statements.

What you need beyond the software

The account

A balance a company keeps to spend later is usually electronic money, which only e-money issuers, in practice e-money institutions (EMIs) and banks, may issue, and which may not earn interest (E-Money Directive, Articles 2, 10 and 12). Most providers start under a licensed partner: the guides to EU e-money licences and UK ones compare the routes, and launching a neobank without a banking licence covers safeguarding.

In the UAE, a stored balance needs the Central Bank's stored value facility licence, or a bank with the Central Bank's no-objection letter (SVF Regulation, Articles 3 and 4); a payment account under the Retail Payment Services and Card Schemes Regulation may hold funds only in transit. The SVF guide also covers the financial free zones.

In the EU, PSD2 lets a provider agree with a business customer that its information rules, and some conduct rules such as the limits on a payer's liability for unauthorised payments, do not apply (PSD2, Articles 38 and 61). Member states may protect microenterprises, with fewer than 10 staff and an annual turnover or balance sheet total of no more than €2 million (Recommendation 2003/361/EC), like consumers. The UK does, and charities with annual income under £1 million too (PSRs 2017, regulations 40(7) and 63(5); FCA Approach Document, 8.6).

The cards

Cards need a licensed issuer that is a Visa or Mastercard member: you, or a BIN sponsor issuing your cards under its licence (see the BIN sponsorship guide).

Visa lets issuers offer commercial cards only as a means of payment for business-related goods and services. In Europe, the cardholder terms must say so, and the issuer applies for Visa's written certification at least 30 calendar days before issuing (Visa Rules, 4.14.1.1). A Visa Business card there needs management information reporting and monthly statements per cardholder (4.14.1.2).

KYB: know your business

In the EU, you identify and verify the company, identify its beneficial owners and take reasonable measures to verify them, understand who owns and controls it and the purpose of the relationship, and monitor it (AML Directive, Article 13). A shareholding of 25% plus one share, or an ownership interest above 25%, indicates ownership (Article 3(6)). From 10 July 2027, the AML Regulation uses 25% or more (Articles 52 and 90).

The UK uses more than 25%, wants directors and senior managers named, and does not accept the Companies House register as your only source on owners (MLRs 2017, regulations 5 and 28). The UAE uses 25% or more (Cabinet Resolution No. (134) of 2025, Articles 9 and 10). In all three, anyone acting for the company must be identified and shown to be authorised.

SCA for business payments

Strong customer authentication (SCA) combines at least two independent factors, such as a phone and a fingerprint (PSD2, Article 4(30)). It applies when a payer accesses its account online, initiates an electronic payment or acts remotely in a way that may carry a risk of fraud (Article 97).

The corporate exemption, Article 17 of Delegated Regulation (EU) 2018/389, lets a provider skip SCA for legal persons initiating electronic payments through "dedicated payment processes or protocols" made available only to payers who are not consumers, where the competent authorities are satisfied they guarantee at least the security PSD2 provides. It is narrow:

  • Only the payer's provider decides, and it may apply the exemption to card payments once the authority is satisfied (EBA Q&A 2018_4060).

  • The UK version sets the same test, with the FCA as the authority. The FCA puts direct machine-to-machine links between a company and its bank, and corporate cards used in an access-controlled travel or purchasing system, in scope, but not employee cards used on public websites. The payer must be incorporated, and the FCA must be told at least 3 months ahead (Approach Document, 20.63 to 20.70).

So build SCA into online card payments and transfers in the app, and treat Article 17 as a later option. In the UAE, the SVF Regulation (Article 12) and the retail payments regulation (Article 13) call for two-factor authentication before high-risk transactions, including those above set limits.

The EU rules are due to change. In the agreed text of the Payment Services Regulation, raising a spending limit remotely would need SCA and, unless the user opts out, take effect after four hours (Articles 51 and 85). On 7 October 2026 it awaited the Council's first-reading position, with a plenary indicated for 14 December 2026 (Legislative Observatory).

How the IFR treats commercial cards

Interchange is the fee paid between the card issuer and the merchant's acquirer on each payment. The Interchange Fee Regulation (IFR), Regulation (EU) 2015/751, caps it at 0.2% of the transaction value for debit and prepaid cards and 0.3% for credit cards (Articles 2, 3 and 4), in a chapter that does not apply to commercial cards (Article 1(3)(a)). A commercial card is issued to an undertaking, a public sector entity or a self-employed person, limited to business expenses, and charged directly to their account (Article 2(6)).

Two other rules apply:

  • Acceptance. Schemes and payment providers may not oblige a merchant that accepts one issuer's cards to accept the scheme's other cards, except consumer cards of the same brand and category under the caps (Article 10(1) and (2)). Visa lets a merchant in the EEA or the UK that opts for limited acceptance refuse commercial cards issued there (Visa Rules, 1.5.4.6).

  • Identification. Cards must be electronically identifiable, and newly issued ones visibly, as prepaid, debit, credit or commercial (Article 10(5)), so product, BIN range and card design must match.

The UK's retained IFR has the same rules (Articles 1 and 10).

Decisions that shape the build

  • Balance or credit. Cards that spend the balance need no lending; a charge card does. An EMI or payment institution may grant credit only alongside a payment, repaid within 12 months and never from customer funds (PSD2, Article 18(4); E-Money Directive, Article 6).

  • Policies and approvals. Simple limits can sit at the processor. Company policies, such as a cap on meals, need your platform to answer each authorisation in real time, with a fallback when it cannot. Decide who approves what, and how approvers authenticate.

  • Receipts. Deducting VAT takes an invoice in the EU (VAT Directive, Article 178) and valid evidence of the supply in the UK (VAT Notice 700), so each receipt must land on the right payment.

  • Accounting. Categories mapped to accounts, VAT codes and cost centres, synced on approval or in real time.

What drives the cost

  • The licence route: a partner's licence, or your own, with capital, people and an authorisation process.

  • Scope: each market, currency and card type adds partner set-up, approvals and KYB data sources.

  • Physical cards: design approval, production and delivery.

  • The product layer: receipt capture, policies, approvals and each accounting connector.

  • Operations: KYB reviews, alerts, disputes and support, growing with every company and card.

Common mistakes

  • Counting on the corporate exemption for team cards.

  • Opting micro-enterprises out of PSD2's protections where the law keeps them in.

  • Assuming every merchant takes commercial cards.

  • Promoting accounts or cards in the UAE before the licence is in place. The retail payments regulation covers promotion too (Article 2).

What this means for your platform

Paynoramic's white-label business account runs the account, the cards, supplier payments and the books on modules already in production: accounts and IBANs on banking-as-a-service partners such as Swan, Treezor, Modulr or ClearBank; card issuing on processors such as Marqeta, Thredd, Nium or Enfuce; KYB, screening and transaction monitoring; SCA for payments; and a ledger that connects to Xero, QuickBooks, NetSuite and SAP. We help you get the partner contracts, or connect your own bank and processor. That ready platform takes about 30 days. Receipt capture, company-wide spending policies and approval flows are built on the same core in 2 to 3 months, and other modules can be added the same way. You receive the full source code.

Sources

Checked on 7 October 2026.

Written by

Paynoramic's Head of IT

Head of IT

Head of IT at Paynoramic, responsible for the module library every platform is built from. Has worked on payment, banking and workforce platforms for companies including American Express, Teya and Indeed Flex, and for a global card issuer-processor. Writes about what a fintech or crypto launch needs beyond the software: licensing, certification and the real cost.

Keep reading

All insights

Building something like this?

Tell us the idea and we will show you the platform it maps to.

Start your project