Singapore – Mastercard has announced new enhancements to its Mastercard In Control® virtual card platform, introducing additional security controls, expanded embedded payment capabilities, and a single API connection designed to help enterprises and financial institutions manage virtual card programs more efficiently.
The company said the updates include new issuer controls, enhanced clearing controls, and broader embedded payment capabilities aimed at improving security, visibility, and scalability for business-to-business (B2B) payments. Citi is expected to become the first issuer to deploy the new capabilities globally later this year.
According to Mastercard, its virtual card number (VCN) ecosystem now supports issuers, direct platforms, and corporate users across 43 countries and territories, including 14 markets in Asia Pacific, and enables transactions in 174 currencies.
Anouska Ladds, Executive Vice President for Commercial and New Payment Flows, Asia Pacific at Mastercard, said businesses in the region are increasingly looking for payment solutions that simplify cross-border supplier management while reducing operational risks.
“For corporates across Asia Pacific, a region that touches the majority of the world’s largest trade corridors, the pressure isn’t just to digitise payments, it’s to manage supplier relationships and working capital across increasingly complex cross-border operations,” said Anouska. “Virtual cards give finance and procurement teams a way to extend that flexibility without adding risk or friction to the supplier relationship. That’s the outcome corporates in this region are actually optimising for, and it’s why we see virtual cards becoming an integral part of how businesses pay.”
Among the updates is Commercial Connect API, which Mastercard said enables customers to access virtual card creation and payment initiation through a single API. Citing research from Kaiser Associates, the company noted that 69% of companies face challenges integrating payment and business systems.
The platform also introduces expanded card controls that allow multiple control sets to be applied at the real card level, enabling issuers to enforce policies across associated virtual cards without exposing sensitive credentials. Mastercard said the enhancements are intended to simplify integration, reduce operational complexity, and accelerate deployment of virtual card programs.
The company also highlighted the expansion of its embedded virtual card program, first launched globally in March 2025. Mastercard said partners spanning expense management, enterprise resource planning (ERP), accounts payable, travel, hospitality, healthcare, and e-commerce have joined the network.
In Asia Pacific, Mastercard recently completed what it described as the region’s first live fully embedded finance virtual card transaction together with Coupa and HSBC. The transaction enabled Pact Group to make supplier payments using virtual cards embedded within its procurement platform.
Mastercard added that its virtual card initiatives have expanded across industry-specific applications, including partnerships with Juniper Travel, HBX Group, and TravelSoft in the travel sector, as well as a collaboration with Volo Health in India to automate healthcare payment and reconciliation processes.
Marc Pettican, Global Head of Corporate Solutions at Mastercard, said the company is responding to growing demand for payment solutions integrated into business workflows.
“As payments become more digitised and embedded into business workflows, expectations for performance, security and control are higher than ever,” said Marc. “We’re expanding our virtual card capabilities to deliver more unified and scalable experiences — helping partners simplify how they implement and scale virtual card programs with greater security, control and consistency.”
Spencer Dunham, Vice President of Financial Services and Payments Practice at Kaiser Associates, said payment providers are increasingly competing on operational capabilities rather than basic functionality.
“Kaiser’s analysis shows that virtual card providers increasingly compete on operational proof: platform maturity, configurable controls, ERP connectivity, and implementation paths that reduce friction for issuers and corporates,” said Spencer Dunham, Vice President of Financial Services & Payments Practice at Kaiser Associates. “Against that backdrop, Mastercard’s In Control capabilities and Commercial Connect API give banks a differentiated foundation for scaling virtual card programs with greater control and less integration friction.”
Mastercard also announced new security capabilities for virtual card programs. Issuer Enforced Controls allow issuers to establish spending limits, transaction caps, and validity periods when virtual card numbers are created. Meanwhile, enhanced Clearing Controls extend transaction validation beyond authorisation to the clearing stage, allowing businesses to block invalid transactions, apply more granular controls, and manage payment timing more effectively.
According to Mastercard, Citi has already implemented both Issuer Enforced Controls and Clearing Controls and is expected to be the first issuer to make the capabilities available globally.
The company added that its virtual card platform is supported by network-level security features including tokenisation, fraud monitoring, and enterprise cybersecurity technologies. Mastercard said fraud rates for virtual cards are less than one-fifth those of non-virtual cards, with even lower rates for cards issued through Mastercard In Control.
Mastercard said the platform is designed to support high-volume e-commerce payment flows with real-time processing and infrastructure intended to provide continuous availability and resilience.
