Spend management and corporate card platform testing

What breaks in corporate card money flows

A spend management platform earns interchange on each card transaction and a per-seat subscription for the controls, approvals, and accounting sync around the card. Each defect below hits one of those flows on every affected card.

• Spend counter updated by authorisations only. The control service enforces monthly limits and merchant category blocks on authorisation requests, but hotel incremental authorisations and force-posted clearing records do not update the spend counter. Later authorisations approve against a stale balance, and the business's charge card balance grows past the credit line the issuing bank approved. Interchange on that spend does not cover a default. Card issuing and processing testing delivers the spend control and authorisation rule test matrix.
• Company liability terms applied to a three-person business (US). Every business signs one company liability agreement, and the fraud workflow bills charges made after a lost card report to the business. Regulation Z 1026.12(a) and (b) apply to all credit cards, business cards included (official comment 3-1), and a charge card is a credit card (1026.2(a)(15)). Unauthorized use liability is capped at the lesser of $50 or the charges before notice (1026.12(b)(1)(ii)). Higher agreed liability is allowed only when one issuer issues 10 or more cards for an organisation's employees (1026.12(b)(5)), and comment 12(b)(5)-1 bars it when the business clearly cannot provide 10 cards. Each amount billed above the cap is refunded and appears in the fraud case log as a 1026.12(b) violation. See Regulation Z.
• Commercial card category lost in a processor migration (EU). New virtual cards are issued from a BIN range registered as consumer credit. Regulation (EU) 2015/751 caps interchange at 0.2% for debit and 0.3% for credit card transactions (Articles 3(1) and 4) and excludes commercial card transactions from those caps (Article 1(3)(a)), checked on 2026-09-16. Interchange on those cards is then limited to the caps wherever both payment service providers are in the Union. Article 10(5) requires issuers to make the card category electronically identifiable, so the wrong category is also a regulatory defect.
• Corporate exemption flag on every virtual card payment (EU). The platform marks all virtual card e-commerce payments with the secure corporate payment exemption, including cards an employee types into a public checkout. Article 17 of Delegated Regulation (EU) 2018/389 lets a provider skip SCA only for payments that legal persons initiate through dedicated processes or protocols available only to non-consumer payers, where the competent authority is satisfied that security is at least equivalent. EBA Q&A 2018_4060 (final, 7 June 2019, checked on 2026-09-16) requires that satisfaction before the provider uses the exemption. Under PSD2 Article 74(2), a payer whose provider did not require SCA bears no losses unless it acted fraudulently, so the issuer carries the fraud, unless the framework contract excluded Article 74 as Article 61(1) allows for non-consumer users. See PSD2 SCA.
• Accounting sync that keeps the authorisation amount. The sync writes each transaction to the ERP at authorisation and never replaces it with the cleared amount, so tips, fuel pre-authorisations, and foreign currency spend post at the wrong value, and refunds post as new expenses. The card liability account in the general ledger stops matching the card statement, and the business pays per seat for a sync its finance team reverses by hand. ERP and accounting integration testing delivers the sync scenario suite and the duplicate and missing record report.