How quickly do spend control updates take effect?

Changes made via the PATCH /cards/{cardId}/controls endpoint are propagated to the authorization network within 200ms. The next authorization attempt on the card will be evaluated against the updated ruleset, making Fyatu spend controls effectively real-time for all practical purposes.

Can I set controls at the program level instead of per card?

Yes. Fyatu supports a two-tier control model: program-level defaults that apply to all cards in a BIN, and per-card overrides that extend or restrict those defaults. A card's effective ruleset is the intersection of program rules and card-level rules, meaning a card can never exceed program-wide limits even if its own limits are higher.

How are MCC codes structured in the API?

The controls API accepts both individual MCC codes (4-digit integers per the ISO 18245 standard) and MCC group strings (e.g., "TRAVEL", "DINING", "FUEL") that map to Fyatu-defined sets of codes. You can mix individual codes and group aliases in the same whitelist or blacklist array.

What happens when a card hits its daily cap mid-transaction?

If a transaction would cause cumulative daily spend to exceed the cap, the full authorization is declined even if the transaction amount itself is within the per-transaction limit. Partial approvals against the remaining daily balance are not applied automatically but can be implemented via a JIT webhook handler that reads the remaining headroom and returns a modified amount.

Can velocity rules distinguish between purchase and ATM transactions?

Yes. Velocity rules can be scoped to a transaction type filter — purchases, cash advances, ATM withdrawals, or online transactions — using the `transactionTypes` field on the rule object. This lets you, for example, allow 10 purchase transactions per day but cap ATM withdrawals at 2.

Are spend controls enforced before or after my JIT webhook?

Network-level spend controls (MCC locks, geo restrictions, per-transaction limits, daily caps) are evaluated first, before the JIT webhook is dispatched. If the transaction is declined at the control layer, no webhook is sent and no JIT handler latency is consumed. This ordering reduces unnecessary webhook traffic and simplifies your handler logic.

How quickly do spend control updates take effect?

Changes made via the PATCH /cards/{cardId}/controls endpoint are propagated to the authorization network within 200ms. The next authorization attempt on the card will be evaluated against the updated ruleset, making Fyatu spend controls effectively real-time for all practical purposes.

Can I set controls at the program level instead of per card?

Yes. Fyatu supports a two-tier control model: program-level defaults that apply to all cards in a BIN, and per-card overrides that extend or restrict those defaults. A card's effective ruleset is the intersection of program rules and card-level rules, meaning a card can never exceed program-wide limits even if its own limits are higher.

How are MCC codes structured in the API?

The controls API accepts both individual MCC codes (4-digit integers per the ISO 18245 standard) and MCC group strings (e.g., "TRAVEL", "DINING", "FUEL") that map to Fyatu-defined sets of codes. You can mix individual codes and group aliases in the same whitelist or blacklist array.

What happens when a card hits its daily cap mid-transaction?

If a transaction would cause cumulative daily spend to exceed the cap, the full authorization is declined even if the transaction amount itself is within the per-transaction limit. Partial approvals against the remaining daily balance are not applied automatically but can be implemented via a JIT webhook handler that reads the remaining headroom and returns a modified amount.

Can velocity rules distinguish between purchase and ATM transactions?

Yes. Velocity rules can be scoped to a transaction type filter — purchases, cash advances, ATM withdrawals, or online transactions — using the `transactionTypes` field on the rule object. This lets you, for example, allow 10 purchase transactions per day but cap ATM withdrawals at 2.

Are spend controls enforced before or after my JIT webhook?

Network-level spend controls (MCC locks, geo restrictions, per-transaction limits, daily caps) are evaluated first, before the JIT webhook is dispatched. If the transaction is declined at the control layer, no webhook is sent and no JIT handler latency is consumed. This ordering reduces unnecessary webhook traffic and simplifies your handler logic.

PLATFORM FEATURE

Dynamic Spend Controls

Set and update spend rules per card in real time. MCC category locks, per-transaction limits, daily/weekly caps, geographic restrictions — all adjustable via a single API call with instant effect.

Get Started View Card Issuing API

REST API · Webhooks · Real-time

Per-card

Granularity

Real-time

Rule updates

MCC · Geo · Velocity

Control dimensions

Technical Deep-Dive

How It Works

The technical architecture behind Dynamic Spend Controls — built into every Fyatu card program.

MCC

MCC Whitelist / Blacklist

Restrict or allow spending by Merchant Category Code at the card level. Accept a list of permitted MCC groups (e.g., only travel and dining) or block specific categories (e.g., gambling, cryptocurrency exchanges) with an array-based configuration that updates instantly via API.

LIMIT

Per-transaction Limits

Set a maximum amount for any single authorization. Transactions above the threshold are declined automatically by the Fyatu network before a JIT webhook is even dispatched, reducing latency and handler load for obvious rejections.

Velocity Rules

Cap the number of successful transactions within a rolling time window — per minute, hour, day, or custom interval. Useful for preventing card testing attacks or enforcing use-case-specific transaction frequency policies.

Geographic Restrictions

Allow or block transactions by country or region using ISO 3166-1 country codes. Combine with merchant country data in the authorization event to build precise geographic allowlists for travel programs or region-locked products.

Daily / Weekly Caps

Define cumulative spend ceilings that reset on a calendar or rolling basis. Cap individual cards for budget control or set program-wide aggregate limits to manage your BIN exposure and float requirements.

Use Cases

Who Benefits from Dynamic Spend Controls

Industries and platforms building with Dynamic Spend Controls through the Fyatu Card Issuing API.

Corporate Expense

Issue one card per employee with department-specific MCC locks and monthly spend caps. Update limits instantly when budgets change, no card reissue required.

Employee Benefits

Restrict benefit cards to eligible merchant categories — wellness, food delivery, commuter services — ensuring spend stays within program rules without manual reconciliation.

Marketing Campaigns

Distribute single-use or multi-use campaign cards locked to specific retailers or MCC codes, with auto-expiry and a fixed spend ceiling per recipient.

Travel

Enable geo-restrictions that auto-unlock for approved travel corridors, or issue travel cards with elevated limits and broader MCC access that revert after the trip window closes.

Loan Disbursements

Disburse loan funds onto purpose-built cards restricted to approved merchant categories (e.g., building supplies, medical), guaranteeing fund utilization without monitoring individual receipts.

Government Programs

Configure benefit cards with strict category rules and geographic constraints to ensure social program funds are spent in accordance with policy requirements and audit obligations.

FAQ