Mastercard said Thursday it has expanded its virtual card platform with issuer-level security controls, broader embedded payments capabilities and a single connection point into its partner network.

The enhancements apply to Mastercard In Control, the company’s virtual card number platform. Mastercard said the updates are designed to help enterprises, financial institutions and platforms operate virtual card programmes with greater security and scale. Virtual card numbers are commonly used in commercial payments because they can be issued for specific transactions, suppliers or time periods, giving businesses more granular control than a static card credential.

According to the company, its VCN ecosystem now includes issuers, direct platforms and corporates transacting across 43 countries and 174 currencies.

Two capabilities are central to the update. Issuer Enforced Controls, a new feature, are applied at the point of virtual card number creation and allow issuers to set baseline guardrails, including spend limits, transaction limit caps and validity periods.

Clearing Controls, which were introduced last year, extend control validation beyond authorisation and into the clearing stage. Mastercard said the feature allows corporates and platforms to block invalid transactions and manage payment timing more precisely. The additional clearing-stage check is relevant in commercial payments because authorisation and settlement can involve different data and timing, particularly when payment workflows are embedded in procurement, accounts payable or platform software.

Citi is already live with both capabilities and is expected to be the first issuer to roll them out globally later this year.

“As payments become more digitized and embedded into business workflows, expectations for performance, security and control are higher than ever,” said Marc Pettican, global head of corporate solutions at Mastercard.

“As virtual card adoption accelerates, our clients need smarter, stronger tools to manage risk,” said Scott Southall, global head of Citi Commercial Cards and Domestic Payments.

Mastercard also said it updated its Commercial Connect API. The update enables multiple control sets at the real card level and combines virtual card creation and payment initiation into a single step. For software platforms and financial institutions, that single-step model can reduce integration complexity when adding virtual card issuance directly into business payment flows.

The company said fraud rates on virtual cards are less than one-fifth of those recorded on non-virtual cards.