SME cards and tokenisation: how small businesses adopt digital-first cards, the network programmes behind them, and where AI underwrites

What is network tokenisation and how far has it gone by 2026?

A network token replaces the 16-digit card number (the PAN) with a different number that only works in one place. EMVCo, the standards body owned by the card networks, describes EMV Payment Tokenisation as “removing the most valuable data to a fraudster, the primary account number (PAN), and replacing it with a unique alternative value, the EMV Payment Token”, and stresses that a token “is constrained in how it can be used. For example, to a specific merchant, device or payment scenario.” Version 1.0 of the EMVCo Technical Framework was published in 2014; EMVCo now runs registration programmes for token service providers and maintains a Guide to Use Cases covering proximity payments, online wallets, in-app purchases, card-on-file e-commerce, guest checkout, third-party service providers and merchant-initiated transactions (EMVCo, 2022). Each network runs its own token service provider, and the issuer approves each token before it is provisioned. Click to Pay is the networks' tokenised online checkout: Visa's 10-K describes Click to Pay as removing “time-consuming key entry” at checkout, and Mastercard calls it “a one-click checkout solution”: a stored-credential button that passes tokens rather than typed card numbers.

The scale is now network-wide. Visa's FY2025 Form 10-K states that “as of September 30, 2025, Visa has provisioned more than 16 billion tokens”, and with its fiscal first-quarter 2026 results in January 2026 Visa said tokens had climbed to more than 17.5 billion, more than triple the number of physical cards, with Visa Flex credentials at about 20 million (PYMNTS, January 2026). Mastercard's goal is 100% e-commerce tokenisation in Europe by 2030 and phasing out manual card entry; on 1 June 2026 it reported that three in five Mastercard e-commerce transactions in Europe are tokenised, that merchant tokenisation (Secure Card on File) is live in 45 European countries and territories, and that Click to Pay is available in 32 European markets, with returning customers making up over 70% of Click to Pay checkouts. Neither network publishes a token count for business cards separately; the figures above cover consumer and commercial credentials together.

For a small business the token matters in three places. A card pushed into Apple Pay or Google Pay is a device token, so the owner can pay the day the account opens. A card stored at a SaaS supplier is a merchant token that survives a card reissue, which keeps subscriptions running after a fraud replacement. And a card handed to an AI agent is an agent-bound token: Mastercard's Agent Pay launch on 29 April 2025 used the example of a small textile enterprise whose AI agent completes a cross-border supplier purchase “using a Mastercard virtual corporate card token”.

How are SMEs adopting tokenised, digital-first card products?

The literal answer: SMEs are moving from a plastic card mailed after a branch application to a card that exists the moment the account is approved, as a virtual number in the app, pushed to a phone wallet, and split into many single-purpose cards under one account. Mastercard's Dreamonomics survey of more than 6,000 SMEs in 18 countries (published 15 September 2026) found that 46% of SMEs use business cards exclusively, rising to 51% in North America; 59% of business-card users are interested in premium solutions and 40% already use them; SMEs use five digital business tools on average, 89% want to adopt more and 78% say integrated tools are critical; 71% prioritise cyber protection but only 37% use cybersecurity tools.

The fintech record shows what digital-first means in practice. Brex rebuilt onboarding as a multi-agent system in January 2026 and says “most eligible businesses onboard to Brex in minutes”, adding that the impact is “most pronounced in the small business segment, where application volume is highest”. Mercury Spend (11 August 2026) lets a founder create budgets “within minutes and without a finance team”, issue cards with limits that decline over-budget transactions at the point of sale, restrict merchants by name or merchant category code, and freeze a card until a missing receipt is supplied. Ramp, whose cards run on partner banks, reported over $1 billion in annualised revenue at its $44 billion Series F on 4 June 2026 (see the Ramp profile). Banks are following: Fifth Third made the Brex-powered commercial card its default for commercial clients in December 2025, a deal the two said unlocks $5.6 billion of annual card volume (Fifth Third profile), and KeyBank launched Key Virtual Card with Qolo in April 2026 to fend off spend-management fintechs (KeyBank profile).

SME card products compared

What is not on the record: no network or regulator publishes the share of SME debit or credit cards that are tokenised, the number of business cards in phone wallets, or the share of SME card spend made on virtual cards. The adoption evidence is survey data (Mastercard's Dreamonomics) and company disclosures, not market-wide statistics.

What are Mastercard's SME programmes for financial institutions, and what are Visa's?

Both networks sell SME growth as a package a bank or fintech switches on for its business customers, not as a card alone. Mastercard's small and medium enterprises team is led globally by Mark Barnett (named as global head in March and September 2026 releases; Jane Prokop held the title in the November 2024 and February 2025 releases), and describes its strategy as helping SMEs “propel their dreams, protect against risk, and power their payments”. Visa runs its SME work inside Visa Commercial Solutions, which its FY2025 10-K calls “a card and virtual payments-led business” addressing “approximately $35 trillion of annual opportunity by converting small and medium business spend to our solutions”, with a portfolio of small business cards, corporate cards, purchasing cards, virtual cards and digital credentials. The table lists the named programmes, what a financial institution gets, and when each started, from the networks' own newsrooms.

What does an issuer actually implement?

• The card product itself. A business debit or credit BIN range on Mastercard or Visa, either directly as a principal member or through a BIN sponsor (BIN Sponsor Plus in the UK), and, in Europe, optionally through Mastercard Product Express with a certified processor such as Enfuce to shorten the build.
• Tokenisation and wallets. Connection to the Visa or Mastercard token service so new cards can be pushed to phone wallets and stored as merchant tokens, and Click to Pay enrolment; Mastercard's 2030 Europe goal assumes issuers support all three.
• Benefits and value-added services. The network benefit bundle for the card tier (Mastercard Collection for Business on World Business and above; Visa's small-business savings programmes and offers under Visa & Main), plus cyber tools such as My Cyber Risk that Mastercard now packages with SME cards.
• Software for the business. A white-label portal (Biz360), an AI advisory layer (Virtual CFO, delivered through the FI's app), or commercial-platform integrations (VCS Hub, Commercial Integrated Partners) so invoices and supplier payments run on virtual cards.
• Commercial virtual card flows. For mid-market clients, AP virtual cards with supplier enablement (Visa AR Manager inside VCS Hub from September 2026; the Mastercard Mid-Market Accelerator card in physical and virtual form).

Neither network publishes how many issuers have signed up to Biz360, Virtual C-Suite or VCS Hub, or SME card volumes by programme. The releases describe what is offered, not take-up, so a bank comparing the two should ask its network representative for live-issuer references rather than rely on launch announcements.

Who issues SME cards: banks, BIN sponsors and issuer-processors?

Most digital-first SME cards are a stack of four companies. The brand the business sees (Ramp, Brex, Mercury) is the programme manager; a licensed bank or e-money institution issues the card on its BIN; an issuer-processor authorises transactions and holds the card ledger; the network tokenises and routes. Ramp names its issuers as Celtic Bank, Fifth Third Bank, Sutton Bank and Lead Bank in the US, Peoples Trust Company in Canada and Stripe entities in the UK and EEA; Brex cards are issued by Emigrant Bank, Fifth Third Bank and Airwallex (Netherlands) B.V.; Navan bears the credit risk on its corporate card and settles with a partner issuing bank (see the Ramp, Brex and Navan profiles).

The concentration risk is visible in the filings. SoFi's FY2025 10-K says Galileo and Technisys revenue “is highly concentrated and a significant Galileo client recently moved to a competitor”; the 16% fall in enabled accounts in Q2 2026 is that client leaving. For a bank choosing a processor, the practical questions are whether it can issue instantly into wallets, whether authorisation decisions can call the bank's own risk model in real time, and whether agent-facing controls exist; Marqeta and Stripe both now market the last explicitly.

Which fintechs lead SME cards, and what AI do they run on them?

The companies below are profiled on this site, each claim traced to the company's own filings, releases or tier-1 press on the profile page. They split into US spend-management card issuers (Brex, Ramp, Navan), a US business bank-account provider with cards (Mercury) and European banks and e-money firms that serve SMEs alongside retail (Revolut, Monzo, Starling, bunq).

Computed from the profiles: who mentions SME, corporate or virtual cards

This table is generated from the 8 fintech profiles whose use cases, platform or posture mention small business, SMB, SME, corporate cards, spend management or virtual cards; the last column lists the matching use cases by the profile's own name for them.

What do banks disclose about SME cards and AI underwriting?

Card-issuing banks describe their SME card franchises in filings but say little about the models that underwrite them. American Express's FY2025 10-K says it is “a leader in providing general purpose credit and charge cards to consumers, small businesses, mid-sized companies and large corporations”, that Commercial Services billed business grew 3% in 2025 “reflecting continued modest growth from U.S. small and mid-sized enterprise (SME) Card Members”, and that “our models and analytical tools help us reduce fraud and underwrite risk, such as in determinations regarding the extension of credit”. Capital One's Q2 2026 10-Q places “domestic small business card lending” and corporate card lending in its Credit Card segment, which since 7 April 2026 includes Brex. JPMorgan Chase's Consumer and Community Banking letter for 2024 reported the #1 position in small business with 9.7% primary bank share, a refreshed Ink Business Cash card, and that Chase Business Banking clients “contributed to over 50% of business card spend growth”; it does not describe AI in business card underwriting.

The pattern: the banks with the largest SME card books (Amex, Chase, Capital One) disclose that models underwrite credit but not what data the models use for small businesses, while the AI that is described in detail arrived by acquisition (Capital One's Brex, Amex's Hypercard and Center) or partnership (Fifth Third with Brex). Where a bank does name AI in SME credit, as TD and RBC do, it is automatic adjudication of applications, not card-specific.

How do banks and fintechs use AI to underwrite, control and protect SME cards?

Cash-flow underwriting for thin-file SMEs

A two-year-old company with no business credit history is a thin file. The fintech answer has been to underwrite on cash and transactions instead of bureau scores: Brex said in 2023 it had used AI “since inception across underwriting, fraud, receipt matching, merchant categorization”, and its 2026 onboarding system uses underwriting agents that “reconstruct a company's financial profile by automatically qualifying and mapping applicants to UW segment policies”. Navan's 10-K says the credit decision for its corporate card uses “proprietary risk assessment methodologies and other techniques designed to analyze the credit risk of specific businesses based on, among other factors, their past purchase and transaction history”, and that Navan bears the entire credit risk. Monzo calls ML credit decisioning the foundation of lending to business customers. Stripe's charge-card programme lets platforms set individual credit limits and weekly, monthly or set-day repayment, and was launched with the statement that 77% of SMBs were concerned about access to financing. Mastercard's Virtual CFO and Visa & Main's $100 million facility put the same cash-flow view in front of the owner.

Business credit is still credit: in the US the Equal Credit Opportunity Act and Regulation B, including adverse-action notices, apply to business card decisions, so a model that declines or cuts a limit must produce reasons (see our AI credit underwriting page). The OCC's August 2026 denial of bunq's US charter, which called its unsecured credit card loss assumptions not credible, shows what supervisors test when a debit-first firm moves into card credit.

Real-time spend controls and receipt matching

Controls are where the digital-first card differs most from a plastic one: per-card budgets, merchant and merchant-category locks, single-use numbers and automatic freezes. AI sits on top of them in two ways. First, matching and coding: Mercury scans a connected Gmail inbox to match receipts to transactions; Brex says nearly 70% of all expenses on its platform are handled entirely by automation; Navan says more than 70% of expenses are automated with AI coding receipts; Visa AR Manager uses proprietary AI to match supplier payments with invoices. Second, policy agents: Ramp's agents review expenses and code invoices, and Amex says its fall-2026 expense agent will reach employees by SMS or Slack to collect details. For agents that spend, the control has moved into the card itself: Mercury's agent cards “can only be created by a human”, and the agent “cannot bypass or change” its limits.

Fraud on virtual and tokenised cards

Tokens remove the stolen card number as an attack, so fraud shifts to account takeover, synthetic businesses at onboarding, invoice fraud and misuse of legitimately issued virtual cards. The defences on the record are authorisation-time models and onboarding agents: Marqeta's Real-Time Decisioning added an AI risk score on 31 March 2026 that evaluates 300+ attributes per authorisation; Brex's identity and fraud agents cut manual identity reviews by 70%; Starling's business assistant flags possible invoice fraud; Revolut reported a 30% fall in card-scam losses from its in-house ML detection. See AI fraud detection for the bank-side record.

What is not on the record: no issuer has published fraud rates for SME virtual cards versus plastic, approval-rate gains from cash-flow underwriting of SMEs, or default rates on AI-underwritten business charge cards. Marqeta publishes attribute counts and latency for its risk score but not fraud outcomes, and Mastercard and Visa have not published adoption numbers for Virtual CFO or VCS Hub's AI features.

1. EMV Payment Tokenisation — EMVCo, Jul 11, 2022 (emvco.com)
2. Guidance Published on New Ways EMV Payment Tokens Can Be Used — EMVCo, Jun 23, 2022 (emvco.com)
3. Visa Inc. Annual Report on Form 10-K for fiscal 2025 — Visa Inc. via SEC EDGAR, Nov 6, 2025 (sec.gov)
4. Visa Credentials Soar as Payments Hyperscaler Eyes Agentic Commerce — PYMNTS, Jan 30, 2026 (pymnts.com)
5. Mastercard Advances Europe's Checkout Transformation on the Road to 2030 — Mastercard, Jun 1, 2026 (mastercard.com)
6. Mastercard unveils Agent Pay, pioneering agentic payments technology to power commerce in the age of AI — Mastercard, Apr 29, 2025 (newsroom.mastercard.com)
7. Mastercard's Dreamonomics report finds small business owners are redefining growth (Mastercard Collection for Business launch) — Mastercard, Sep 15, 2026 (mastercard.com)
8. Mastercard to supercharge small business operations through new innovative platform (Biz360) — Mastercard, Nov 12, 2024 (mastercard.com)
9. Mastercard launches new product innovation to address unmet needs of the middle market (Mid-Market Accelerator) — Mastercard, Feb 18, 2025 (mastercard.com)
10. Mastercard unveils Small Business Navigator to empower U.S. entrepreneurs with smarter, safer growth — Mastercard, May 29, 2025 (mastercard.com)
11. Mastercard launches best-in-class 'BIN Sponsor Plus' programme to support next generation of U.K. Fintechs — Mastercard, Jan 15, 2026 (newsroom.mastercard.com)
12. Mastercard advances its agentic AI strategy with Virtual C-Suite, bringing executive level intelligence to small businesses — Mastercard, Mar 10, 2026 (mastercard.com)
13. Enfuce Joins Mastercard Product Express to Fast-Track Business Card Programme Launches Across Europe — Mastercard, Apr 21, 2026 (newsroom.mastercard.com)
14. Mastercard modernizes credit solutions for small businesses in Puerto Rico with new tools to operate, protect and grow — Mastercard, Oct 15, 2026 (mastercard.com)
15. Visa Launches Commercial Integrated Partners to Turbo-Charge the Fintech Ecosystem — Visa, May 21, 2025 (usa.visa.com)
16. Visa Announces General Availability of VCS Hub; Ushers in a New Era of AI-Powered Commercial Payments Innovation — Visa, Sep 29, 2025 (usa.visa.com)
17. Visa Introduces Visa & Main, A New Platform to Accelerate Small Business Growth Across the U.S. — Visa, Feb 5, 2026 (usa.visa.com)
18. Visa Expands Commercial Solutions Hub with Integration of Visa Accounts Receivable Manager — Visa, May 27, 2026 (usa.visa.com)
19. SoFi Reports Second Quarter 2026 with Record Net Revenue of $1.2 Billion — SoFi Technologies via Nasdaq, Jul 29, 2026 (nasdaq.com)
20. SoFi Technologies, Inc. Annual Report on Form 10-K for fiscal 2025 — SoFi Technologies via SEC EDGAR, Feb 17, 2026 (sec.gov)
21. Lithic and Monavate Partner to Power Card Programs Across Traditional and On-Chain Finance — Lithic via Business Wire (Nasdaq), Aug 13, 2026 (nasdaq.com)
22. Stripe launches charge card program for Stripe Issuing — Stripe, Jun 1, 2023 (stripe.com)
23. Adyen Issuing: card issuing platform (product page, retrieved 16 October 2026) — Adyen, Oct 16, 2026 (adyen.com)
24. The end of the trade-off: How AI agents broke the onboarding trilemma — Brex, Jan 20, 2026 (brex.com)
25. Mercury Launches Spend with Agent Cards and Intelligent Budgets for the AI Era (Business Wire via Yahoo Finance) — Mercury via Business Wire, Aug 11, 2026 (finance.yahoo.com)
26. Navan, Inc. Annual Report on Form 10-K for the fiscal year ended January 31, 2026 — Navan via SEC EDGAR, Apr 2, 2026 (sec.gov)
27. American Express Company Annual Report on Form 10-K for 2025 — American Express via SEC EDGAR, Feb 6, 2026 (sec.gov)
28. Capital One Financial Corporation Quarterly Report on Form 10-Q for the quarter ended June 30, 2026 — Capital One via SEC EDGAR, Jul 28, 2026 (sec.gov)
29. Capital One unveils Venture Business & VentureOne Business — Capital One, Apr 14, 2026 (capitalone.com)
30. Letter to Shareholders from Marianne Lake, Annual Report 2024 — JPMorganChase, Apr 7, 2025 (jpmorganchase.com)