Card limits

Every account that issues cards has card limits: how many cards and cardholders it can have, and what all its cards together can spend. They grow with the account’s trust tier (the tier that also sets payment and payout limits) and apply from the day cards are switched on, with nothing to set up. When a limit stops you, the error says which one, what you’ve used, when it frees up, and where to ask for more. A card’s own limits and rules can only be tighter.

Read them

GET /v1/issuing/limits (scope cards:read).

curl https://api.tuppence.ai/v1/issuing/limits \
  -H "Authorization: Bearer $TUPPENCE_SECRET_KEY"

const limits = await tuppence.issuing.limits.retrieve();
const daily = limits.limits.issuing_cards_daily;
console.log(`${daily.used} of ${daily.value} cards today`);

limits = tuppence.issuing.limits.retrieve()

{
  "object": "issuing_limits",
  "livemode": true,
  "tier": "starter",
  "tier_label": "Starter",
  "restricted": false,
  "enforced": true,
  "policy_version": 6,
  "increase_url": "https://dashboard.tuppence.ai/cards?limits=ask",
  "limits": {
    "issuing_cards_daily": { "value": 10, "used": 4, "resets_at": 1791244800, "source": "tier", "expires_at": null },
    "issuing_spend_daily": { "value": 500000, "used": 128450, "resets_at": 1791244800, "source": "tier", "expires_at": null },
    "issuing_quasi_cash": { "value": 0, "used": null, "resets_at": null, "source": "tier", "expires_at": null }
  }
}

The response has all eleven limits (three shown).

Field	Means
`value`	A count, an amount in your currency’s minor units, or `0`/`1` for a switch. `null` is unlimited
`used`	What’s used now. `null` for a switch, for the largest single purchase, and for replacements (counted per cardholder)
`resets_at`	Unix seconds when the window next frees up (00:00 UTC for daily limits). `null` for a count that frees up only when you cancel something
`source`	`tier`; `override` (set by our team, may end at `expires_at`); or `restriction` (below)
`tier`	`null` until we’ve reviewed the account. Until then it has Probation’s limits
`restricted`	Whether the issuing restriction is on
`enforced`	Whether limits apply (below)
`increase_url`	Where to ask for more

The limits by tier

Limit	What it counts	Not reviewed / Probation	Starter	Established	Trusted
`issuing_cards_active`	Virtual cards active at once. A single-use card stops counting once used	5	25	100	500
`issuing_cards_daily`	Cards created since 00:00 UTC: virtual and physical, replacements included	3	10	50	200
`issuing_cards_30d`	Cards created in the last 30 days	10	50	250	1,000
`issuing_cardholders`	Cardholders that aren’t blocked	2	10	50	250
`issuing_physical_cards`	Physical cards that aren’t cancelled	1	5	25	100
`issuing_replacements_90d`	Replacements of one cardholder’s card in 90 days	1	2	3	3
`issuing_spend_daily`	Card spend across the account since 00:00 UTC	£1,000.00$1,000.00€1,000.00	£5,000.00$5,000.00€5,000.00	£25,000.00$25,000.00€25,000.00	£100,000.00$100,000.00€100,000.00
`issuing_spend_30d`	Card spend across the account in the last 30 days	£3,000.00$3,000.00€3,000.00	£25,000.00$25,000.00€25,000.00	£150,000.00$150,000.00€150,000.00	£750,000.00$750,000.00€750,000.00
`issuing_max_authorization`	The most one card purchase may be	£500.00$500.00€500.00	£2,500.00$2,500.00€2,500.00	£5,000.00$5,000.00€5,000.00	£10,000.00$10,000.00€10,000.00
`issuing_quasi_cash`	Buying from quasi-cash and high-risk merchants (`1` allowed)	blocked	blocked	allowed	allowed
`issuing_provisional_credit`	Spending a card dispute’s provisional credit before it’s decided (`1` at once)	held	held	spendable	spendable

Amounts are in your account’s currency: the same numbers in pounds or dollars.
£10,000.00$10,000.00€10,000.00 is the card processor’s cap on one card purchase.
A Custom tier has what our team set, and Starter’s limits for anything they didn’t.
Tiers grow with trading history, as payment limits do: Going live.

Quasi-cash and high-risk merchant categories: money transfer (4829), quasi-cash and crypto (6050, 6051), stored value and top-ups (6540), gambling (7995), pawn shops (5933), securities (6211), lotteries and racing (7800–7802), direct marketing and telemarketing (5960–5969).

When a limit applies

Mode	Enforced
Live	Always (`enforced: true`)
Test	Only when enforcement is switched on for the account, so a card count never stops a sandbox CI run. See Testing

They apply wherever a card or cardholder is created: this API, the dashboard, the app, MCP, the assistant, and a platform acting as a connected account. A connected account is held to its own tier. Creation is counted under a lock, so parallel requests can’t exceed a limit.

Errors

Code	When	Extra fields
`403 issuing_card_limit`	Creating or replacing a card, virtual or physical, over a card limit	`limit`, `used`, `max`, `resets_at`, `increase_url`
`403 issuing_cardholder_limit`	Creating a cardholder over the limit	same
`400 limit_above_account_maximum`	Creating a card, or changing its limits, above the account’s maximum (table below)	`limit` (the account’s), `max`

Nothing is created when refused.

{
  "error": {
    "type": "permission_error",
    "code": "issuing_card_limit",
    "message": "New businesses can create 3 cards a day while we get to know you. You've created 3 today; you can create more after 00:00 UTC, or ask us for higher limits.",
    "limit": "issuing_cards_daily",
    "used": 3,
    "max": 3,
    "resets_at": 1791244800,
    "increase_url": "https://dashboard.tuppence.ai/cards?limits=ask",
    "request_id": "req_…"
  }
}

Don’t retry a limit error. Wait until resets_at (null means it frees up only when you cancel a card or block a cardholder), free one up, or ask for more. In the SDKs, the extra fields are on the error’s raw.

The card’s own limit	May not be above
`per_authorization` (or a single-use card’s amount)	`issuing_max_authorization`
`daily`	`issuing_spend_daily`
`weekly`, `monthly`	`issuing_spend_30d`

Replacements

Case	Counts against limits?
Fraud dispute: disputing as `fraudulent` cancels and replaces the card in one step (more)	No. Always allowed once, so a business with a stolen card is never stuck
A standing virtual card, lost or stolen: `POST /v1/cards/:id/replace` with `reason` `lost` or `stolen`, when the card is compromised (we froze it after a fraud warning or a run of declines, or a fraud dispute names it)	No
The same, otherwise	Yes, as a new card. A refusal leaves the old card working

A replacement keeps the agent, cardholder, limits and rules; the old card is cancelled.

Declined purchases

A purchase is checked against the card’s own rules, then the account’s limits. A decline (a card_authorization with approved: false) gives the reason in decline_reason. The dashboard and app explain it in plain words with the numbers, for example “Declined: this would take today’s card spend over £5,000.00$5,000.00€5,000.00, your limit while your account is new.”

`decline_reason`	Why
`account_limit`	Over `issuing_spend_daily`, `issuing_spend_30d` or `issuing_max_authorization`
`merchant_category_restricted`	A quasi-cash or high-risk merchant while `issuing_quasi_cash` is blocked
`funds_under_review`	It would spend a card dispute’s provisional credit, held until the dispute is decided
`payments_balance_headroom`	US: more than could be paid out of the account’s earnings right now. `decline_limit` says what bound it: `new_account_floor`, `payouts_not_approved`, `payouts_on_hold`, `cleared`, `exposure_cap`, `daily_payout` (or `headroom_unavailable` when it couldn’t be worked out in time)
`limit_exceeded`	Over one of the card’s own limits
`approval_required`	The card’s rules ask a person first: over the approval amount, or unusual for its agent
`merchant_locked`	The card works at one merchant only, and this is another
`mcc_blocked`, `mcc_not_allowed`	The card’s rules block this kind of merchant, or allow only others
`country_not_allowed`	The card’s rules don’t allow merchants in this country
`card_inactive`	Frozen, cancelled or not yet activated
`card_consumed`	A single-use card already used
`insufficient_funds`	What the cards can spend won’t cover it (UK: the cards’ balance; US: your earnings, pending included)

Account limits apply only where enforced. The card’s own rules always apply. In the US, so does payments_balance_headroom: it’s the payout gate that all money leaving the account passes.

Funding the cards, by region

GET /v1/issuing/balance says what the cards spend from in spends_from. A purchase must always fit within spendable.

	UK (`spends_from: issuing_balance`)	US (`spends_from: payments_balance`)
Cards spend	Their own Issuing balance, separate from the money you take	The account’s earnings directly. A purchase is money leaving, like a payout, through the same gate
`spendable`	The cards’ balance	What could be paid out now: cleared money less any reserve and unsettled purchases, once past the first 168 hours, within the exposure cap and the daily payout limit (shared by card spend and payouts). Money still clearing isn’t spendable
Top up	Bank transfer to the cards’ own sort code and account number (`GET /v1/issuing/funding_instructions`); usually arrives within minutes. Examples	Nothing to top up. `funding_instructions` answers `available: false`, `reason: spends_earnings`; `POST /v1/issuing/balance_transfers` is refused (`balance_transfer_unavailable`). Examples
Also		`limited_by` (what holds it), `available_from` (when more is spendable), `message` (why)

The issuing restriction

When we need to review an account’s card activity, we restrict its issuing. While the restriction is on:

restricted is true;
every limit is the lower of its own value and the Not reviewed one (source: restriction);
no new cards can be created;
provisional credit is held.

Existing cards keep working within those limits. The restriction never freezes cards; that’s a separate, deliberate step. We tell you, and the review usually takes one business day.

The event

issuing.limits_updated is sent whenever the card limits change: an override, a new tier, or the restriction being placed or lifted.

Field
`limits`	Every limit’s value now
`changed`	Which ones changed
`reason`	`override`, `tier`, `restriction_placed`, `restriction_lifted`
`tier`, `restricted`, `currency`, `policy_version`

Agents: plan, don’t retry

An agent creating cards over MCP meets the same limits:

get_issuing_limits returns the numbers above, so the agent can see how many cards it has left today.
When a limit refuses create_agent_card, it returns the same error (limit, used, max, resets_at, increase_url). The agent should plan around it: use a card it already has, wait until resets_at, or ask a person to request more. Retrying gets the same answer.

Where the owner allows it, an agent can read its own card’s number to pay at a web checkout: See a card’s details.

Ask for more

Ask once at increase_url (dashboard: Balance → Ask for higher limits), saying what you need and why. A person on our team raises it. Raised limits show as source: override.