A company card policy is a short written document that says who may hold a business card, what it may be used for, how much can be spent, and what the cardholder must hand in afterward. For a Lithuanian company, a good policy also ties every card transaction to an accounting document, so the books stay clean and the tax inspectorate has nothing to question. This guide shows what to include, how to set limits and approvals, how to handle receipts, lost cards and departures, and how to roll the policy out.

DemivoltBring More Control to Company SpendingDemivolt offers virtual and physical business cards, with role-based user management to help businesses manage card access and expenses.Explore Demivolt

TL;DR

Cover every card type in one policy: physical, virtual, and any shared or subscription cards, with a named owner for each.
Set limits per cardholder and per transaction, define who approves exceptions, and list prohibited uses plainly.
Require a supporting document for every transaction. Lithuanian rules on receipts and accounting documents decide what you must keep.
Write down the steps for lost cards, suspected fraud and employee exits, and test them before you need them.
Review the policy at least once a year and after any incident.

What a company card policy is and what it should cover
Who gets a card: eligibility and issuance
Spending rules: limits, approvals and prohibited uses
Receipts and records for Lithuanian accounting and tax
Controlling cards day to day
Cross-border and foreign-currency spending
Putting the policy into practice
Our perspective: policy and tooling must match
Cards and accounts built for controlled spending
FAQ
Sources

What a company card policy is and what it should cover

The policy is an internal rule, approved by management, that every cardholder reads and signs. It answers four questions: who, what, how much, and what proof. It sits next to your expense policy, your approval matrix and your accounting policy, and it should not contradict any of them.

A policy should cover every payment instrument the company issues:

Physical cards for people who travel or buy in person.
Virtual cards for online subscriptions, advertising platforms, software and one-off supplier payments.
Shared or team cards, which are the hardest to control and need a named responsible person.
Cards held by non-employees, such as contractors or external accountants, if you allow them at all.

The cardholders covered are not only employees. Directors, board members, freelancers and advisors may all hold cards, and the policy should say whether the same rules apply to each. In most small companies the answer should be yes, with higher limits only where the role justifies them.

If your company is still choosing a card setup, our card programmes page describes how virtual and physical Visa business cards can be issued and managed from a business account.

Who gets a card: eligibility and issuance

The most common policy failure is issuing cards to everyone who asks. Start from need instead.

Define eligibility by role. For example: sales staff who travel, marketing staff who pay for advertising, the finance team for supplier payments.
Record the business reason for each card in a simple register: cardholder, card type, purpose, limit, issue date, approver.
Require a signed acknowledgment before the card is activated. The cardholder confirms they have read the policy and accept its rules.
Prefer virtual cards for recurring online spend. One card per vendor makes it easy to see who charged what and to cancel a single subscription without affecting anything else.
Name a card administrator, usually in finance, who can freeze, replace and close cards.

Role-based access matters here too. If your banking platform lets you separate who can view, who can issue and who can approve, use it. Our business accounts support multiple accounts and role-based user management, so the person who spends is not the person who changes limits.

Spending rules: limits, approvals and prohibited uses

A policy that says “use common sense” is not a policy. Put numbers and names into it.

Limits

Set three kinds of limit:

Per-transaction limit, which stops a single large purchase.
Monthly limit per cardholder, matched to the role’s real needs.
Category or merchant restrictions, such as blocking gambling, cash withdrawals or specific merchant category codes. Our guide on merchant blocking on business cards explains how MCC rules and bank-side blocks work.

Start tighter than you think you need. Raising a limit after a documented request is easy. Recovering money after an overspend is not.

Approval workflow

Decide in advance who approves what. A simple matrix works for most SMEs:

Situation	Who approves	When
Purchase within the cardholder’s limit and category	No prior approval	Receipt submitted afterward
Purchase above the per-transaction limit	Line manager	Before payment
Temporary limit increase (travel, event)	Finance lead	Before the trip or event, with an end date
New recurring subscription	Finance lead	Before signup, using a dedicated virtual card
Any purchase from a restricted category	Managing director	Before payment, in writing

Adjust the roles to your own structure. A two-person company can compress this into one approver, but it should still be written down, because the founder is also bound by the policy.

Prohibited uses

List them explicitly. A typical set:

Personal purchases of any kind, even if the employee intends to repay them.
Cash withdrawals, unless approved for a stated purpose.
Purchases for family members or friends.
Gambling, adult content, and anything illegal.
Splitting a purchase into smaller payments to avoid a limit.
Sharing card details, including the number, CVV or one-time codes, with anyone.

Say what happens on a breach. Typical consequences range from a written warning and card suspension to repayment obligations and disciplinary action. Have your employment lawyer confirm how repayment and disciplinary clauses fit Lithuanian employment law and your employment contracts before you put them in writing.

Receipts and records for Lithuanian accounting and tax

This is where a card policy earns its keep. Every card payment becomes an expense in your books, and an expense needs a supporting document.

The State Tax Inspectorate (VMI) states that expenses must be supported by accounting documents containing the required information. Payment-confirming documents, such as cash-register receipts, must be kept but need not be attached to invoices. The same VMI document says expenses may be recognized from cash-register receipts of up to €100 including VAT, and fuel expenses from receipts of up to €150 including VAT, if the buyer can be identified. Anything above those thresholds needs a proper document, usually an invoice in the company’s name.

Turn that into policy rules:

Always ask for an invoice in the company’s name and with the company’s code, not a bare receipt, for anything beyond small purchases.
Fuel receipts must allow the buyer to be identified. Say how: a company card linked to the vehicle, a fuel card, or an invoice.
Online purchases need a downloaded invoice, not a screenshot of the card statement. A card statement proves payment, not the nature of the purchase.
Foreign-language documents are common for software and advertising. Lithuanian law on accounting says documents and registers are prepared in Lithuanian, or in Lithuanian and a foreign language, and that amounts are expressed in euros, or euros and foreign currency. Your accountant should confirm how foreign-language supplier invoices are to be handled in your own records.

Submission deadline

Set an internal deadline for handing in documents, for example within five working days of the transaction, and a hard cutoff before month-end close. Your accountant needs complete data before the period closes. Missing documents should trigger a reminder on a fixed schedule, and repeated gaps should affect the cardholder’s limit.

How long to keep records, and in what form, is governed by Lithuanian law and your own accounting policy. Confirm retention periods with your accountant and write them into the policy by reference. For a broader view of internal controls and audit readiness, the guides on internal controls and audit readiness are a useful reference point for how finance teams document and review these processes.

Reconciliation

Match each card transaction to a document every month, ideally weekly. The steps mirror a standard accounts payable process: collect the document, code the expense, approve it, and reconcile it to the bank statement. Treat unmatched transactions as open items with an owner and a date.

Controlling cards day to day

Online purchases and virtual cards

Online spend is where most fraud and most policy violations happen. Practical controls:

Use one virtual card per vendor or per purpose, with its own limit.
Freeze virtual cards that are not in use.
Keep card details out of email, chat and shared spreadsheets.
Review how card tokenization protects stored credentials, and prefer tokenized wallets and merchant profiles where available.

Fraud and suspicious transactions

The policy should tell cardholders exactly what to do when they see a payment they do not recognize: report it to the card administrator immediately, who freezes the card and contacts the issuer. Say who is reachable and when. Our guides on card fraud prevention and payment risk management cover monitoring and response in more detail. If a customer or cardholder disputes a payment, the process in our chargeback management guide applies. A payment that seems charged twice is often a pending authorization, as explained in why the same card payment shows twice.

Lost or stolen cards

Write this as a short numbered procedure on the card itself, in the onboarding sheet and in the policy:

Freeze or block the card immediately in the app or by calling the issuer.
Notify the card administrator the same day.
Review recent transactions and flag any you do not recognize.
Request a replacement card.
Record the incident in the card register.

Speed matters more than blame. If cardholders fear punishment for reporting, they will wait, and the loss grows.

When an employee leaves or changes role

Make card closure part of the exit checklist, on the same day as system access:

Collect or destroy the physical card.
Close the card and any virtual cards the person owned.
Move recurring subscriptions to another card before closing, so services do not lapse.
Require all outstanding documents before the final payment of salary is processed, subject to what your employment lawyer confirms is permitted.
Check the card’s last 30 days of transactions.

A role change should trigger a limit review in the same way.

Cross-border and foreign-currency spending

Companies selling or buying across borders see card spend in several currencies. The policy should address this directly:

State which currency your cards settle in and who bears conversion costs. Ask your issuer how conversion is applied and how it appears on statements.
Pre-authorize travel. Set a temporary limit with an end date, and consider restricting card use to the destination countries. Our guide on travel card controls aligned with EU SCA lists five controls finance teams should set.
Record the transaction in euros and the original currency, matching the supplier invoice. This follows the accounting principle above that amounts are expressed in euros, or euros and foreign currency.
Use the right rail for larger payments. Card spend suits small purchases. Supplier invoices are better paid by bank transfer. Our payments service handles SEPA and SWIFT, and the SEPA fee calculator shows the cost of an outgoing transfer. Timing matters too, so see our note on SEPA cut-off times.

Putting the policy into practice

A policy nobody reads protects nobody. Roll it out in five steps.

Draft it short. Three to five pages is enough. Use plain sentences and a one-page summary of the key rules.
Get sign-off from management and finance, then from each cardholder.
Brief cardholders in person or on a short call. Walk through a real example: a restaurant bill, an online subscription, a lost card.
Give them a one-page cheat sheet: limits, what to submit, whom to call.
Review on a schedule. Check the card register and exceptions quarterly, and revisit the policy at least once a year and after any incident or change in your business.

Useful review questions: which cards have never been used, which limits are too high, which documents arrive late, which vendors would be better served by a dedicated virtual card.

Our perspective: policy and tooling must match

We see the same pattern in growing companies. The written policy is sensible, but the card setup behind it cannot enforce it: one shared card, no per-person limits, no way to see spend in real time. The policy then depends on goodwill and memory.

Our view is that rules should be built into the account wherever possible. Limits, merchant restrictions, role-based access and separate accounts for separate purposes turn policy sentences into controls. A card that cannot be used at a blocked merchant needs no reminder email. Segregated accounts and a dedicated client manager help finance leaders keep the picture clear, and a risk-based onboarding process, such as the one described in our KYB check guide, means the company itself is verified once and cards can then be issued to the right people quickly.

We also think policies should be short. A cardholder who can summarize the rules in a minute will follow them. One who has to open a 20-page PDF will not.

— dd

Cards and accounts built for controlled spending

Demivolt is a regulated European fintech platform offering business accounts with dedicated IBANs, SEPA and SWIFT payments, and virtual and physical Visa business cards, with role-based user management and segregated client funds. The published fees below make budgeting simple:

Item	Fee
Account opening	0
Account verification	0
Dedicated Client Manager	0
Monthly maintenance	0
Internal transfers between Demivolt accounts	0
SEPA In	€0
SEPA Out	€0.40
SWIFT In	€25.00
SWIFT Out	€30.00

If you are setting up a card policy and need the account structure to support it, explore our card programmes or get started on the Demivolt site. Advisors who set up policies for clients can also look at the reseller program.

FAQ

Does a small company really need a card policy?

Yes. Even a company with two cards benefits from a one-page document that sets limits, requires documents and names who approves exceptions. It protects the founder as much as the staff, because it shows that spending was controlled and records were kept.

What should happen if an employee uses the company card for a personal purchase?

The policy should say it in advance: report it at once, repay the amount within a stated period, and expect the consequences the policy lists. Because repayment and disciplinary measures touch employment law, have a Lithuanian employment lawyer review the wording before you rely on it.

Are card statements enough as proof of an expense?

No. A statement proves that money left the account, not what was bought. VMI guidance says expenses must be supported by accounting documents, so require an invoice or a valid receipt for every transaction and ask your accountant which documents your business needs.

Should we use virtual or physical cards?

Use both, for different jobs. Virtual cards suit online subscriptions and single suppliers because they can be limited and cancelled individually. Physical cards suit travel and in-person purchases by named employees.

How often should we review the card policy?

At least once a year, and after any fraud incident, a change in team structure, or a new type of spending such as expanding into new countries. Review the card register and unmatched transactions every quarter.

Company Card Policy: A Practical Guide for Lithuanian Businesses