Sponge card review: a USDC Visa you control from the command line

Updated October 2026

Licensed

Available in US

Fast payouts

18+ Only

Sponge is a virtual Visa card whose spending is backed by USDC collateral sitting in a Sponge wallet, and whose main interface is a command-line tool and an SDK, not a mobile app. The company behind it, Sponge Inc., describes the card as “credit” issued by Rain, a Visa Principal Member, and the target user is a developer who wants an AI agent to be able to spend from a USDC balance. That positioning is what makes the card unusual, and it is also what makes it hard to evaluate against ordinary crypto cards aimed at consumers.

If you are looking for a tap-to-pay experience, a physical card in the post, cashback in a token you can sell, or even a published fee schedule, Sponge does not provide any of that on its public pages. What it provides is a way to create a virtual card programmatically, fund it with USDC, and have it accepted wherever Visa is accepted. Conditions are current as of October 28, 2026.

Verdict

I went through the card’s own pages, the developer documentation and the public information about the company, and my overall score is 4.9 out of 10. The card has a clear use case and a serious issuer behind it, but the public material is thin on the things a normal cardholder cares about: country availability, fees, ATM access, mobile wallets, customer support hours, and what happens to your money if something goes wrong. The score breaks down as follows.

The card suits a narrow audience: developers who want an AI agent to be able to spend from a USDC balance, and who are comfortable operating from a terminal. If that is you, Sponge is interesting. If you are an everyday consumer looking for a crypto card to pay for groceries and earn cashback, Sponge is not aimed at you, and the gaps in the published material make it a poor fit regardless.

Who they will give the card to

The Sponge card pages do not publish a list of supported countries, supported citizenships, or even a “we do not serve these regions” page. The only eligibility rule visible on the public material is a minimum age of 13 set by the Sponge service terms. That is a much weaker statement than what mainstream crypto cards publish, and it is one of the reasons the “who can get it” score is only 5/10.

What the developer documentation does show is the shape of the identity check. Sponge runs a hosted KYC flow that starts from the CLI or SDK and redirects you to a verification page, after which an issuer application is submitted on your behalf. The flow asks for an occupation (or a SOC code), consent flags for an E-Sign agreement, an account-opening privacy notice, the Sponge Card terms, an accuracy statement and a non-solicitation clause, and a billing address made up of street, city, region, postal code and country. The documentation does not say which identity documents are accepted, whether a passport is required, or what the minimum age actually is for the card product itself. It only states 13 for the service.

For someone used to crypto card sign-ups that clearly list “available in 30+ countries” or “EEA and UK residents”, that silence is a real gap. You cannot tell, before you start the KYC flow, whether you will be served. You can only find out by attempting it, and by then you have already shared personal information. The card also does not say what level of due diligence is run, only that there is “a single hosted KYC and issuer application”, which is thinner than the tiered structures (simplified, standard, enhanced) that regulated issuers elsewhere in the market are required to apply.

If your main concern is “will they actually give me a card, and where”, the honest answer here is: I could not find that out from the public pages, and you should expect to discover it only when you try.

How to get the Sponge card

Getting the card is the part of the experience that is well-documented, because Sponge is built around it. There is no consumer sign-up form, no QR code to scan, and no “Download on the App Store” button. The card is created programmatically.

The public flow runs through a Node CLI (npx spongewallet) and an SDK, with an MCP interface also available. The CLI walks you through a hosted KYC redirect, after which you can call createSpongeCard to issue a virtual card. The same call needs a billing address, an email address and a phone number; the developer documentation lists those fields explicitly. The card is described on the homepage as a credit card issued by Rain, a Visa Principal Member, and it is accepted wherever Visa is accepted.

What is missing is the part most cardholders expect. There is no published evidence of a physical card: the documentation only mentions a virtual card, and the company does not say whether one will follow. There is no consumer mobile app to manage the card, no store listing to rate, and no statement of what “credit” means here in practice, since the card is funded by USDC collateral rather than by a traditional credit line. Card currency is not stated either, which matters for anyone thinking about foreign-currency spending.

If you are a developer with Node installed, the path is straightforward: install the CLI, run KYC, create the card, fund it, and start spending. If you are not, this card is not really designed to be obtained by you.

What it really costs

This is the section where the public material is at its weakest, and the cost score of 5/10 reflects that. Sponge does not publish a fee schedule, an exchange-rate markup, an ATM fee, a monthly maintenance fee, or a daily and monthly spending limit. The only pricing-adjacent statement in the documentation is that “collateral determines spending power”, and the getSpongeCardStatus call returns a “spending power” figure, which is the only published ceiling on what the card can do.

To make this concrete, here are three everyday situations and what I could and could not determine about the fees that would apply.

Paying for a coffee with USDC. You fund the card from your Sponge wallet with card fund, then tap or insert at the till. The fee structure for that transaction is not published: there is no stated conversion fee from USDC to whatever currency the merchant charges in, and no stated FX markup if that currency is not the card’s own base currency. You can see the spending power drop in the card status response, but you cannot tell in advance how much of it will go to fees versus the merchant.

Paying an online subscription in euros. Because card currency is not stated, it is not clear whether the card is denominated in USDC, in US dollars, or in the local currency of the billing address. A euro payment would normally carry a foreign-exchange fee, and the markup on cards that convert stablecoins to fiat is typically the largest single cost of using them. Sponge does not publish that number, so I cannot tell you what this will cost you. The homepage says the card is “issued by Rain, a Visa Principal Member”, and Rain does operate a real issuing business, but the Sponge fee schedule is not on Rain’s public site either.

Withdrawing cash from an ATM. The documentation does not mention ATM access at all, and since the card is virtual, ATM use would have to go through a virtual card number on a phone wallet or a separate physical card. Neither is described. The fee for a cash withdrawal, if it is even possible, is not stated. The same applies to refunds, disputes and chargebacks, which are also not addressed in the documentation I reviewed.

The honest summary is that I cannot tell you what this card will cost you in dollars and cents, because the card does not tell you. If a published fee schedule matters to you, this is not the card to choose without first asking the company directly.

Top up: how to fund the card

Topping up the Sponge card is the one part of the user experience that is documented in some detail, because it is also a developer-facing operation. The card is funded by USDC moved from your Sponge wallet, using the card fund command (or the equivalent SDK call). The example in the documentation shows the Base network; the SDK additionally mentions Solana as an optional chain.

That is the full list of options. No other stablecoins, no BTC or ETH, no bank transfer, no card-to-card top-up, no Apple Pay or Google Pay funding. The collateral model is also “all-in”: the card’s spending power equals the USDC you have moved into it, and the getSpongeCardStatus endpoint tells you what that power currently is. There is no concept of an overdraft, a credit line, or a partial top-up; you either have USDC in the wallet and you have moved some to the card, or you do not.

A few things follow from this that are worth being clear about.

• The minimum top-up amount, the maximum top-up amount, and any fee on the card fund operation are not stated. The on-chain network fee (gas on Base, or its equivalent on Solana) is paid by your wallet, not by Sponge.
• Because the only funding path is USDC on Base or Solana, you need a wallet that can send USDC on one of those two networks. If your USDC is on Ethereum mainnet, Tron, Polygon, Arbitrum or any other chain, you will need to bridge it first, which is an extra step and an extra on-chain fee.
• Circle stopped supporting USDC on Tron in February 2024, so “USDC over TRC20” is not a native option here even if you wanted it. Stablecoin issuers can also freeze funds tied to sanctions lists, which is a general property of these tokens rather than something specific to Sponge.
• Withdrawing collateral back to the wallet is done with card withdraw (or withdrawSpongeCard in the SDK), which returns USDC to your Sponge wallet. The amount field is limited to two decimal places, which is a small but real constraint if you are scripting precise balances. The fee for the withdrawal is not stated.

If you are a developer comfortable with USDC, Base and a CLI, this funding model is clean. If you are not, or if you want to fund a card with a bank transfer, this card does not accommodate you.

Paying with it every day

Once the card exists and is funded, what can you actually do with it? The documentation says it is accepted wherever Visa is accepted, which on paper means tens of millions of merchants worldwide. In practice, several features that consumers take for granted are not addressed.

There is no physical card. The public material only mentions a virtual card, so any in-person payment has to go through a tokenised number in a mobile wallet. Apple Pay and Google Pay support is not stated, and there is no documentation of token provisioning through either. The Sponge wallet itself is used through the CLI, SDK or MCP, with no consumer app, so there is no “Add to Apple Wallet” button in the usual sense. A merchant that requires a physical card or a tap from a phone wallet may simply not work with Sponge as it is currently described.

There are no published rewards, cashback or token-earn mechanics. Mainstream crypto cards typically publish a tier-based cashback rate paid in the card’s own token; Sponge does not. There is also no public mention of a bonus for first spend, a referral programme, or a staking requirement for higher rates, but the absence of those statements is itself notable: the company has chosen not to publish them.

ATM access is not mentioned. Without a physical card, ATM use is normally impossible anyway, and even with a virtual number, ATM acquirers often decline. The documentation does not address whether ATM transactions are blocked, allowed with a fee, or supported through a specific partner. Cash advances are similarly unaddressed.

There is no published information on merchant category restrictions. Many crypto cards exclude gambling, cash advances, or peer-to-peer transfers by policy; Sponge does not publish its excluded MCC list. There is also no public description of how disputes are handled, what reason codes the issuer uses, or what consumer-protection rights apply to a USDC-backed card that calls itself “credit” but is funded by collateral you hold.

A few words on the technical operation in the wild. Card payments in the Visa network go through an issuer (Rain, in this case) which screens the merchant, the country and the MCC. The card number and CVC returned by createSpongeCard are encrypted with a one-time secret key, and the documentation specifically asks you to treat the decrypted values as secrets, not to log them, and not to persist them. That is a sensible security instruction for a developer audience. It is also a sign that this card is built for short-lived, programmatic use rather than for being copied into a browser autofill and used for a year.

In short, “everyday use” is the weakest part of Sponge’s offering, and the 3/10 score reflects that. The card can in principle be used at any Visa merchant, but the practical paths to do so are not documented.

What can go wrong

Crypto cards live at the intersection of three failure modes: the card product itself, the underlying crypto, and the regulatory perimeter. Sponge has thin public disclosure on all three, which is why the “what can go wrong” section needs to spell each one out.

The card product. Sponge does not name the issuing bank. It says the card is “issued by Rain, a Visa Principal Member”, and it is true that Rain operates an issuing business under a Visa principal licence. The actual bank behind the programme, the licence reference, and the regulator that supervises the issuer are not stated on the Sponge public material. That makes it harder for a cardholder to know which jurisdiction’s consumer-protection rules apply if a dispute goes wrong. The Sponge service terms are governed by US law, but the issuing bank may be elsewhere, and the interaction between those two is not explained. Sponge has not published any incident reports, and I did not find a Trustpilot page, an app store, or any other channel of user feedback. The only support entry points are a contact link on the homepage, an X account at @paysponge, and a Discord.

The underlying crypto. Sponge spends from USDC collateral. USDC is issued by Circle, which says each token is redeemable 1:1 for US dollars and is backed by cash and cash equivalents, mostly held in an SEC-registered government money-market fund, with monthly reserve attestations. That is the best-published backing in the stablecoin market, and it is the main reason USDC is the de facto choice for a card that promises “credit” against a balance. Even so, stablecoins can and have depegged: USDC briefly lost its peg in March 2023 during the US banking crisis, and there is no on-chain mechanism that prevents a future depeg. If USDC trades below one dollar at the moment a transaction is authorised, your spending power is reduced in real terms. The card does not publish a contingency for this.

The regulatory perimeter. KYC and anti-money-laundering rules apply to whoever issues the card. Sponge’s hosted KYC flow collects the basics: name, address, date of birth, email, phone, occupation, and a set of consents. What it does not say is how it screens for sanctions, how it treats politically exposed persons, or what it does if it cannot complete due diligence. In the EU and the UK, those steps are mandatory under the relevant AML regulations; in the US, the customer identification programme is the equivalent. The fact that the Sponge pages do not describe this in detail does not mean it is not happening, but it does mean you, as the user, have less information than you would with a card from a bank or an electronic money institution that publishes its regulatory status.

A few specific risks worth flagging:

• The card number and CVC are returned encrypted, and the documentation says to treat the decrypted values as secret. If your environment logs them, or if the secret key is mishandled, the card is exposed.
• Sponge does not publish a custody model for the underlying USDC. Is it held in a segregated client account, in Circle directly, or in Sponge’s own treasury? That is not described.
• The card does not publish information on 2FA, account freeze, or spending limits, so the usual “card safety” levers consumers expect are not documented.
• Programme closures do happen in this market. Visa terminated its global agreements with FTX in November 2022, and WaveCrest was suspended by Visa in Europe in 2018, which wound down every WaveCrest-issued Visa programme. There is no public reason to expect Sponge to be at risk, but the category has seen it before, and the lack of published insurance or safeguard details is the part to check before committing meaningful funds.
• If you send USDC to the wrong network, or to an address on a chain Sponge does not support, the deposit is unlikely to be recoverable. On-chain transfers are irreversible, and Sponge does not publish a manual recovery process for misrouted deposits.

None of these risks are unique to Sponge, but they are the ones I would want clear answers to before relying on the card for anything more than small, programmable payments.

What to take instead

Sponge’s narrow audience makes a direct comparison difficult, because the alternatives below are aimed at consumers, not at AI agents. They are useful for a reader who lands on this page looking for “a USDC-backed Visa” and decides they want something more conventional. The descriptions below are based on official information about each card.

A few practical differences stand out.

Nexo is the most established of the four in the European market, and the only one that names the issuer (DiPocket UAB) and the network (Mastercard). The published fees are transparent: 0.2% FX on weekdays for EEA/UK/CH cardholders, rising to 2% in the rest of the world, with weekend surcharges. Cashback is paid in NEXO tokens or Bitcoin and is tied to a loyalty tier that depends on the share of NEXO in the portfolio, so the headline rate is not automatic. The 2025-era Bulgarian police raid on Nexo’s Sofia office over alleged Russia-sanctions/AML violations is a one-source news report rather than an official statement, and it is worth being aware of without treating it as a final verdict.

Xplace is closer in spirit to Sponge in that it supports stablecoin spending without an FX spread on its top tier (“0% FX on Platinum”). It runs on the Solana network and supports a defined list of tokens (cbBTC, wETH, SOL, JitoSOL, USDC, USDT, xStocks), which is more than Sponge’s USDC-only funding but less open-ended than Nexo’s 100+ assets. The published annual fees climb sharply with tier, from free at Basic to $999 a year at Platinum, which is a real cost to weigh against the FX savings and cashback.

ether.fi is the most jurisdiction-restricted of the three. The card is only available in a named list of countries and US states, with Belgium and Ireland eligible only without physical delivery. That kind of explicit country list is exactly what Sponge lacks. Cashback is paid in the ETHFI token, which locks for seven days before it can be claimed, and the FX markup drops by tier (0.5% at Core, 0.25% at Luxe, 0% at Pinnacle and VIP), with a published 0% FX article for euro purchases.

If your reason for looking at Sponge is “I want to give an AI agent a USDC balance it can spend”, none of these alternatives are designed for that workflow, and Sponge is still the most natural fit. If your reason is “I want a USDC-backed Visa I can use in a wallet”, Xplace and ether.fi are more directly comparable, and Nexo is the most established if you are happy with Mastercard rather than Visa.

Who I would recommend the Sponge card to

I would recommend the Sponge card to a developer who wants an AI agent to be able to spend from a USDC balance, who is comfortable installing a Node CLI, completing a hosted KYC flow, and managing card numbers as short-lived secrets, and who is willing to contact Sponge directly to confirm country support, fees, and ATM and wallet access before committing meaningful funds. The card’s documentation, the choice of USDC as the only funding asset, and the explicit developer tooling all point at that audience, and the gaps in the public material matter less if you are running small, programmatic payments than if you are trying to use the card for daily life.

I would not recommend it to a consumer looking for a tap-to-pay card with cashback, to someone who needs a physical card, to anyone whose country of residence or citizenship is not confirmed by Sponge as supported, or to anyone who needs a published fee schedule before they start. For those readers, Nexo, Xplace or ether.fi will be a more transparent experience, even if they lack the CLI-first, AI-agent angle that makes Sponge interesting.

The score of 4.9 out of 10 is not a verdict that Sponge is a bad product. It is a verdict that, for the average reader who lands on this page, the public material is too thin to recommend with confidence, and the operational model is too developer-centric to fit an everyday cardholder. If Sponge publishes a country list, a fee schedule, a physical card option, and consumer-facing support channels in the future, this score should move. Until then, the card is best understood as a developer tool that happens to be a Visa, rather than as a Visa that happens to accept crypto.

Frequently asked questions

What is the Sponge card?

The Sponge card is a virtual Visa card whose spending power is backed by USDC held in a Sponge wallet. It is created programmatically through a command-line tool or SDK rather than through a mobile app, and the company behind it is Sponge Inc., a Y Combinator W26 startup.

How does the Sponge card work?

You complete a hosted KYC flow from the CLI or SDK, then call createSpongeCard to issue a virtual card. You fund it with USDC from your Sponge wallet using the card fund command, and from that point the card behaves like any other Visa at the point of sale, drawing down the USDC collateral as you spend.

Is Sponge a bank?

No, Sponge is not a bank. The company describes the card as credit issued by Rain, a Visa Principal Member, which means Rain is the regulated issuer and Sponge is the programme manager and front-end. The specific issuing bank behind the Rain programme is not named on Sponge’s public pages.

Who owns Sponge?

Sponge is operated by Sponge Inc., which lists itself in the “Sponge (YC W26)” cohort of Y Combinator. The team behind the company is not detailed on the homepage, and the developer documentation is the main source of public information about the product.

Is the Sponge card available in my country?

The card’s public pages do not publish a country list, a citizenship list, or a list of unsupported regions. The only stated eligibility rule on the public material is a minimum age of 13 in the Sponge service terms. You can only find out whether your country is supported by starting the KYC flow.

Does the Sponge card require KYC?

Yes. Sponge runs a hosted KYC flow that starts from the CLI or SDK and asks for a billing address, an email, a phone number, an occupation or SOC code, and a set of consents including an E-Sign agreement and the Sponge Card terms. The documentation does not say which identity documents are accepted or how sanctions screening is handled.

How do I add the Sponge card to Apple Wallet?

The Sponge documentation does not describe Apple Pay or Google Pay support, and there is no consumer mobile app to manage the card. Provisioning the card into a phone wallet is not addressed in the public material, and you should confirm this with Sponge before relying on it.

Where can I use the Sponge card?

The card is described as accepted wherever Visa is accepted, which in principle means tens of millions of merchants worldwide. Because the card is virtual and there is no physical version, in-person use depends on mobile wallet support, which is not documented. Online use at any Visa-accepting merchant is the main path the documentation supports.

How do I top up the Sponge card?

You top up with the card fund command, which moves USDC from your Sponge wallet to the card. The example in the documentation uses the Base network, and the SDK also lists Solana as an optional chain. No other tokens, networks or funding methods are published.

Is the Sponge card safe?

The card is issued by Rain, a Visa Principal Member, and the underlying USDC is issued by Circle, which publishes monthly reserve attestations. The documentation also asks you to treat the decrypted card number and CVC as secrets and not to log or persist them. The gaps are in custody, 2FA, account freeze, and programme-closure contingency, none of which are described in the public material.

Content created by the «cryptocardtested» team