XCARDS scored 3.6 out of 10: cheap to open, expensive to use, and you are trusting an intermediary

Updated October 2026

Licensed

Available in US

Fast payouts

18+ Only

XCARDS is not a bank. It is a virtual card front end operated by 4P SOLUTIONS LTD in Malta, which describes itself in its own Terms as an “intermediary between the customer and the banks” — and the banks are never named. The card is virtual only, it is loaded with BTC or USDT, and every payment carries a “service fee” of 4–8% on top. That combination is the whole story: convenient in the narrow sense, expensive in the sense that matters, and built on a custodian relationship the Terms explicitly decline to stand behind. My score for the card is 3.6 out of 10.

The conditions described here are current as of October 28, 2026.

If you are reading this because an ordinary bank card has been refused to you — a country restriction, a name mismatch, a thin file — then I understand the appeal. A card that only asks for a passport and a proof of address, issued in minutes, with no credit check, is genuinely useful. But the same openness that gets you in is why you should treat what you load onto it as money you are lending to an unnamed intermediary in Malta, and why I would keep only what you can afford to lose there.

Who gets the card, and who does not

There is no list of issuing countries. That is the first thing to know, and it cuts both ways: you may not be turned away for your nationality, and equally you have no published statement promising you will be admitted.

What the Terms do give is a prohibition list, and it is long. Terms Annex 1 forbids use “in, from, or to” comprehensively sanctioned jurisdictions, including Belarus, Russia, Ukraine (restricted there to Crimea and the Donetsk and Luhansk regions), Iran, Syria, Cuba, North Korea and others. The wording turns on where you are, not what passport you hold — citizenship is not mentioned anywhere in this rule, and the Terms treat the location of the individual or entity as the deciding fact. That is a meaningful distinction for someone with a residency document from a restricted country and a nationality from somewhere else: the rule as written catches the address, not the passport.

The FAQ adds a wrinkle that surprises people: transfers to legal entities registered in Ukraine and the Russian Federation are prohibited, while a merchant located elsewhere is not blocked. So a Ukrainian-registered company cannot receive a payment, but a foreign shop can. Read that as entity-level screening rather than a blanket country switch.

You must be 18 or over, per the Terms.

Signing up and verifying

Verification is full KYC for all clients — not an optional upgrade. The AML/KYC policy asks for proof of identity (passport, driver’s licence or national ID card) and proof of address (tenancy agreement, utility or phone bills, bank statements and similar), and your phone number is confirmed by SMS code. A video call is possible if the file needs more. There is also an “Unverified Account” path with limitations, but the Terms do not quantify those limitations, which is exactly the kind of blank space worth asking about before you plan a budget around it.

There are two levels and only two: Unverified, with limits that are not specified anywhere public, and Verified, which is the level at which the documents above apply and at which you can issue an unlimited number of cards. Processing time is not stated; higher-risk customers may be drawn into longer checks. Grounds for refusing or closing an account include an AML suspicion and missing documents — the second one being the one that catches people out, because an incomplete address proof can end the relationship rather than pause it.

The sequence itself is short: register with an email address, verify, top up with BTC or USDT, issue the card. Cards are issued immediately, and no physical delivery is described anywhere — there is no plastic card in the picture at all.

Fees, limits and what a payment actually costs

The headline numbers are bad, and I would rather show them plainly than explain them away. Maintenance is 2–4 USD per month. The “service fee” is a flat 4–8% depending on the amount. Cash out of the card costs 10% of the amount with a minimum of 100 USD. Those three lines, on their own, tell you this is a card for small, occasional, must-not-fail payments — not for a weekly shop or a subscription you cannot cancel.

Three everyday payments, priced against the published percentages:

• A $30 supermarket shop. The service fee at 4% is $1.20; at 8% it is $2.40. On top of that, if the merchant prices in a currency other than the card’s, you are exposed to whatever exchange rate is on screen plus an FX fee the card does not disclose. A grocery run that should cost you thirty dollars can quietly cost you thirty-three or thirty-four.
• A $12 coffee subscription. The same 4–8% on $12 is $0.48 to $0.96. The percentages look tolerable here, but they apply again every month, forever, and you cannot cancel it without losing access to whatever the card was holding.
• A $200 payment you need to make once. At 4% that is $8; at 8% that is $16. Add the monthly maintenance of 2–4 USD if the card sits idle for part of the month, and the real cost of moving $200 is between roughly $10 and $20 — which is the figure to hold in your head when you compare it against any of the alternatives later in this review.

Two more numbers worth keeping beside these. There is no minimum deposit when you open the card, which is friendlier than the 100 USD minimum you must meet on every top-up. And the verified tier issues unlimited cards — “unlimited” being the operative word, since the limitation on this product is cost per transaction, not the number of cards you can hold.

Top up: only two coins, and a network nobody names

Topping up works through the “Accounts” section with BTC or USDT, and that is the entire list. Auto-top-up can be switched on when the card is issued, or later under Cards and Auto-top-up. The minimum top-up is 100.00 USD. The top-up fee is not stated separately from the 4–8% service fee, so I read the service fee as applying to loading as well as to spending — but the card does not say so, and that is a question to put to support before you move real money.

The gap that worries me most is this: the networks are not stated. For USDT alone that is several materially different chains — Ethereum, Tron, Solana, Polygon, Avalanche and others — with different fees, different confirmation times and different failure modes. If you send on a chain the provider does not support, or to an address belonging to a different network, the transfer can be lost or need manual recovery with no guarantee attached; crypto transfers are irreversible by design. So the first top-up should be small enough that losing it would sting but not wound you, and the address should be pasted rather than typed, because clipboard-hijacking malware that silently swaps a copied address is a real and common attack. A minimum of 100 USD does not leave much room for a cautious first test, which is one of the quiet problems with this card.

On the ERC-20 standard, gas is paid in ETH, so a wallet holding USDT and no ETH cannot send it at all. On Tron, fees are paid through bandwidth and energy and often burn TRX. These are details of the category, not of this card, but they are the details that decide whether a transfer works.

The rule that has no exceptions: a card that is not topped up is blocked, and a blocked card cannot be unlocked. If your balance runs to zero mid-month, you have not got a grace period — you have got a dead card. Auto-top-up exists precisely to avoid that, which is a sensible design, and also a mechanism that quietly keeps the service fee running.

Withdrawing goes the other way: from card back to account balance in no more than one day, for a 10% commission on the amount and a minimum of 100 USD. Funds unclaimed after an account is suspended or terminated are held for one year, after which rights to them are lost.

Paying with it day to day

Everyday use is the weakest part of this card, and the reason is simple: virtual cards only. No physical card is described, and Apple Pay, Google Pay and ATM access are all unstated. If your phone has no wallet set up, or the card cannot be tokenised into it, then a “card” that only exists as a number is a number you have to paste into a checkout form — and pasting card numbers into websites is precisely the habit that produces card fraud. I would want confirmation on wallet support before treating this as a daily driver, and I would treat the absence of that confirmation as a “no”.

The set of things you cannot buy is long and stated without room for argument. Gambling and betting, dating, crypto purchases, and top-ups of payment systems or brokers are blocked with no refund. Terms Annex adds adult content, escort services and similar. Blocking in this industry is usually done by merchant category code — MCC 7995 covers casinos, betting and lotteries, and issuers block it by policy rather than by law, so the list varies by issuer. What matters for you is the refund point: a prohibited-use block is explicitly non-refundable.

There is no rewards programme, no wallet feature, and no app listing named — this is a website, not an app you download. No physical card, no wallet, no ATM, no rewards, no app: the everyday surface of the product is four fields on a website.

On disputes, the Terms commit to answering complaints within 15 working days, with a statute of limitations of one calendar year. There is no chargeback process described. That gap is worth pausing on, because a chargeback is normally the mechanism through which a customer recovers money when goods never arrive or a charge was fraudulent. Its absence does not tell you disputes will be handled badly, but it removes the usual path. US debit-card reversal rights come from Regulation E and credit-card rights from Regulation Z; prepaid-card coverage varies and should not be assumed — and this is a prepaid-style card, spending a loaded balance. If a big purchase goes wrong, you are relying on support and the Terms rather than on a scheme.

What can go wrong

Start with custody, because the Terms say it out loud and in capitals: you should not store funds on the accounts or cards, and XCARDS does not guarantee their safety. Banks may block funds. The card’s own legal text therefore tells you not to park money on it and declines any promise about it. That is an unusual thing for a card issuer to publish, and I would treat it as the single most important sentence on the site.

Two more structural facts sit underneath it. Control of crypto belongs to whoever holds the private key; with a custodial wallet, that is the provider, and a seed phrase — typically 12 to 24 words — is the unencrypted key itself, so anyone who obtains it can restore the wallet and spend it. And transfers are irreversible: a stolen key has no built-in recovery, because the network cannot freeze or return anything. Custodial platforms have a real record of this going wrong — Mt. Gox at about US$350 million reported stolen between 2011 and 2014, Coincheck at about US$400 million in 2018, and the Ronin Network at US$625 million in 2022. XCARDS is young and small, and being small is not the reassurance it sounds like: it means less history, not a better balance sheet.

Confirmations add friction worth knowing about. Transfer orders need a confirmation code sent to email or Telegram, and there is no stated in-app freeze. So your first line of defence in a compromised-account scenario is a code arriving in an inbox or a chat app, and your second is support.

On the stablecoin side: USDT and USDC are US-dollar-pegged, and stablecoins can depeg — TerraUSD collapsed in May 2022 and USDC temporarily lost its peg in March 2023 during the US banking crisis. Stablecoins are also not censorship-proof; Tether says it disables tokens in wallets on the OFAC sanctions list and has frozen funds tied to illicit activity. If the card loads USDT and the value of that token slips, your balance slips with it.

And there is a payment trap that hits foreign-issued cards specifically. The BIN at the front of the card number identifies the issuer and its country, and any merchant can look it up. If the issuer country differs from your billing address, extra scrutiny is possible. Address verification, which compares the numeric parts of a billing address against issuer records, is mainly offered in the US, Canada and the UK and is generally unavailable for foreign-issued cards, which can cause declines at checkout. Some merchants decline prepaid or foreign BINs for the same reason. So yes: a card from a Maltese-registered intermediary can look foreign to a shop in your own country.

On complaints and record, the picture is thin rather than bad. I found no official incidents, and no reviews at all — a search for the card’s reviews turned up only other card sites. There is no Trustpilot page for the domain. The Terms of Service and the AML/KYC policy were last amended on 21.04.2025, with files dated 11 Jul 2025, and no other dated events surfaced. No reviews from users means no pattern to judge, which for a deposit-taking service is the absence of evidence, not evidence.

The company behind it is 4P SOLUTIONS LTD, registered under Maltese law at Aurora House, Level 3, 184 Triq-il-Kappillan Mifsud, Birkirkara BKR 1904, Malta. Licences are not stated. The Terms also give a mail address in Mahé, Seychelles, and the AML policy refers to Seychelles sanctions — a detail that will matter to anyone who screens counterparties, and one more jurisdiction to ask about. Support is described as 24/7 personal, via Telegram website chat and [email protected]; languages are not stated.

One last practical thing, because it catches people: a declined authorisation can leave a hold on your funds that stays for several days, typically up to seven. A failed attempt at one shop can therefore freeze money you needed elsewhere.

What to take instead

I compared three cards that a reader in the same position might reasonably consider. The scores are from my own review work on each of them.

Cardex (5.6). The most established of the group by its score, and the only one that describes both virtual and physical cards. It sits on the VERVE, VISA, Mastercard and UnionPay networks, converts in real time at the moment of payment, and its site describes an “AI-Powered Conversion Rate” that scans global exchange rates and picks the best one when you spend. I would note two things: no fee percentage is published, so the cost of a payment is not something you can calculate before you make it, and the app listing is Naira-focused, with the card currency given as Naira. It claims one crypto card for 200+ countries with no exclusion list — broad, but broad in the same uninformative way.

CardFlow (4.9). Aimed at Nigeria as “Nigeria’s smartest fintech card platform” and at “Nigerians and global users”, with no country list or exclusions stated. A virtual USD Mastercard created in minutes, free to create according to its own FAQ, funded with Bitcoin, USDT, ETH or a Naira bank transfer. Its fee schedule is not stated.

HyperCard (4.7). A prepaid card with a balance in USD or EUR, funded by depositing crypto in the app and converted onto the card. The app page says it works in more than 176 countries — though that describes where the card is accepted, not who may hold it, and the official pages list no country list. Network and fees are not stated on the pages I could read.

Where all three beat XCARDS is the same place: physical or wallet support, or at least a named payment network. Where they do not beat it is transparency on fees — none of them publishes what XCARDS at least publishes as a percentage.

A note on how this category is regulated, since it bears on any of these choices. A card itself is a payment service, regulated separately under e-money and payment-services law, while MiCA covers the crypto side — custody, exchange, transfer — so a crypto card often rests on two licences. In the EU, an electronic money institution can issue e-money and payment cards but cannot lend, and may serve the whole EU/EEA from one member state’s licence. MiCA took legal effect in June 2023; its rules on asset-referenced tokens and e-money tokens applied from 30 June 2024 and the remaining provisions, including crypto-asset service provider rules, from 30 December 2024. The transitional period lets providers operating under national law continue only until 1 July 2026 or until a MiCA authorisation is granted or refused, whichever comes first. ESMA maintains an interim register of authorised providers, white papers and non-compliant entities, and it is worth a look before committing funds to any of these.

One structural point that explains a lot: Visa and Mastercard do not issue crypto cards to consumers themselves. They license issuers and can suspend a programme — in November 2022 Visa said it had “terminated our global agreements with FTX”, and the FTX US debit card programme was wound down by its issuer. WaveCrest, a Visa issuer that supplied crypto card brands, was suspended by Visa in Europe in 2018, closing all WaveCrest-issued Visa programmes. Closures follow a pattern: a notice period, then loading and spending stop, then you are asked to withdraw what is left. A card backed by an unnamed issuer is a card with an unnamed termination date.

Who I would recommend this to

I would recommend XCARDS to one specific person: someone who has a verified account, needs a virtual card issued within minutes rather than weeks, is paying small amounts in small shops that accept a virtual card number, and treats the balance as spending money rather than savings. If that is you, the mechanics are genuinely fast and the absence of a credit check and a long application is a real benefit.

I would not recommend it as a primary card, for large or recurring payments, or as anywhere to hold money. The 4–8% service fee makes it structurally unsuitable for a monthly outgoings, the 10% withdrawal fee and 100 USD minimum make it unsuitable for recovering money in a hurry, virtual-only makes it unsuitable for cash, and the Terms’ own capitalised statement that you should not store funds on the card tells you the issuer does not see it as a place for money either.

And to the person reading this because a normal card was refused to you: I have written this review so you can weigh the trade honestly rather than be sold a promise. The realistic calculation is that you are choosing between an expensive known arrangement and an unknown one. If you do proceed, do three things. Keep only a small balance. Confirm the deposit network with support in writing before your first transfer, because the site does not name it. And ask the two questions the public pages cannot answer: which bank is the intermediary acting between you and, and what licence the operation runs under. The terms say an intermediary is involved; they do not say which.

Frequently asked questions

What is the XCARDS card?

XCARDS is a virtual payment card that you load with BTC or USDT and then spend like a prepaid card. It is operated by 4P SOLUTIONS LTD, registered in Malta, and issued through an intermediary relationship the Terms describe without naming the banks. No physical card is described, and cards are issued immediately once your account is set up.

Is XCARDS a bank?

No. The Terms state that XCARDS “acts as an intermediary between the customer and the banks”, and the banks are not named, nor are any licences. Licences are not stated on the public pages. That makes it closer to an intermediary and card programme manager than to a bank, with none of the deposit protections a bank account carries.

Does XCARDS require KYC?

Yes — full KYC for all clients, per the FAQ. You supply proof of identity such as a passport, driver’s licence or national ID, proof of address such as a tenancy agreement or utility bill, and confirm your phone by SMS. A video call is possible. An Unverified Account with limitations also exists, but the Terms do not quantify those limits.

How do I top up the card, and how much?

You top up with BTC or USDT through the Accounts section, and auto-top-up can be enabled at issuance or under Cards and Auto-top-up. The minimum top-up is 100.00 USD, and no maximum is stated. Critically, the networks are not disclosed, so confirm the correct chain with support before sending any transfer.

What does XCARDS cost to use?

Maintenance is 2–4 USD per month, the service fee is a flat 4–8% depending on the amount, and there is no minimum deposit at issuance. A foreign-exchange fee is not stated, though rates are published on the site. Withdrawal costs 10% of the amount with a minimum of 100 USD, and no ATM or cash fees are described.

Can I add the card to Apple Pay or use it at an ATM?

Neither is stated anywhere on the public pages. Since only virtual cards are issued, and no wallet support is described, the practical answer appears to be that you have a card number to paste into a checkout form. Ask support directly and get the reply in writing before relying on this card for daily spending.

Which countries can use XCARDS?

There is no issuing-country list, so you cannot check eligibility in advance. Use is prohibited “in, from, or to” comprehensively sanctioned jurisdictions, including Belarus, Russia, Ukraine in Crimea and the Donetsk and Luhansk regions, Iran, Syria, Cuba and North Korea. The rule follows your location rather than your citizenship, and transfers to Ukrainian and Russian registered legal entities are prohibited.

Is it safe to keep money on the card?

The Terms answer this themselves, in capitals: do not store funds on accounts or cards, and XCARDS does not guarantee their safety, noting also that banks may block funds. Transfers are irreversible, transfers need a code sent to email or Telegram, and no in-app freeze is described. Treat any balance you load as money you could lose in full.

Is XCARDS worth it compared with Cardex or CardFlow?

On my scoring Cardex reaches 5.6, CardFlow 4.9 and HyperCard 4.7, against 3.6 for XCARDS. The gap comes down to cost transparency and everyday practicality: the 4–8% service fee and virtual-only issuance are the weaknesses, while the alternatives publish less about fees but offer more in card types.

How do I withdraw money or close my account?

A transfer from the card to your account balance takes no more than one day and costs 10% of the amount, with a minimum of 100 USD. The public pages do not describe an account-deletion procedure. Note that funds unclaimed after suspension or termination are held for one year, after which rights to them are lost.

Content created by the «cryptocardtested» team