A virtual Visa for AI agents, and a very specific one at that

Updated October 2026

Licensed

Available in US

Fast payouts

18+ Only

Sponge is a USDC-backed Visa payment card built by Sponge Inc., a Y Combinator W26 company, and issued by Rain, a Visa Principal Member. It is sold, in Sponge’s own framing, as a card “for AI agents” — meaning the application is created and run through a command-line tool, a software development kit, or a Model Context Protocol integration, rather than a consumer app. Spending power is set by USDC collateral held in a Sponge wallet, and the card number is delivered as encrypted data that the developer decrypts with a one-time secret key.

I went through the Sponge developer documentation, the platform’s public pages, the company footer, and the alternatives on the market, and what came out is a card with a very narrow audience and a great deal of unstated detail. If you are not building an AI agent or an automated checkout flow, almost nothing here will be useful to you. If you are, you will still need to read the small print very carefully.

The conditions described in this review are current as of October 28, 2026.

Verdict

Sponge is a 4.9 out of 10 for me. The score is broken down by the criteria I weigh most when looking at a payment card.

The 4.9 reflects two things pulling in opposite directions. On the upside, the rails underneath are serious: Rain is a Visa Principal Member, the brand sits in a Y Combinator batch, and the engineering-first delivery is a coherent product for a specific buyer. On the downside, the public material leaves so much unstated — country eligibility, fees, limits, dispute path, security beyond the encrypted card number — that I cannot score it higher for someone walking in without a developer behind them. There are also no public reviews or complaint trails to point at, which is not the same as a clean record; it just means the product is too new or too small for a signal to exist.

Who it suits: developers and teams building AI agents that need to spend USDC at real-world merchants, and who are comfortable with a CLI, a wallet key, and reading API documentation before they spend a cent.

Who it does not suit: anyone who wants a card they can apply for in an app, anyone outside the narrow technical path, and anyone who needs to know up front what a payment will cost them. If you want a consumer crypto card with cashback tiers, a published fee schedule, or a physical card in the post, you should look elsewhere.

Who can get the Sponge card

This is one of the weaker parts of the Sponge public material, and it is worth being blunt about that. The Sponge card pages do not publish a country list, and they do not say which citizens or residents can apply, which are blocked, or how regional rules are enforced. The platform terms only set a minimum age of 13 for using the Sponge service as a whole, with no further detail on the card.

In practice that means the card’s eligibility is determined when you try to onboard through the hosted KYC flow rather than something you can check in advance. If the issuer cannot onboard you, the application will be refused at that stage, and you will only know afterwards. For a card aimed at developers, that is an unusual design choice: developers tend to want clear, machine-readable rules they can code against.

The card itself is described on the Sponge homepage as a credit card issued by Rain, accepted wherever Visa is accepted, with USDC collateral determining the spending power. No card currency is published, and no multi-currency support is described.

How to get it

Sponge is not applied for through a website form. The intended path is through the CLI (npx spongewallet), an SDK, or an MCP integration, with createSpongeCard as the call that produces a card. That alone tells you who the audience is.

The KYC flow is hosted. From the CLI or SDK you start a hosted flow with a redirect URI; once approved, you submit the issuer application. The application collects an occupation (or SOC code), and four consent flags: the E-Sign disclosure, the account-opening privacy notice, the Sponge Card terms, an accuracy confirmation, and a non-solicitation confirmation. Card creation also needs a billing address broken into line1, city, region, postal_code, country_code, an email, and a phone number.

The accepted documents, the precise age floor for the card product, and any tiering of KYC levels are not stated. Sponge describes a single hosted KYC and a single issuer application, with no public mention of additional checks for higher limits.

What this means for you: the path is clear if you are a developer and you are happy to drive it from a terminal. If you are not, there is no obvious consumer front door. The CLI also assumes you already control a Sponge wallet holding USDC, because funding comes from there, not from a bank transfer.

What it really costs

This is where Sponge is least informative, and the place I would look first if I were evaluating the card for my own use. The card pages do not publish an issuance fee, a monthly or annual fee, a conversion fee, a foreign-exchange fee, an ATM fee, or any daily or monthly limits. “Spending power” is described as set by USDC collateral, and the getSpongeCardStatus call returns that spending power; nothing more is said about it.

The costs table sums up what is and is not on the record.

So what does a coffee actually cost you? The honest answer is: I cannot give you a fixed number. The costs you will see at the point of payment come from three places the docs do not fully describe.

A small online purchase in USDC-collateralised dollars. The card is denominated in something — the docs do not say what — and you hold USDC. Somewhere between the merchant and your collateral there is a conversion from USDC to whatever the card charges in, and a possible foreign-exchange fee if the merchant settles in a different currency. The exact rate is not on the page, so I would test with a small charge first and reconcile the deduction against the published USDC value before assuming a number.

A subscription in a non-US currency. Same problem, plus the FX layer. If the card is nominally in US dollars, anything else is a foreign transaction. If it is nominally in the merchant’s local currency, the conversion from USDC may apply on top. Sponge does not say.

A refund or a partial reversal. Crypto transfers are not reversible; card chargebacks exist, but the Sponge dispute path is not described, and the rules around Regulation E or Regulation Z coverage for a prepaid-style product are not stated. A refund landing back in USDC is not the same thing as the original merchant refund in fiat, and the timing will not match.

I would not run Sponge on autopilot for high-value payments until you have answers from the issuer, in writing, for at least the conversion rate, the FX margin, and the dispute process.

Top up

Sponge is funded in one way only: by moving USDC from your Sponge wallet to the card with the card fund command. The example chain in the documentation is base; the SDK mentions base or solana as optional chains. No other coins are accepted, and there is no fiat on-ramp documented in the card material.

This has two practical consequences. First, if you are not already holding USDC, you need to acquire it elsewhere, transfer it to your Sponge wallet, and then run card fund. That is at least two extra steps compared to a card that lets you top up with a bank transfer. Second, the on-chain leg of the transfer will cost a network fee paid in the native token of the chain you use; that fee is charged by the blockchain, not by Sponge, but it is still your cost and it is paid in ETH on base, or in SOL on solana, with the wallet needing a balance of that native token to send.

The reverse path, card withdraw or withdrawSpongeCard, returns USDC from the card back to the wallet. The amount is limited to two decimal places, and fees on that withdrawal are not stated.

For the reader: think of the Sponge card less like a bank card you top up and more like a thin layer on top of a USDC balance, with the network fee as your real, visible cost, and everything else opaque.

Paying with it every day

In the docs, the card is virtual only. There is no physical card, and no Apple Pay, Google Pay, or ATM support is described. So the everyday-use story is narrow from the start: online card payments through a Visa-accepting merchant, with a card number delivered as encrypted data the developer decrypts once with a one-time secret key.

The docs are explicit that the decrypted card number and CVC should be treated as secret: do not log them, do not persist them. That is good security guidance, but it also means the card is genuinely meant to be used through a controlled flow (an AI agent, a checkout integration) rather than handed to a person for tap-to-pay at a supermarket.

The other things a consumer would want to know are not in the public material: supported wallets for everyday use, a rewards or cashback programme, a mobile app, and the dispute path for a problematic charge. There is no consumer app; the card is operated through the CLI, the SDK, or the MCP server.

What can go wrong

There are two layers of risk to think about with a card like Sponge: the company and the technology underneath, and the things the company has not told you.

On the company side, the facts I can verify are limited but reasonable. Sponge Inc. is in the footer of the homepage. “Sponge (YC W26)” is the framing in the starting data. The card is issued by Rain, which describes itself as a Visa Principal Member. The issuing bank is not named in the Sponge material, and the licences under which Rain operates the programme are not stated. The terms of the service are governed by US law. I found no published incidents, no user complaints, no news reports about the card programme, and no Trustpilot page or comparable review trail. As I noted in the verdict, the absence of complaints is not a clean record — it is more likely a small user base — but it is also not a red flag.

On the technology side, the documented security model has a clear strength and a few blanks. The card number and CVC are returned encrypted with a one-time secret key, and the docs say to treat the decrypted values as secret. That is the right pattern for a developer-facing card. The custody model — who holds the wallet key, who can move the collateral, what happens if Sponge is breached — is not described. Two-factor authentication on the wallet, an instant card freeze, and spending limits as separate controls are also not stated. The standard prepaid-card coverage under US Regulation E or credit-card coverage under Regulation Z is not described, and a crypto-funded prepaid-style product often does not carry the same statutory protections as a regulated bank account.

A few risks are worth flagging in plain language, because they are typical for the category and they are not addressed in the Sponge material.

Counterparty and hack risk. Crypto custodians have a long history of failure, from Mt. Gox through Coincheck to the Ronin bridge. Sponge’s custody model is not on the public page, so you cannot tell from the outside whether the wallet is self-custody (your key, your funds) or custodial (their key, their risk). The behaviour during a stress event is therefore unknown.

Sanctions and compliance risk. Nationality is screened separately from residence, and a card can be refused or frozen on citizenship grounds. With no published list, the only way to know whether you personally can use Sponge is to apply.

Stablecoin depeg. USDC briefly lost its peg in March 2023 during the US banking crisis and recovered, but a prepaid-style card has no buffer if the underlying collateral drops. Spending power is the value of the USDC you hold at the time of authorisation.

Network and address mistakes. Transfers on the wrong network, or to an address for a different chain, are not recoverable. The card only accepts USDC on the chains it lists (base or solana in the SDK). Anything else is a support ticket with no guarantee.

Programme risk. Even well-funded card programmes can be wound down. Visa terminated its global agreements with FTX in November 2022 and the FTX US debit card programme was wound down by its issuer. WaveCrest, a Visa card issuer that supplied several crypto card brands, was suspended by Visa in Europe in 2018 and the affected programmes were closed. A Sponge user is exposed to the same kind of programme-level event, on top of Sponge Inc. as a going concern.

Regulatory drift. Under MiCA, e-money tokens in the EU may be issued only by a credit institution or an electronic money institution. A USDC-collateralised card in Europe is therefore exposed to the regulatory status of the issuer and of any EU-based partner that helps move the funds. In the US, FinCEN guidance treats administrators and exchangers of convertible virtual currency as money services businesses. Neither path is described in the Sponge material.

The Sponge contact channels are a contact link on the homepage, an X account at @paysponge, and a Discord server. There is no published support email, no phone number, and no published service-level agreement.

What to take instead

Sponge’s narrow, developer-first shape is unusual, so the alternatives that make sense for a normal reader are the more conventional crypto cards. I picked three with the broadest geographic reach and the most transparent fee structures in the public material.

Nexo is the closest to a familiar crypto card, with virtual and physical options, no monthly or annual fee, and tier-based cashback on Credit Mode. The catch is that the country list is not published, and physical card delivery requires $5,000 in digital assets and at least Gold tier. The 2025-era Bulgarian police raid on Nexo’s Sofia office, reported by Cointelegraph over alleged Russia-sanctions and AML concerns, is a reminder that crypto card programmes can run into sanctions issues their public pages do not describe.

Xplace is the most expensive at the top end ($999 a year for Platinum) but the cheapest at the bottom (Basic is free and the 0% FX on Platinum is unusually clean). The card currency is not stated, and only Silver is live today; Gold and Platinum are “coming soon”.

ether.fi has the most transparent country list, with named jurisdictions and explicit exclusions, and a published 0% FX on EUR purchases that Sponge does not come close to. The 7-day lock on ETHFI cashback and the 31 US states are the friction points. ATM withdrawals are blocked in North Korea, Iran and Myanmar.

If you are not building an AI agent, all three are more usable day to day than Sponge, because they publish fee schedules, support physical cards, and describe a dispute path through a normal issuer.

Who I would recommend it to

I would recommend Sponge to a very specific kind of reader: a developer or a small team that is building an AI agent, a checkout integration, or a payment automation that needs to spend USDC at Visa-accepting merchants, and that is comfortable with the CLI/SDK delivery model. The card’s encrypted-number pattern and the card fund workflow make sense in that context, and the Sponge wallet is already a self-contained unit if you are operating inside it.

I would not recommend Sponge to: anyone who is not technical, anyone who needs to know what a payment costs before they make it, anyone who needs a physical card, anyone who needs ATM access, anyone who lives in or is a citizen of a country whose relationship to US-regulated card programmes is uncertain, and anyone who plans to use the card for high-value purchases without testing the conversion and FX path with a small charge first.

The honest summary is that Sponge is a 4.9 because the rails are credible and the use case is coherent, but the public material is too thin for me to score it higher, and the gap between what a developer needs and what the public pages say is wide. Treat the card as a developer tool, not a consumer product, and you will read the documentation with the right expectations.

Frequently asked questions

What is the Sponge card?

The Sponge card is a virtual Visa payment card issued by Rain and built by Sponge Inc., a Y Combinator W26 company. Spending power is set by USDC held in a Sponge wallet, and the card is created and operated through a command-line tool, a software development kit, or a Model Context Protocol integration, with AI agents as the named use case.

How does the Sponge card work?

You hold USDC in a Sponge wallet, run card fund to move it as collateral, and createSpongeCard produces an encrypted card number and CVC that you decrypt with a one-time secret key. At the point of payment, the card charges against the collateral, and you can withdraw unused collateral back to the wallet with card withdraw.

Is Sponge a bank?

No. Sponge is a software company that runs a card programme. The card is issued by Rain, which describes itself as a Visa Principal Member. The issuing bank is not named in the public material, and the licences under which the programme operates are not stated.

Who owns Sponge?

Sponge is built by Sponge Inc., a company in the Y Combinator W26 batch, per the Sponge starting data. Ownership structure, investors, and corporate registration are not described in the public material I could check.

Is the Sponge card available in my country?

The Sponge card pages do not publish a country list. Eligibility is decided when you go through the hosted KYC flow, not before. If the issuer cannot onboard you, the application will be refused at that stage, with no public way to check eligibility up front.

Does the Sponge card require KYC?

Yes. The KYC flow is hosted and started from the CLI or SDK with a redirect URI, followed by an issuer application that asks for an occupation or SOC code, four consent flags, a billing address, an email, and a phone. The accepted documents, the age floor for the card product, and any tiering of KYC levels are not stated.

How do I top up the Sponge card?

You top up by moving USDC from your Sponge wallet to the card with card fund. The example chain in the documentation is base; the SDK lists base and solana as optional chains. No other coins are accepted, and no fiat on-ramp is described.

Can I add the Sponge card to Apple Pay or Google Pay?

The public material does not describe Apple Pay, Google Pay, or any other mobile wallet support. The card is delivered as encrypted card data for programmatic use, not as a tokenised device payment.

Is the Sponge card safe?

The documented security pattern is reasonable for a developer-facing card: the card number and CVC are returned encrypted with a one-time secret key, and the docs say to treat the decrypted values as secret. Beyond that, the custody model, two-factor authentication, an instant card freeze, and dispute rights are not stated, so I would treat the safety story as “good hygiene on the card number, unknown on everything else”.

Is the Sponge card worth it?

If you are building an AI agent or an automated checkout that needs to spend USDC at Visa merchants, the card is a coherent tool and the only friction is the thin public documentation. If you are an everyday consumer looking for a physical card, an app, published fees, or cashback, the card is not worth it for you, and Nexo, Xplace, or ether.fi will be a better fit.

Content created by the «cryptocardfacts» team