Virtual Card Balances: License Tiers and Custody Checks

When the platform dies, you are a creditor, not a depositor

WildCard shut its virtual card business in July 2025. In August 2026, 51VCard's registrar put its domain on clientHold status. Both groups of users then walked into the same wall: there was still money on the cards, so who owes it to them? The answer is ugly. If your funds landed in the platform's own accounts, then when the platform disappears you join a long line of unsecured creditors, ranked behind employee wages and taxes.

Plenty of people treat a virtual card as a wallet: top up once, let subscriptions drain it slowly. With a bank, that habit is fine. Deposits sit behind deposit insurance and a prudential supervisor. A virtual card platform is not a bank. What that "balance" in your account legally is depends entirely on which license the platform holds. Platforms do not volunteer this information. The marketing page says "licensed" and stops there.

Licensed can mean anything from a safe with a supervisor to a wall decoration. This piece separates the tiers and gives you a verification routine you can run yourself.

Three license tiers, three balance outcomes

Take Hong Kong, because a large share of virtual card platforms incorporate there and because its license registers are public.

SVF license: the balance has custody requirements. The Stored Value Facility license from the HKMA exists precisely to regulate stored value. A licensed issuer that takes your money onto a card must keep those funds in an authorized financial institution or under a trust arrangement under the Payment Systems and Stored Value Facilities Ordinance. The operator cannot dip into float for its own purposes. Of the three tiers, this is the only one with real structural protection for balances. The catch is obvious: SVF capital and compliance thresholds are high, and small card-only platforms rarely clear them.

MSO license: it polices money laundering, not your balance. The Money Service Operator license from Hong Kong Customs covers currency exchange and remittance. Its center of gravity is AML and CTF, and it imposes nothing like the SVF's mandatory custody of prepaid funds. Han Kun Law Offices, in its analysis of cross-border payment firms issuing cards in Hong Kong, puts it plainly: an MSO issuing cards must operate on a pay-before-you-spend, no-credit basis, but the model of directly holding user prepayments for later spending already resembles an SVF business, and whether regulators will keep tolerating it is an open question. In plain terms, your top-up is legally closer to a prepayment. If the platform goes bankrupt, you have no priority claim.

Offshore registration or no license: the balance is one line in the platform's own ledger. A large batch of platforms operate on a Vanuatu company registration, some Lithuanian payment-institution category, or wave a US FinCEN MSB number as their credential. The MSB list is a registration regime: being listed says nothing about client funds being supervised. In this tier there is no independent custody at all. If the platform misappropriates funds, exits, or gets its BIN sponsor cut off upstream, your money exists only in the platform's internal books.

One more common confusion. Platforms like to display "partner bank" or BIN sponsor names on their sites. The upstream issuer bank is real, but that relationship sits at the card-network clearing layer and governs nothing about your top-up balance. Your USDT goes to the platform's own wallet address, not to the BIN sponsor. For what a BIN sponsor actually does, see our earlier piece on the upstream issuance chain.

A five-minute check on the platform you use

Order matters more than depth here. Four steps.

Step one: find the operating entity. Not the brand name, the full legal entity at the signature block of the Terms of Service, usually buried in the footer. A ToS that names only the brand and no company is an automatic deduction.

Step two: take the entity name to the right register. A Hong Kong entity goes into the Customs and Excise MSO register (www.customs.gov.hk), then the HKMA's SVF licensee list (www.hkma.gov.hk). A claimed US MSB goes into FinCEN's MSB registrant search (www.fincen.gov). EU entities go into national payment-institution and e-money registers, and since this year you should also check MiCA crypto-asset service authorizations, which we covered separately when the MiCA deadline passed. A register hit with a number and validity dates counts as licensed. A marketing claim does not.

Step three: read the funds clause. Search the ToS for segregated, trust, and safeguarding. See whether the platform states in writing that client funds are held separately. Writing it does not guarantee doing it, but refusing to write it at all tells you the posture.

Step four: check license-to-business fit. Both Han Kun and JunHe's license analyses point out that under the current Hong Kong framework an MSO covers fiat exchange and remittance only; touching virtual-asset conversion or custody requires separate authorization, such as the SFC's VA dealing or VA custody regimes or a TCSP trust license. A platform that accepts USDT top-ups holding nothing but an MSO is most likely running its crypto leg outside the licensed perimeter. That does not automatically make it a scam, but the risk exposure is larger than the marketing implies.

Use platforms in our directory as worked examples. PokePay's site discloses a Canada FINTRAC MSB registration and a Polish virtual asset service provider registration. Under the tiers above, those are registration-grade credentials with no custody mandate, which fits small balances topped up as needed. FotonCard runs on invitation codes and does not force KYC at signup, which drops it into the last tier by construction, and the discipline is the same: never park meaningful money on the card. We keep license and fee notes updated on every entry in the provider directory.

How much balance to keep: do the math

With the logic clear, one operational question remains: how much belongs on the card?

Keep too little and top-up fees get expensive per dollar. Most platforms charge 0.5 to 2 percent on deposits, and refilling 20 dollars every month for one subscription makes the fee share ugly fast. Keep too much and one black swan takes it all. Between 2024 and 2026, Fomepay, Infi, Taoxiong, WildCard, and 51VCard went down in sequence, a failure rate for prominent platforms of roughly one to two a year. VirtualCardx maintains a longer list of collapsed domestic platforms, worth a read. Suppose a platform's three-year failure odds are a generous 10 percent: a standing 500-dollar balance then carries 50 dollars of expected loss, which already exceeds the top-up fees you saved by batching deposits.

My ceiling for working balances is 1.5 to 2 times monthly burn. A subscription user burning 20 dollars a month needs about 40 on the card. An advertiser burning 300 a day should pick a platform with auto-replenishment or rotate two cards. The only sensible home for a large balance is a more heavily licensed institution, not a high-risk platform saving you one percent on deposits.

Two footnotes. First, for deposit-bonus promotions, do your exposure math as if the bonus does not exist. Second, a platform that allows withdrawals gives you an extra escape hatch, and the day something goes wrong that hatch is worth far more than a few tenths of a percent on the fee schedule. Incidentally, subscription billing traps and balance management are separate problems; we have a dedicated guide on canceling subscriptions properly.

The platform claims "bank-grade custody." How much is that worth?

Marketing copy always runs ahead of licenses. When you see "bank-grade security" or "funds fully custodied," go back to the register check from the previous section: only an SVF hit or an explicit trust clause gives those words anything to stand on. Without a register hit, the sentence is just copy. "Partnered with a major bank" is the same trap, since clearing partnerships and client-fund custody are different things. The first decides whether your swipe settles; the second decides whose account your deposit sits in.

A refund lands on a dead card. Where does the money go?

This trap is sneakier than the balance itself. When a merchant refunds a purchase, the money goes back along the original path, onto the card. If the platform has already stopped operating at that moment, the refund lands in the platform's own account within the upstream clearing system, not in your hands. The practical countermeasure: the moment a platform starts smelling wrong, go through every card purchase still inside a refund window. Where the merchant can redirect the refund to another payment method, ask early. For the rest, keep order records and refund commitments as evidence for what follows.

KYC passed and paperwork in order, so the balance is safe?

Two different things. KYC protects your account from being taken over by someone else; the license tier decides where you stand in line when the platform fails. A real license does raise the cost of running away, since renewals pass review and controllers leave a paper trail, and that value is genuine. What it does not change is the legal character of your balance: under the MSO tier you remain a prepayment creditor. So the conclusion holds. The license tier sets the balance ceiling you should tolerate; it does not hand you an unlimited comfort card.

If it does go wrong, move in this order

Withdrawals slowing down and support stalling with "banking risk review" or "system upgrade" scripts are your signal. Do not wait for an official announcement.

Withdraw first, as much as the rails allow, and eat the fee. Then handle in-flight spending: if the card still authorizes, convert the balance into things you would buy anyway, renewing your own services or grabbing store credit. Locking the card and gathering evidence comes third: screenshot the balance and transaction history, save the ToS page, keep the on-chain transfer hashes from your top-ups. Those are your materials for complaints and police reports.

File complaints by place of registration. Hong Kong MSO issues go to Customs, SVF issues to the HKMA, and suspected fraud straight to the police. Manage expectations, though: cross-border recovery is measured in years, and unlicensed platforms mostly end nowhere. That is exactly why the work belongs up front.

One reusable rule to close on. Rank platforms into four tiers: direct bank or SVF issuance, MSO plus an explicit trust statement, bare MSO, and unlicensed or registration-only. Your standing balance should scale with the tier, and the bottom tier gets pay-as-you-go treatment only. Rerun the check when you switch platforms or when terms change. Five minutes, and it beats posting in a forum after the collapse.