Sponge card review: the verdict, the fees, and who this card is actually built for

Updated October 2026

Licensed

Available in US

Fast payouts

18+ Only

The Sponge card sits in an unusual corner of the crypto-card market. The product is a Visa, issued by Rain, that spends a USDC balance held inside the Sponge wallet — but you do not download an app, you do not get a piece of plastic in the post, and you do not top it up with Bitcoin or Ethereum. You get a card by typing a command into a terminal, after a hosted identity check that the same terminal kicks off. The whole thing is built so that an AI agent, not a person, can hold it and use it.

That single design decision shapes everything else about this review. If you are a developer wiring a program up to a wallet so it can book a server or buy API credits, the Sponge card is one of the few products that even attempts to solve that problem. If you are a person who simply cannot get a normal bank card, almost everything you would expect from a card — a mobile app, Apple Pay, a physical card, support for more than one coin, a published fee table — is either missing or unconfirmed on the public pages.

The score at the bottom of this review is 4.9 out of 10, and the low mark is mostly a question of fit. The card does what it sets out to do for a narrow audience, but it is not a general-purpose payment card and it is not priced or documented in a way that lets a normal user compare it to anything else. I will walk through the eligibility rules, the signup flow, the costs as they are actually published, the top-up mechanics, what daily use looks like, and what can go wrong, and then I will look at three alternatives that target the same problem from a more consumer-friendly angle.

The conditions described here are current as of October 28, 2026.

Verdict

The total score is 4.9 out of 10, broken down below by the criteria I weigh when looking at any crypto card. The numbers are not a ranking against rivals on this page — they are a straight read of how the Sponge card performs on each of these dimensions given what is publicly available.

The audience this card is built for is narrow but real. Developers giving AI agents a USDC-backed Visa card is the use case the product is shaped around, and on that single axis it has very little competition. For that reader, the score is arguably too low. For anyone else — a freelancer in a country where bank cards are hard to get, a tourist, a person who just wants a stablecoin card with a phone app — the score is, if anything, generous. The reasons are spelled out in the rest of the review, but the short version is that the things a normal cardholder cares about most — fees, countries, mobile wallet support, what happens if the card is lost — are the things Sponge publishes the least about.

Who they will give the card to

The Sponge card is unusual in that the question of *who can have one* is barely answered in public. The homepage and the developer documentation do not publish a list of supported countries, supported citizenships, or supported residences. The only eligibility number you will find in the platform’s own terms is a minimum age of 13 for the Sponge service as a whole. There is no separate “this country is excluded” notice, and there is no residency-based gating language the way you would see from a regulated e-money issuer.

In practice, what controls who actually gets a card is the identity check that runs after you ask for one. The flow is hosted KYC, kicked off from the CLI or the SDK with a redirect URI, which then hands over to Rain’s issuer application. You are asked for an occupation (or a SOC code) and you have to tick a set of consent boxes: e-Sign, the account-opening privacy notice, the Sponge Card terms, an accuracy statement, and a non-solicitation flag. To create the card itself, the SDK requires a billing address (line 1, city, region, postal code, country code), an email, and a phone number. The card-issuing side is Rain, advertised on the homepage as a Visa Principal Member, but the actual issuing bank is not named on the Sponge pages, and the licences Sponge Inc. itself holds are not stated either.

What the docs do not say is at least as important as what they do. They do not state which documents are accepted at the KYC step, whether a passport is required or a national ID is enough, what age you must be to be issued a card specifically (as opposed to use the platform), or what the geographic exclusions are. Terms are governed by US law, which suggests Rain’s programme is structured around a US framework, but you will not find a country table to check your own residence against before you start.

For a reader in a country where ordinary bank cards are hard to get, this is the section that should make you slow down. With most crypto cards, you can read the supported countries before you install anything; here, the only way to find out whether you are eligible is to start the KYC flow and discover that you cannot finish it. That is more friction than it sounds, especially because hosted KYC providers routinely store a partial application against your identity even when they do not approve it.

How to get it

The signup flow is, again, shaped around the developer audience. There is no App Store download and no Google Play listing to speak of — the homepage, the docs, and the GitHub presence all point at the same entry point: a command-line tool you run with npx spongewallet, the TypeScript SDK, or an MCP server that a model can call.

The shape of the process is roughly this. You authenticate against the Sponge wallet, then call the hosted KYC entry point with a redirect URI. Your browser opens, the identity provider takes you through the usual document and selfie steps, and on approval an issuer application is created with Rain. From there you can call createSpongeCard to mint a virtual card. The card details the API returns are encrypted with a one-time secret key; the documentation tells you to treat them as secret, decrypt them in memory, and never log or persist the decrypted PAN or CVC. There is no mention of a physical card, no shipping address field, and no obvious way to ask for one.

What is not stated is whether the same flow works on a phone, what happens if KYC is refused, how long the hosted check usually takes, and whether you can reapply if your documents expire. There is also no public, per-country step-by-step that I could find, which means the practical “how long does it take, what do I need” answer depends on the KYC vendor Rain uses at the moment you try.

For a developer, this is workable. For a non-developer, the absence of a graphical app is the binding constraint. The card is technically obtainable without writing code if you use the hosted KYC link and a third-party API explorer, but the product is not designed to be walked through that way, and Sponge does not promise that it will work.

What it really costs

This is the part of the review where I have to be most direct: the public Sponge pages do not publish a fee schedule. I checked the homepage, the developer documentation, the GitHub repositories linked from the docs, and the legal pages I could find, and there is no table of issuance fees, monthly fees, FX margins, ATM fees, or conversion fees for the card. The terms I could see are the platform terms, not card-specific pricing.

What the documentation does say is that the card is a *credit card* (the homepage describes it that way) issued by Rain, a Visa Principal Member, and that spending power is determined by the USDC collateral you have moved into the card via the card fund command. There is also a card withdraw (or withdrawSpongeCard) call that returns USDC to your wallet, with the amount rounded to two decimal places. The implicit cost of running the card is therefore the on-chain network fee you pay to move USDC onto Base or Solana and back, not a fee the card issuer charges on top.

The limits — daily, monthly, per-transaction — are not stated. What is stated is that “collateral determines spending power” and the getSpongeCardStatus endpoint returns a spending power value. So the practical spending cap is the USDC you have moved across, not a published ceiling, and that means the size of your wallet is your limit.

I want to underline what the table above means in practice. The cost of *holding* the card appears to be zero on the Sponge side, because there is no monthly fee and no published per-transaction fee. The cost of *moving money in and out* is the on-chain network fee on Base or Solana, paid in each network’s native asset, plus whatever your entry route into USDC costs you. The cost of *spending* is whatever spread sits between USDC and the currency the merchant charges you in, and that spread is not disclosed. With most crypto cards the spread is the single largest cost over a year, and Sponge does not put a number on it.

A few everyday payments, walked through with the public information:

• A €5 coffee paid with Apple Pay, in a country whose currency is not the card’s base currency. The docs do not say whether the card supports Apple Pay, so this would likely have to be a manual card-entry or online payment. The FX spread between USDC and the merchant’s currency is not published. The on-chain cost of funding the card with USDC on Base, before the coffee, is the Base network fee in ETH, which on Base is typically a small fraction of a cent.
• A $200 online subscription, paid automatically each month. If the merchant supports the card and AVS does not flag the foreign-issued BIN, the payment is funded by USDC collateral. The conversion, FX and any payment fees are not stated. The only fixed cost you can see in advance is the gas on the original card fund transfer.
• A cash withdrawal at an ATM abroad. The documentation does not state that ATM withdrawals are supported at all, and does not publish a fee if they are. Treat this as unsupported until Sponge says otherwise.

The honest summary is that the Sponge card is cheap to *hold* and unstated to *spend*. For a developer running an agent that buys small things in a known currency, that is fine. For anyone else, it is a reason to look at the alternatives below, every one of which publishes a fee schedule.

How to top it up

Funding the Sponge card is the cleanest part of the product, because the mechanism is one command and one coin.

The only collateral the card accepts is USDC, and the only way to move it in is from the Sponge wallet itself. The CLI command is card fund; the SDK exposes the same operation. The example chain in the documentation is Base, and the SDK notes that Solana is also available as an optional chain. There is no on-ramp — you cannot buy USDC from inside the Sponge app — and there is no support for any other stablecoin, no support for ETH, BTC, or SOL as funding, and no support for USDT. The wallet is the funding source; the card cannot be topped up from a third-party exchange address.

A practical flow looks like this. You acquire USDC on an exchange or in another wallet, withdraw it to your Sponge wallet deposit address on Base, wait for the transfer to confirm, then run card fund with the amount you want to move onto the card. The getSpongeCardStatus endpoint should then return a higher spending power. To reverse the move, card withdraw returns USDC to the same wallet, with the amount rounded to two decimal places.

The fees and minimums on funding are not stated, which in practice means you pay the on-chain network fee on Base or Solana and nothing more on the Sponge side. The on-chain fee is paid in the network’s native asset (ETH on Base, SOL on Solana), so a wallet that holds only USDC cannot fund the card on those networks — you need a small native-token balance to pay gas. The Sponge wallet presumably handles that, but the documentation does not spell it out.

A few things to watch for, drawn from how this category of product tends to go wrong:

• Wrong network. If you send USDC to your Sponge wallet on a network other than Base or Solana, the card cannot fund from it. The chain selection happens at the deposit-address level, not the card level, and a transfer on the wrong chain is not something Sponge can pull back.
• No ETH or SOL for gas. USDC on its own cannot pay network fees. If your Sponge wallet runs dry of the native asset, the card fund call will fail.
• Stablecoin-only. Tether’s USDT is not supported, and Circle stopped issuing USDC on Tron in February 2024, so “USDC over TRC20” is not a route. If you hold USDT elsewhere, you will need to swap it before you deposit.
• Irreversible transfers. Blockchain transfers are not reversible in the way a card payment can be. A deposit to the wrong address, or on the wrong chain, is gone unless the receiving party chooses to help.

Paying with it every day

The everyday-use story is where the score drops the most, because the card is built to be used by software rather than by a person.

What the documentation confirms is that the card is virtual only. There is no physical card mentioned on the developer docs and no shipping or delivery field in the SDK calls I could see. The card number and CVC the API returns are encrypted with a one-time secret key, designed to be decrypted by the calling program, used to authorise a single payment, and then discarded. That is a sensible design for an AI agent that needs to pay once and never store credentials; it is awkward for a human who is used to a tap-to-pay experience.

What is not stated covers most of what a normal user would want to know:

• Apple Pay and Google Pay. The docs do not mention tokenisation into a mobile wallet. With a virtual card whose PAN is designed to be ephemeral, mobile-wallet support is not guaranteed, and you should not assume it works.
• ATM withdrawals. The docs do not state whether ATM cash-out is supported, and do not publish a fee if it is. Treat ATM use as unsupported until Sponge publishes a confirmation.
• Card currency. Not stated. The card settles USDC collateral, but the currency in which the merchant is charged is not named.
• Rewards or cashback. Not stated. There is no public cashback table, no points scheme, and no token-rebate arrangement in the documentation I could find.
• A consumer mobile app. None. There is no Sponge app in the iOS or Google Play stores under the brand, and the company points users to the CLI, the SDK, and the MCP server instead.
• Disputes and chargebacks. Not stated. Standard card-issuer rights (Regulation E in the US, Regulation Z for credit, Visa’s chargeback reason codes) usually apply, but Sponge does not spell out the process, the time window, or who handles a dispute raised through the API.

For an agent buying cloud capacity or a $10 data feed, none of this is a problem. For a person, the lack of a mobile app, the lack of mobile wallet support, and the lack of any dispute process are the reasons the everyday-use score is the lowest in the table.

A few mechanics worth understanding if you are going to use the card:

• Spending power is collateral, not a credit line. The card is described as a credit card, but it is funded by USDC you have moved across. There is no borrowing, no APR, and no interest. The “credit” framing is about how the card settles, not about lending.
• Merchant category codes (MCCs). Card networks classify merchants by a four-digit MCC, and issuers can block categories they do not like. Sponge does not publish a blocked-MCC list. The category of merchants most often restricted on crypto cards is gambling (MCC 7995), so if that is your use case, assume the worst.
• 3-D Secure. Online card payments can be challenged with a one-time code or a biometric step. With a programmatic card, this is a meaningful friction point: a challenge that requires a human response can fail a payment. The docs do not say how 3-D Secure is handled.
• AVS and foreign BINs. Address Verification Service is mostly a US, Canada and UK thing, and it is generally unavailable for cards issued abroad, which can cause declines. Sponge does not say how it routes AVS.
• Holds on authorisations. A declined or held authorisation can leave a temporary hold on funds for up to several days. With USDC collateral, that hold is real USDC you cannot withdraw until it releases.

What can go wrong

Every crypto card has a risk surface that goes beyond the fees. The Sponge card has three: the things that go wrong on the card itself, the things that go wrong with the company behind it, and the things that go wrong with the chain the card is built on.

On the card side, the documentation’s design choices are mostly defensive. The PAN and CVC are returned encrypted with a one-time secret key, the docs tell you not to log the decrypted values, and you are expected to decrypt, use, and discard. There is no mention of two-factor authentication, an instant card freeze, or spending limits because the card is a virtual instrument intended to live inside a process; the controls are in the calling code, not on a cardholder’s phone. Custody of the underlying USDC — whether Sponge holds the keys or whether the wallet is self-custody — is not stated. With many crypto cards, the answer is “we hold the keys in custody,” which means the counterparty risk below is also your custody risk.

On the company side, Sponge Inc. is a Y Combinator W26 company. The footer of the site names Sponge Inc.; the starting data describes it as “Sponge (YC W26)”; the card programme sits with Rain, which the homepage advertises as a Visa Principal Member. The issuing bank is not named on the Sponge pages, and the licences Sponge itself holds are not stated. The terms are governed by US law, which gives a US frame of reference but no guarantee that Sponge is registered as a money services business with FinCEN or holds state licences; the public pages do not say.

On the customer-protection side, Sponge points to a contact form on the homepage, an X account at @paysponge, and a Discord. There is no public Trustpilot page, no app store rating to consult, and no news report I could find of an incident, a programme suspension, or a chargeback dispute in 2026. That is a thin set of signals, and it is worth saying so: the absence of complaints is not the same as the presence of a track record, and a YC W26 company is, by definition, very young.

On the chain side, USDC is the largest US-dollar stablecoin by volume but it is not the same as holding dollars. Circle describes USDC as redeemable 1:1 for USD, backed by cash and cash equivalents, mostly in an SEC-registered government money market fund, with monthly reserve attestations. Tether describes USDT similarly. Both stablecoins have, at times, lost their peg — USDC briefly in March 2023 during the US banking crisis, and the TerraUSD collapse in May 2022 is the headline example of what a depeg looks like. A card whose spending power is a USDC balance is exposed to that risk in a way a card that holds fiat at a bank is not. On top of that, blockchain transfers are irreversible, so a deposit to the wrong address, on the wrong chain, is not recoverable through a chargeback.

Two structural risks are worth naming because they apply to the category rather than to Sponge specifically. First, custody platforms have a long history of failure, from Mt. Gox through Coincheck to the Ronin bridge, and a card that holds user funds with a custodian inherits that counterparty risk. Second, Visa itself has the power to wind down a card programme, as it did with the FTX US debit card in November 2022 and with WaveCrest’s European programmes in 2018. A programme closure typically gives a notice period, then stops spending and loading, then asks users to withdraw. Sponge has not signalled any such risk, but the structural exposure is the same as for any Visa programme.

What to take instead

If the Sponge card does not fit your situation, three other products in the same general category do a more conventional job of “crypto balance on a Visa.” I have used each of these elsewhere in the crypto-card reviews on this site, and the scores below come from those reviews.

Xplace, scored 7.7 / 10. Xplace is closer to a traditional crypto card: a Visa with both virtual and physical tiers (Silver is live, Gold and Platinum are listed as coming soon), a published annual-fee schedule (Basic free, Silver $99 a year, Gold $249 a year, Platinum $999 a year), a published “0% FX on Platinum” claim, and a published cashback ladder in Credit mode (Basic 0.5%, Silver 1%, Gold 1.5%, Platinum 2%, paid in USDC to the wallet at settlement). Funding is broader than Sponge’s: you can deposit BTC (cbBTC), ETH (wETH), SOL, JitoSOL, USDC, USDT and xStocks, and the network is Solana. The catch is that Cash-mode cashback, FX on the non-Platinum tiers, and the supported-country list are not stated.

ether.fi, scored 6.7 / 10. ether.fi’s card is a Visa with virtual and physical options, a published FX ladder by tier (Core 0.5%, Luxe 0.25%, Pinnacle and VIP none), a published cashback ladder paid in ETHFI (Core 3% up to $2,000 monthly, then 1% to $3,000, then 0.5%; Luxe 3% up to $10,000; Pinnacle 3% up to $50,000), and a published residency list that is unusually specific. The list of supported jurisdictions includes Andorra, Argentina, Australia, Austria, Brazil, Canada, Cyprus, the Czech Republic, France, Germany, Hong Kong, Hungary, Italy, Japan, Mexico, Poland, Portugal, Singapore, Spain, Switzerland, the UAE, the UK, and 31 US states; Belgium and Ireland are listed as eligible without physical delivery. ATM withdrawals are explicitly blocked in North Korea, Iran and Myanmar. The trade-off is that the first virtual card costs $10 in a long list of regional-pricing countries, and crypto conversion fees are not published.

Anodos Card, scored 7.2 / 10. Anodos is a Visa under licence, with physical and virtual cards, three published tiers (Free, Pro at $9.99 a month or $99.90 a year, Elite at $29.99 a month or $299.90 a year), published FX (1.50% / 1.25% / 1.00% by tier), and a published 0% APR on purchases with late-payment fees of up to $40. The residency rules are unusually explicit: cards cannot be issued to residents of Belarus, Mainland China, Cuba, India, Iran, Iraq, Israel, Myanmar, Nepal, Nicaragua, North Korea, Russia, Syria, Turkey, Ukraine, Venezuela or Vietnam; Chinese and Hong Kong passports are not eligible; spending is blocked in Cuba, Iran, North Korea, Russia, Syria, Ukraine and Venezuela. The international programme requires users to attest they are not US citizens. The catch is that the collateral list is broad (Ethereum, Polygon, Optimism, Arbitrum, “or others the issuer adds”) but the specific coins accepted are not listed, and the cashback arrangement is not stated in the card terms.

The pattern across the three is the same: published fees, published countries, published tiers, and a phone app. Sponge trades all four for a developer-first interface and a USDC-only funding model. If the developer-first interface is the feature you want, the Sponge card is one of the only products on the market that delivers it; if it is not, the alternatives are better documented and easier to live with.

Who I would recommend it to

I would recommend the Sponge card in a very specific case, and I would not recommend it in a slightly broader set.

Recommended for: developers building software that needs to authorise small, programmatic payments in a stablecoin and does not want to maintain a fiat balance at a bank. The CLI, SDK and MCP entry points are what you actually want in that situation, the USDC-only funding model keeps accounting clean, and the per-payment ephemeral PAN and CVC fit an agent’s “use once, do not store” model. If you are a researcher giving a program a wallet to study autonomous spending, the same is true.

Not recommended for: anyone who needs a card they can hand to another person, a card that lives in Apple Pay or Google Pay, a card whose fees are published before they sign up, or a card that works in a specific country they can verify in advance. That covers most of the people who arrive at a “crypto card review” expecting a daily-driver recommendation. For them, Xplace, ether.fi or Anodos is a more honest fit.

Not yet clear for: people whose jurisdiction Sponge has not published. Until Sponge publishes a country list, the only way to know whether you can be issued a card is to start the KYC flow. If the country you live in is one where an ordinary bank card is hard to get, that test is the worst place to discover the answer, because a partial KYC application often lingers in identity-verification systems.

The honest framing is that the Sponge card is not underpriced or under-documented for its target user. It is priced and documented for software, and the 4.9 out of 10 is a measure of how poorly that fits a person. If you read this review and concluded that the card is “almost good but missing a few things,” you are reading it as the wrong audience. The card is a tool that does one specific job, and the job is not the job most people come to a crypto card to do.

Frequently asked questions

What is the Sponge card?

The Sponge card is a Visa credit card issued by Rain, the company behind Sponge, that spends a USDC balance held in the Sponge wallet. It is virtual only, created through a command-line tool, a TypeScript SDK, or an MCP server that an AI agent can call, and it is designed for developers rather than for everyday consumer use. Spending power is set by the USDC you move onto the card with the card fund command.

How does the Sponge card work?

You authenticate against the Sponge wallet, complete a hosted KYC check that is started from the CLI or SDK, and then call createSpongeCard to mint a virtual Visa. The API returns a card number and CVC encrypted with a one-time secret key. You decrypt them in memory to authorise a payment, then discard the values. To load the card, you move USDC from your Sponge wallet with card fund; to unload it, you use card withdraw, which returns USDC to the wallet.

Is Sponge a bank?

No. Sponge is a technology company. The card programme is run by Rain, which the homepage advertises as a Visa Principal Member. The actual issuing bank is not named on the Sponge pages, the licences Sponge itself holds are not stated, and the platform’s terms are governed by US law. The card is a Visa, not a bank account.

Who owns Sponge?

Sponge is run by Sponge Inc., whose name appears in the site footer. The starting data describes the company as “Sponge (YC W26),” meaning it is part of Y Combinator’s Winter 2026 batch. Beyond the company name, no ownership structure, founder list, or investor list is published on the Sponge pages I could find.

Is the Sponge card available in my country?

The Sponge public pages do not publish a country list. The only eligibility number in the platform’s terms is a minimum age of 13 for the service. The only way to find out whether your country is supported is to start the hosted KYC flow and see whether Rain’s issuer application accepts your details. That is more friction than most crypto cards require, where a country list is usually posted in advance.

How do I get a Sponge card?

You install the CLI with npx spongewallet, or import the SDK, and start the hosted KYC flow with a redirect URI. After KYC approval, Rain creates the issuer application and you can call createSpongeCard. You need a billing address, an email and a phone number; the docs do not state which identity documents are accepted or how long approval usually takes. There is no mobile app you can download.

Does the Sponge card require KYC?

Yes. The flow is a hosted KYC, started from the CLI or SDK, that ends with a Rain issuer application. You are asked for an occupation (or a SOC code) and you tick a set of consent boxes covering e-Sign, the account-opening privacy notice, the Sponge Card terms, an accuracy statement and a non-solicitation flag. The documentation does not state which documents are accepted or what the failure mode is for a refused application.

How do I top up the Sponge card?

You fund it with USDC from the Sponge wallet using the card fund command. The example chain in the docs is Base, and the SDK also lists Solana as an optional chain. There is no support for any other coin and no on-ramp inside Sponge. Network fees on Base or Solana are paid in the native asset, so a small ETH or SOL balance is needed in the wallet to pay gas.

How do I add the Sponge card to Apple Wallet or Google Pay?

The Sponge documentation does not state whether the card can be added to Apple Pay or Google Pay. The card is a virtual-only product whose PAN and CVC are returned encrypted and designed to be used once, which makes a tokenised mobile-wallet experience unlikely. You should not assume that tap-to-pay works; the supported way to authorise a payment is through the CLI or SDK.

Is the Sponge card safe?

The card’s design is defensive where it matters for an agent: the PAN and CVC are encrypted with a one-time key, the docs tell you not to log the decrypted values, and the funding model is collateralised by USDC you control. The less reassuring answers are that the custody model of the underlying USDC is not stated, two-factor authentication and an instant card freeze are not mentioned because the product is a virtual instrument, the licences Sponge holds are not published, and there is no public Trustpilot page or app store rating to consult. Treat it as a tool for a narrow use case, not as a daily-driver financial product.

Content created by the «cryptocardverdict» team