Business Spend Policy: How to Write One Employees Follow

A business spend policy outlines a set of rules regarding what employees can purchase, the payment method, spending limits, what documentation is kept, and how it is enforced. 

Each rule must have a setting, approval, or review process that enforces it.

To write a policy employees will follow, you need to write 8 short sections regarding cards and limits, merchants, receipts, approvals, subscriptions, reimbursements, exceptions, and enforcement. You must configure your rules on company cards before the policy is released.

The floor for receipts and reimbursements is set by the IRS, merchant category codes (MCCs) are set by card networks, Visa and Mastercard, and transactions are coded and documented by accounting systems.

Most policies fail in the gap between these systems and a PDF no one re-reads, because, in reality, the policy says one thing and the company card says another, and employees follow the card.

This blueprint bridges that gap for finance leaders in U.S based companies, and includes a copy-and-paste policy near the end.

Key Takeaways

• A spend policy holds when every rule maps to an enforcement point: a card setting, an approval step, a monthly review, or a named person.

• Limits, merchant restrictions, and expiry dates set on company cards stop out-of-policy charges at authorization, before finance has to chase anyone.

• Internal Revenue Service (IRS) Publication 463 generally requires receipts for lodging and for other travel, gift, and car expenses of $75 or more, showing amount, date, place, and the nature of the expense.

• The IRS treats accounting for expenses within 60 days and returning excess advances within 120 days as a reasonable period under an accountable reimbursement plan.

• Every recurring software charge needs a named owner, its own card, and a recorded renewal date, so subscriptions do not outlive the people who bought them.

• Exceptions belong in one logged channel with an approver and an end date, so a temporary limit raise reverts instead of becoming the new rule.

What Should a Business Spend Policy Include?

A business spend policy should include 8 sections: cardholders and limits, merchant rules, receipts, approvals, subscription ownership, reimbursements, exceptions, and enforcement. Each answers one question an employee has at purchase and names the system that checks it.

Define Scope Before Rules

Start with the scope. What is covered by the policy and who is covered, then list the expenses the policy covers. 

State if each is chargeable on a company card, if it requires a purchase order, or is reimbursable. Include the name and title of the owner of the policy and state when the policy will be reviewed.

Write Rules a System Can Check

Rules that are too vague can lead to issues down the road. Employees can interpret rules differently, often leading to disputes on who is right.

 Rules that are clear and concise eliminate the need for debate. Saying “keep meals reasonable” provides no limiting principle, and leaves the decision to the employee, potentially leading to wasteful spending. 

Rewriting that rule to say “client meals up to $60 per person, employees listed on the receipt” is rule that can easily be verified by a card limit and reviewer. 

Before issuing rules like this, they should ensure no card limit, approval, or monthly report can verify the rule.

How Do You Set Employee Spending Limits That Hold?

Limits hold when they’re set in stone. Employee spending limits hold when they’re set by the card, not the paperwork.

Size Limits by Role and Purpose

Limits should be set based on the purpose of the spending and the role of the employee. Set the ceiling high enough to allow for routine spending by the employee. 

Limits that are set below the real need lead to users learning that the policy is negotiable and result in frequent exception requests.

Issue One Card per Purpose

Giving a card for each purpose creates a clean statement and a clean shutdown. Using merchant-locked cards keeps funds blocked for that purpose only. 

For budgets that pace evenly over a month, our workflow shows how to set a limit for each client and platform.

Which Merchants Should Company Cards Allow?

Company cards should allow only the merchants and categories each card exists to pay. An allow-list approves what you expect, which holds up better than a block-list trying to predict everything you do not.

Prefer Allow-Lists to Block-Lists

A block-list that excludes gambling, cash advances, and gift cards still leaves thousands of merchants open. An allow-list flips the default, so a travel card works on airlines and hotels, a software card works on approved vendors, and anything else declines at authorization. Spend controls for employees are most reliable this way, because the card applies the rule for everyone.

Plan for Category Codes That Misfire

Category rules depend on the code each merchant carries, and your card issuer does not set it. Under the Visa merchant data standards, the merchant's acquiring bank assigns the code, which should reflect its primary type of business.

A tool bought through a reseller can carry a code your rules never anticipated, so tell employees how to request a one-off merchant approval rather than paying personally.

What Receipt Rules Should the Policy Set?

Receipt rules should set a threshold, the details every receipt must show, and a submission deadline. Tie the threshold to tax substantiation and the deadline to your month-end close.

Match the Threshold to IRS Substantiation

For travel, gift, and car expenses, IRS Publication 463 generally requires documentary evidence, such as receipts or bills, for lodging and for any other expense of $75 or more.

A receipt is adequate when it shows the amount, date, place, and essential character of the expense. A policy threshold above $75 leaves gaps you will fill later.

Set a Submission Deadline Employees Can Meet

Give employees a fixed window to attach a receipt and business-purpose note, closing before your books do. Five business days after the charge posts suits most teams, because receipts land before reconciliation starts. Our month-end reconciliation checklist covers what finance does with them next.

How Should an Approval Workflow Policy Route Requests?

An approval workflow policy should route requests by amount and type, approve budgets before money moves, and keep requesters and approvers separate. Most purchases then need none, since the card limit already reflects one.

Approve the Budget, Not Every Charge

Approving each transaction turns managers into a bottleneck, so approve the budget instead: a manager signs off on a conference trip or a quarterly tool budget, finance issues or raises a card to match, and every charge inside that envelope clears on its own. Anything above it declines and becomes a new request.

Set Tiers by Amount and Risk

A short tier table tells everyone who signs what. The example below suits a company of roughly 20 to 200 people, so adjust the bands to fit.

Keep Requesters and Approvers Separate

Nobody should approve their own request. Name a backup approver for each tier so absences do not stall purchases, and give finance view access to every approval. The same separation for ad buying teams is covered in our media buyer permissions guide.

Who Owns a Software Subscription Under the Policy?

Every subscription should have one named owner who answers for its cost, renewal, and cancellation. The policy should record that owner, a dedicated card, and the renewal date.

Give Every Recurring Charge an Owner and a Card

Put each subscription on its own vendor-locked card with a ceiling slightly above the current price, so a price rise or seat expansion declines and forces a conversation.

Keep a register of owner, vendor, monthly cost, renewal date, and notice period, and review it quarterly, since nobody revisits a recurring purchase unprompted.

Transfer Ownership When People Leave

Offboarding checklists cover laptops and logins but often skip subscriptions. Add a step that reassigns every subscription the departing employee owns, or cancels it.

A vendor-locked card keeps the handoff simple, since nobody updates the payment method inside the tool.

How Should Reimbursements and Exceptions Work?

Reimbursements and exceptions are the two routes outside the card flow, and both need tighter rules. Reimbursement should follow IRS accountable plan timing, and exceptions should run through one logged request.

Run Reimbursements as an Accountable Plan

Your expense reimbursement policy should meet the 3 accountable plan rules in Publication 463: a business connection, adequate accounting within a reasonable period, and return of any excess within a reasonable period.

The IRS treats accounting within 60 days of the expense and returning excess within 120 days as reasonable. Reimbursements meeting all 3 rules stay out of the wages on the employee's Form W-2, while those that fail are generally treated as paid under a nonaccountable plan.

Route Exceptions Through One Logged Request

Make the approved path faster than the workaround. Capture the amount, reason, approver, and end date in one request form, and grant the exception as a temporary limit raise or single-use card that reverts on that date. Count exceptions by person and category monthly, so recurring ones become policy changes rather than habits.

How Do You Enforce a Spend Policy Without Policing Employees?

Let cards block what they can, review only the charges that break a rule, and write consequences down before you need them. Finance stays out of most purchases while repeated breaches stay visible.

Map Every Rule to an Enforcement Point

The table below is the core of a corporate card policy that holds, pairing each rule with what enforces it and the record it leaves. For how issuers apply these settings during authorization, see how card controls work.

Review by Exception Each Month

Reviewing every transaction spends finance time on purchases the cards already checked. Pull a monthly report of declines, missing receipts, exceptions, and charges without a business-purpose note, and focus there. A cluster of declines on one card usually points to a limit set too low for the work.

Write Consequences Before You Need Them

State what follows a breach: a reminder for a first missing receipt, a temporary card freeze after repeated ones, and card removal plus a manager conversation for personal or unapproved spend. Apply the same steps at every level of seniority, so a breach triggers a known process rather than a judgment call.

What Does a Copy-and-Paste Spend Policy Template Look Like?

The template below holds all 8 sections in plain language, with example values you can replace. Use it as a company expense policy template for a first draft, then change every example figure to match your roles, vendors, and volumes.

Sections 1 to 4: Scope, Cards, Merchants, and Receipts

Paste these sections at the top of your policy. Each line can be confirmed by a card setting or a report.

Spend Policy Template, Sections 1 to 4

1. Scope and ownership

• This policy covers all company spending on software, travel, meals, advertising, equipment, and supplies by employees and contractors.

• Company cards are the default payment method. Purchase requests cover contracts and invoices. Reimbursement is for cases where a card cannot be used.

• The finance lead owns this policy and reviews it every 6 months. 2. Cards and limits

• Each cardholder receives cards for defined purposes, with monthly limits set by role. Example: $500 for team members, $2,500 for managers, and project cards sized to the approved budget.

• Cards issued for a fixed project or event carry an expiry date that matches its end. 3. Merchant rules

• Each card works only at the merchants or categories listed for its purpose. Cash withdrawals, gift cards, and personal purchases are not permitted on any card.

• To use a merchant outside your card's list, submit an exception request before purchasing. 4. Receipts

• Upload an itemized receipt for every lodging charge and every other charge of $75 or more within 5 business days of the charge posting.

• Each receipt shows the amount, date, merchant, and what was bought, with a one-line business purpose.

Sections 5 to 8: Approvals, Subscriptions, Reimbursements, and Enforcement

These sections cover routes that need a person's sign-off. With the first 4, they form a business expense policy template you can adapt in an afternoon.

Spend Policy Template, Sections 5 to 8

5. Approvals

• Spending inside an existing card limit needs no further approval.

• New cards and limit increases follow the approval tiers attached to this policy. No one approves their own request. 6. Subscriptions

• Every recurring charge has a named owner, its own card, and an entry in the subscription register with its renewal date.

• When an owner leaves, their manager reassigns or cancels each subscription before the last working day. 7. Reimbursements

• Submit out-of-pocket expenses with receipts within 30 days. Return any unused advance within 60 days.

• Finance pays approved claims within 10 business days. 8. Exceptions and enforcement

• Request exceptions through the finance channel with the amount, reason, and end date. Approved exceptions expire on that date.

• A missing receipt triggers a reminder, and 3 in one quarter pause the card until resolved. Personal or unapproved spend on a company card must be repaid and leads to card removal.

Enforce Your Ad Spend Policy With Opal

We built Opal to enforce the advertising section of your spend policy on the card itself. The rules you write for ad budgets, platforms, and approvals become settings on cards we issue.

What You Set on Each Card

Every account includes virtual cards in any number, with no per-card charge, so you can dedicate one to each ad platform, client, campaign, or employee and set a spending cap, an allowed merchant, and an end date on each.

Spend approvals and employee permissions sit beside those settings, every transaction appears in one dashboard as it posts, and spend syncs to QuickBooks or Workday. Applying takes about 2 to 3 minutes, with cards usually ready in 1 or 2 days.

Where Our Card Fits in Your Policy

The Opal Card accepts charges only from supported advertising and media platforms, including Google Ads, TikTok Ads, and Meta Ads, so software, travel, and reimbursements stay on your other accounts.

The card is paid in full each month, serves U.S.-based businesses, and is issued through our partner bank. It carries no annual fee, asks for no personal guarantee, runs no hard credit check, and pays back as much as 2% of eligible ad spend, with your rate set during approval.

If paid media is a large share of your spend, apply for Opal and set up your first platform cards to match the policy you just wrote.

 Frequently Asked Questions (FAQs)

What Is the Difference Between a Spend Policy and an Expense Policy?

A spend policy governs money before it leaves the business: who holds cards, which limits and merchants apply, and which purchases need approval. An expense policy traditionally covers what happens afterward, such as receipts, claims, and reimbursement. Most companies now combine both in one document.

How Long Should a Spend Policy Be?

Most companies can fit a working spend policy on 2 to 4 pages. Eight short sections are enough, with role limits and approval tiers attached as tables. Longer documents tend to go unread, so put the detail into card settings, where it is enforced automatically rather than remembered.

Do Employees Need Receipts for Every Purchase?

Federal tax rules do not demand a receipt for every purchase. IRS Publication 463 generally requires documentary evidence for lodging and for other travel, gift, and car expenses of $75 or more. Many companies still require a receipt for every charge because a single rule is easier to follow.

How Often Should You Update a Spend Policy?

Review it every 6 months and after major changes such as a new card program or a jump in headcount. Let the monthly exception log guide the update, because an exception approved repeatedly for the same reason is a rule that needs rewriting, and a limit nobody approaches may be too high.

Who Should Approve Exceptions to a Spend Policy?

A named finance lead should approve exceptions, with a backup for absences, while the requester's manager confirms the business need. Log the amount, reason, and end date, and set each exception to expire on its own so it never quietly becomes the standing rule.

Can a Card Platform Enforce the Whole Policy?

No card platform enforces every rule. Limits, merchant restrictions, expiry dates, and approvals run on the card, while business purpose and receipt quality need a reviewer. Opal enforces the advertising portion on supported ad and media platforms, so software, travel, and reimbursements rely on controls attached to your other payment accounts.