Sponge in one line: a virtual Visa for AI agents, funded with USDC, with most of the details missing

Updated October 2026

Licensed

Available in US

Fast payouts

18+ Only

If you have been looking for a crypto card, the pitch here is unusual enough to be worth reading slowly. Sponge is not an app you download and tap. It is a Visa card, issued by Rain, that is created by code, funded with USDC, and spent from a balance that behaves like collateral rather than like a bank account. The developers behind it describe the use case plainly: giving AI agents a USDC-backed Visa card. That is a real product with a real audience. It is also, as you will see, a product whose public pages leave most of the ordinary questions unanswered.

Before we go further, the honest framing: this is a review of what Sponge publishes about itself, not a report from someone holding the card in a shop. Where the card’s own pages say nothing, I will say so rather than fill the gap with an assumption from a competitor or a guess.

Conditions are current as of October 28, 2026.

Verdict: 4.9 out of 10, and the reason is disclosure, not concept

Sponge scores 4.9 out of 10. The idea is good. The card is real. And yet almost everything you would want to know before applying is either absent or reduced to a single line.

Here is where the marks come from:

Two things are worth separating here. The first is whether Sponge works as designed. On its own terms it looks coherent: a stablecoin balance moves from a wallet into a Visa instrument, spending power follows the collateral, and the whole thing is scriptable. The second is whether you could make an informed decision from what is published. On that, the card scores poorly, and the low marks above cluster around that problem rather than around the concept.

The pattern is consistent: countries not stated, age only 13 with no document list, fees not stated, ATM not stated, limits not stated, currency not stated, physical delivery not stated, rewards not stated, custody model and 2FA not stated, disputes not stated. That is a long list of the same kind of silence, and it is the main thing to weigh as you read the rest of this page.

Who does it suit? Someone who already runs agent infrastructure, already holds USDC on base or solana, already has a billing address and can handle a hosted identity flow without needing a mobile app. That person can probably get value from Sponge today. Who does it not suit? Almost anyone who wants an everyday card: someone paying for groceries, someone topping up from a bank account, someone who needs a card in Apple Pay, someone who wants to know what a coffee costs before they buy it. The product is not aimed at them.

Will they give you the card?

The short answer is that the card does not publish the answer, and that absence is itself informative. There is no country list on the card pages. The platform terms set a minimum age of 13 for the service. That is the entire public position on eligibility, and it is thinner than the one-line country disclosure most competing cards publish.

The reason for the silence is structural rather than accidental. Sponge is not the issuer. Rain is, described as a Visa Principal Member. The issuing bank is not named, and the licences behind the arrangement are not stated. When the party you apply to is also the party that holds the programme, the countries that can be served depend on that issuer’s licences, its risk policy and its sanctions screening — none of which Sponge publishes on these pages.

So the practical position: nobody can tell you from the public pages whether Sponge will issue to you in the country you live in. That is not the same as being refused, and it is not the same as being accepted. Before you invest an afternoon in a CLI flow, the only reliable route is to ask the project directly through one of the support channels described below.

Two adjacent questions get the same answer. What documents are accepted, and what is the minimum age for the card itself, are not stated. The KYC level is not stated either — there is a single hosted KYC step and then an issuer application, with no tiers described. For a reader comparing cards, that absence matters more than it might seem: a card that publishes its verification levels lets you predict the wait. A card that does not leaves you guessing.

How to get it

Getting a Sponge card is a software flow, not an application form. Here is the path as the card describes it.

The hosted KYC flow is started from the CLI or SDK with a redirect URI. After approval, the application goes to the issuer. During that step you supply occupation, or a SOC code, and you give consent to a set of flags: E-Sign, the account-opening privacy notice, the Sponge Card terms, accuracy, and non-solicitation. Creating the card itself then needs a billing address broken out into line1, city, region, postal_code and country_code, plus an email and a phone.

That is the whole process, and it has an unusual feel. There is no product page with a “Apply” button, no document upload described in marketing terms, no stated list of passports or driving licences. The flow assumes you are comfortable with a terminal and a redirect. The card runs through a CLI (npx spongewallet), an SDK and an MCP interface.

The card you get is virtual. It is created by createSpongeCard, and the homepage describes it as a credit card issued by Rain, accepted wherever Visa is accepted. The card currency is not stated. Physical delivery is not stated either — the documentation describes virtual only, and the pages do not say whether a plastic card exists at all.

For an agent-driven workflow this is a feature. For a person who wants a card in their wallet, this is the whole story, and it ends at “virtual”.

Fees: what it costs, and what you are left to guess

Sponge publishes no costs. Not the issuance fee, not a monthly or annual fee, not the conversion rate, not the foreign-exchange treatment, not ATM terms, not daily or monthly spending limits. There is no tier table, because only one Sponge Card is described. If a fee exists, the public pages do not say so.

That is not a nitpick. For a prepaid-style instrument, the fee structure is most of the decision. Let me show you why by walking through three ordinary payments against the structure competitors publish, so you can see exactly which numbers you are missing.

A coffee costing a few dollars, paid in a shop. On a card with published terms you would learn three things: whether the balance is converted from USDC at a stated rate, whether a foreign-exchange fee applies when the shop’s currency is not the card’s, and whether there is a per-transaction minimum. Here you know only that spending is backed by USDC collateral and that collateral determines spending power — getSpongeCardStatus returns your spending power. Whether that coffee leaves a visible mark is not stated.

An online subscription billed in euros while your collateral is USDC. This is the classic case where the cost of a crypto card is decided. A card charging 0.2% on a weekday in the EEA publishes that figure; a card charging 2% in another region publishes that too. Sponge publishes neither an exchange-rate figure nor an FX fee, and the card currency is not stated, so you cannot even tell which of the two situations you are in. Competitors in this space quote weekend rates as well as weekday rates, because the gap between them is where people get surprised.

A withdrawal at a cash machine. ATM availability and terms are not stated, and so are daily and monthly limits. On other cards this is a published row; here it is a blank.

Here is what is missing, laid out as the table I would want to read:

There is also the category-level cost that sits outside the card: on-chain network fees for your deposit are charged by the blockchain, not by the card provider. If you fund on base or solana, that network cost is yours, and it is separate from anything Sponge would charge.

One piece of wording deserves a second look, because it is the one pricing-adjacent statement the card makes. The homepage describes a credit card. Spending power is tied to collateral. A credit card normally involves a credit line and a billing cycle; collateral in USDC is a different arrangement. Whether the label is meant in the loose marketing sense or the regulated one, the public pages do not explain, and the distinction would matter a great deal if a dispute ever arose.

Top up: one coin, two networks, one command

You fund the card by moving USDC collateral from your Sponge wallet, using the card fund command. The example chain shown is base; the SDK also mentions solana as an optional chain. That is the entire funding story: one asset, two networks, no bank transfer in the public description.

The mechanics are simple. Collateral moves from the wallet to the card, and spending power follows it. When you want the money back, card withdraw (or withdrawSpongeCard) returns USDC collateral to the wallet, with the amount accepted up to two decimal places. Fees for funding and for withdrawal are not stated, and no minimum is published.

The reason this is worth walking through carefully is that both directions carry a category-level risk that has nothing to do with Sponge. Blockchain transfers are irreversible. If you send on a network the card provider does not support, or to an address belonging to a different network, the funds can be lost or need manual support recovery with no guarantee. On base and solana you are within the networks Sponge names, which is better than sending blind — but the address must still be right, and “right” is on you.

There is one more layer under the USDC choice. Stablecoins aim to hold a stable value against a fiat currency, but the BIS put about 90% of stablecoin market capitalisation in USDT and USDC, and stablecoins are not guaranteed stable: USDC temporarily lost its peg in March 2023 during the US banking crisis. Tether also describes itself as disabling tokens in wallets on the OFAC sanctions list and freezing funds tied to illicit activity, so these assets are not censorship-proof. None of that is a reason to avoid USDC on Sponge. It is a reason to read “collateral” as an asset with its own behaviour, not as cash in an account.

What you cannot do, on the published information, is fund from a bank account, from another coin, or from a different stablecoin. If you do not already hold USDC on base or solana, the first thing to establish is where your USDC sits and on which network. Getting that wrong is the single most expensive mistake available at this stage.

Paying with it every day

The everyday-use score is the lowest single mark on the card, and the reason is straightforward: a virtual card, created by code, with the wallet layer undocumented and mobile wallets unaddressed.

What is disclosed is a virtual card described as a credit card accepted wherever Visa is accepted. What is not disclosed covers almost everything a daily payment touches. Wallets: not stated, so there is no answer on adding it to Apple Wallet or Google Pay. ATM: not stated. Apple Pay and Google Pay: not disclosed. Rewards or cashback: not stated. Disputes and chargebacks: not stated. Card currency: not stated. And there is no consumer app — Sponge is used through the CLI, the SDK and MCP, so store ratings are not applicable in the first place.

For a card aimed at AI agents, none of this is a defect. An agent paying an API does not need Apple Pay; it needs a number, a network call and a funded balance. The gap appears when a human wants the same instrument: no phone wallet means no tap-to-pay, no ATM means no cash, and no published dispute process means no clear route if a charge goes wrong.

There is a category-level reason to read the missing features with care. A tokenised mobile wallet replaces the card number with a device-specific number stored in the Secure Element, and each payment uses a one-time dynamic security code. Without that layer, every online payment runs on the raw card number. And a card number issued in one country can simply look foreign to a shop in another, because merchants read the issuer identification number at the front of the number and may apply extra scrutiny when the issuer country differs from your billing address. Some merchants decline prepaid or foreign-issued cards on that basis alone. Add 3-D Secure and address verification, and the picture is a card that will work most of the time and occasionally fail for reasons that have nothing to do with your balance.

What can go wrong

Let me separate three different things people worry about, because they have very different odds here.

Operational failures. Wrong network, wrong address, insufficient collateral — all real, all yours to manage. Blocked merchant categories are another: some issuers block gambling merchants, a category that carries its own four-digit code in the merchant classification system, by policy rather than by law, and the blocked list varies by issuer. Sponge does not publish a blocked list. Declines are also worth understanding as a category: a declined authorisation can leave a hold on your funds for several days, typically up to seven.

Company and programme risk. This is where Sponge’s thin disclosure bites hardest. Sponge Inc. is named in the footer, described as Sponge (YC W26). The card is issued by Rain, a Visa Principal Member, with the issuing bank unnamed, and the terms are governed by US law. Licences are not stated. On the record I could find, there is nothing adverse: no official incidents are published, and a search on 21 October 2026 turned up no user reports and no news. There is also no Trustpilot page or reviews, so there is no body of user experience to learn from either.

That silence is not evidence of anything bad. It is simply an absence of the sort of history that would let you judge. And it is worth knowing how category history works: a crypto card programme that ends typically gives a notice period, then stops spending and loading, then asks users to withdraw remaining balances. Visa terminated its global agreements with FTX in November 2022 and the FTX US debit card was wound down. WaveCrest, a Visa issuer that supplied crypto card brands, was suspended by Visa in Europe in 2018 and all its Visa programmes closed. Card programmes do close.

Custody risk. Sponge’s documentation does not state its custody model, and it does not state whether there is 2FA or an instant freeze. What it does say is about the card credentials: the card number and CVC are returned encrypted with a one-time secret key, and the documentation tells you to treat that secret as sensitive, never to log or persist the decrypted values. That is good practice and it is a thin guarantee. It protects the card number; it tells you nothing about who holds the collateral behind it.

That distinction is the one to hold on to. Control of crypto belongs to whoever holds the private key or seed phrase. A seed phrase, typically 12 to 24 words, is an unencrypted form of the private key, and anyone who obtains it can restore the wallet and spend its funds. Transfers are typically irreversible, and a stolen key has no recovery path: the network cannot freeze or return funds. Custodial platforms have a real record of this going wrong — Mt. Gox, with about US$350 million reported stolen across 2011 to 2014; Coincheck, about US$400 million in 2018; Ronin Network, US$625 million in 2022. With a self-custody-linked card the funds stay in your own wallet until the moment of payment, but then you carry sole responsibility for key loss, phishing, and malware that swaps a copied address. Sponge’s pages do not tell you which side of that line it sits on, and that is a question worth asking directly.

Two further category-level points. Prepaid and debit cards are generally available to adults, while Sponge’s platform terms set a minimum age of 13 for the service — so read the two carefully, and expect the card itself to carry a higher age than the service does. And if a charge goes wrong, the remedy depends on the licence and the account type: US debit card reversal rights come from Regulation E, credit card rights from Regulation Z, and prepaid coverage varies and should not be assumed. With the issuer bank unnamed and the card currency unstated, I would not assume you are protected by any particular regime.

Support, at least, is reachable: there is a contact link on the homepage, an account on X at @paysponge, and a Discord. Those are the channels to use for the questions above.

What to take instead

If you need an everyday card and want published numbers, the comparison below is more useful than anything I could write about a card that publishes no fees. All three scored higher than Sponge in my assessment.

Nexo is the calmest option for a European reader: no monthly, annual or inactivity fee, spending straight from the account across more than 100 digital assets, and a published FX fee. It also has the longest, least comfortable history of the four — Cointelegraph reported a 2025-era Bulgarian police raid on the Sofia office over alleged sanctions and AML violations, with no official Nexo statement on Russians found. That is a news report, not an official finding, and you should weigh it as such.

Xplace has the strongest fee story and the highest score: free through Basic, then $99, $249 and $999 a year by tier, 0% FX on Platinum, stablecoin spending with “no hidden spread”, deposits on Solana including USDC and USDT, and 0.5% to 2% cashback in credit mode paid in USDC. Its physical card is live at Silver with Gold and Platinum listed as coming.

ether.fi is the one with the most explicit country policy, which is exactly what Sponge lacks. It lists its jurisdictions — Andorra, Argentina, Australia, Austria, Brazil, Canada, Cyprus, Czech Republic, France, Germany, Hong Kong, Hungary, Italy, Japan, Mexico, Poland, Portugal, Singapore, Spain, Switzerland, the UAE, the UK, plus 31 US states — and says plainly that an unlisted jurisdiction cannot apply. It also publishes a tiered FX fee and a detailed cashback ladder, with ATM, cash advances, P2P and gambling categories excluded.

Two of these make the same point from different directions. Xplace shows what a transparent fee schedule looks like. ether.fi shows what an honest eligibility policy looks like. Neither is the same product as Sponge — Sponge is aimed at agents, and they are aimed at people with wallets — but if your objection to Sponge is silence, these are cards that answer.

One more thing to check in the wider category: in the EU, MiCA has applied to stablecoins since 30 June 2024 and to crypto-asset service providers since 30 December 2024, and ESMA keeps an interim register of authorised providers you can check. A card is a payment service regulated separately, so a crypto card often rests on two licences. Sponge’s terms are governed by US law, and its licences are not stated.

Who I would recommend it to

I would recommend Sponge to exactly one person: someone who is already running AI agents, already holds USDC on base or solana, and wants each agent to have its own Visa instrument with its own spending ceiling. In that situation the design is the argument — collateral sets the spending power, the CLI and SDK handle issuance, and nothing about a mobile app is missed because a mobile app was never the point. The encrypted card number with a one-time secret key, and the documentation’s insistence on not logging decrypted values, also fit that world better than a consumer card would.

I would not recommend it to anyone choosing their first card, anyone paying ordinary bills, anyone whose USDC sits on a network other than base or solana, anyone who needs cash, a phone wallet or a published fee, and anyone who needs to know who holds their funds and under which licence. Not because the card looks unsafe — nothing I found says that — but because the questions those people arrive with are not answered anywhere on the pages.

If you are still curious, the sensible order is this. Ask support whether your country is served and what documents the issuer wants. Ask what the fee schedule is, in writing, including conversion and FX. Ask who the issuing bank is and what licences sit behind the programme. Ask what happens to your collateral and to a disputed charge if the programme ends. Then read the answers against the table above. Anything you cannot get in writing is information you do not have, and no fee schedule you were not told about becomes a good deal.

Frequently asked questions

What is the Sponge card?

Sponge is a virtual Visa card issued by Rain, described on the homepage as a credit card accepted wherever Visa is accepted. Spending is backed by USDC collateral, and collateral determines your spending power. It is not a consumer app: the card is created through a CLI, an SDK or an MCP interface, and the stated audience is developers giving AI agents a USDC-backed Visa card.

How does Sponge card work?

You move USDC collateral from your Sponge wallet into the card with the card fund command, on base or solana, and spending power follows the collateral. Payments draw on that balance. To take the money back, card withdraw returns USDC to the wallet, with amounts accepted up to two decimal places. Conversion rates and fees are not stated.

Is Sponge a bank?

No — and it is worth being precise about this. Sponge Inc. is the company behind the service; the card is issued by Rain, described as a Visa Principal Member. The issuing bank is not named, licences are not stated, and the terms are governed by US law. Sponge is best understood as the party that markets and operates the programme, not as a bank you hold a deposit with.

Who owns Sponge?

Sponge Inc., named in the site footer, and described in the starting data as Sponge (YC W26), meaning a Y Combinator Winter 2026 company. Beyond that ownership details are not stated on the card’s pages, and no licences are listed.

Is the Sponge card available in my country?

Nobody can tell you from the public pages — there is no country list. The platform terms set a minimum age of 13 for the service, but say nothing about where the card can be issued, and the issuing bank is unnamed. If your country is not listed for the issuer’s licences, the answer will be no. Ask support before you start a flow, because eligibility is not something you can infer.

Does Sponge card require KYC?

Yes. A hosted KYC flow is started from the CLI or SDK with a redirect URI, followed by an issuer application after approval. You supply occupation or a SOC code and consent to E-Sign, the account-opening privacy notice, the Sponge Card terms, accuracy and non-solicitation. Which documents are accepted is not stated.

How much does the Sponge card cost?

Issuance, monthly fee, conversion, FX, ATM terms, daily limits and monthly limits are all not stated. On top of that, on-chain network fees for your deposit are charged by the blockchain rather than the card provider. Because no fee schedule is published, the only way to know the cost is to ask support in writing.

How do I top up the Sponge card?

You send USDC collateral from your Sponge wallet using card fund. The example chain is base, and the SDK also mentions solana as an optional chain. No other coin is supported on the published information, no bank transfer route is described, and no minimum or funding fee is stated. Make sure the USDC is on the network you intend to use.

Is the Sponge card safe?

There is no published incident to point to, and I found no user reports in a search on 21 October 2026 — but there is also no review history and no published custody model, 2FA or freeze feature. The card number and CVC are returned encrypted with a one-time secret key, and the documentation tells you not to log or persist decrypted values. Ask who holds the collateral before you fund it.

Is the Sponge card worth it?

For an agent operator already holding USDC on base or solana, plausibly yes: scriptable issuance and collateral-based spending power are real advantages. For an everyday spender, no — with no fees, no ATM, no phone wallet, no published currency and no published limits, the card cannot be evaluated on the things that decide its value. The four alternatives above publish at least some of what Sponge omits.

Content created by the «cryptocardcatalog» team