Sponge is built for AI agents, not for daily shopping

Updated October 2026

Licensed

Available in US

Fast payouts

18+ Only

Sponge is a virtual Visa card that developers wire into software — most often so that an AI agent can pay for things on its own. It draws on USDC held as collateral in a Sponge wallet, it is created through a command-line tool or an SDK rather than an app, and the public pages are silent on almost everything a normal cardholder would ask first: which countries are served, what it costs, what the limits are, how disputes work. That silence is the story of this review. Sponge is a real product with a real issuer and a real card network behind it, but it is aimed at a different reader than the one most people searching “Sponge card review” are. I scored it 4.9 out of 10 — and the reason it does not sit lower is that for its actual audience, the narrow job it does well is a real job.

The conditions described here are current as of October 28, 2026.

Verdict: 4.9 out of 10

The score is not a verdict on a scam. It is a verdict on a product that solves one specific problem well and leaves almost every other question unanswered in public.

Let me show my working, criterion by criterion, because where a card is silent matters as much as where it is strong.

Total: 4.9 / 10.

Who this suits: a developer who wants an AI agent to hold a Visa card it can spend from without handing over a personal bank account, and who is comfortable living inside a CLI. If that is you, the narrow feature — a card number and CVC returned encrypted, USDC collateral loaded by command, spending power that follows the collateral — is genuinely useful.

Who it does not suit: almost everyone else. If you want a card in your pocket, a country list to check your name against, a known monthly fee, an Apple Pay wallet, cash withdrawals, or someone to call about a disputed transaction, none of that is published here. The absence is not a warning sign on its own, but it does mean you are buying on trust rather than on terms.

Who they will give the card to

They do not say. There is no country list on the card pages, and the platform terms set only a minimum age of 13 for the service. Citizenship rules, residence rules, excluded jurisdictions — none of it appears in public.

I want to be plain about what that means for you. Every crypto card makes a bet about which countries it will serve, and every card that serves a broad list tells you the list. When there is no list, the practical consequence is that you cannot pre-check your own eligibility. You may well qualify; you may find out at the KYC step, after you have given your details.

That also means I cannot tell you whether Sponge works in your country, and I am not going to guess. Treat “not stated” as not stated: the card’s public pages do not say.

How to get it

There is no app and no application form to fill in by hand. The whole flow runs through the command line or the SDK.

You start a hosted KYC flow from the CLI/SDK with a redirect URI, and once you are approved you move on to the issuer application. During that stage you supply your occupation (or an SOC code) and give consent on several counts — E-Sign, the account-opening privacy notice, the Sponge Card terms, an accuracy declaration, and a non-solicitation acknowledgement. Creating the card itself needs a billing address in a specific shape: line1, city, region, postal_code and country_code, plus your email and phone.

The card that comes out is virtual, created by createSpongeCard. The homepage describes it as a credit card issued by Rain, a Visa Principal Member, accepted wherever Visa is accepted.

Two things you should notice about this flow, and neither is a criticism of Sponge — they are what it is. First, it is built for integration. If you are not comfortable with a command line and a redirect URI, this is a bad first crypto product. Second, what documents you need and what minimum age the card itself requires are not stated on the public pages, even though the platform terms mention 13 for the service.

The docs describe a single hosted KYC and a single issuer application — there are no tiers of verification to choose between, and nothing on the page tells you which level you will land on.

Fees: what it really costs

Here is the honest part of this review. The card’s public pages do not state the cost of issuance, the fees, the ATM terms or the limits. I cannot invent them, and I will not estimate them.

What you do learn about how value moves is this: the spending is backed by USDC collateral, and the card’s status endpoint reports spending power that the collateral determines. In other words, your spending limit is not a fixed number set by the issuer — it moves with what you have loaded. There is no published ceiling, so the real ceiling is your own balance, plus whatever the issuer’s undocumented rule turns out to be.

Let me put that to three everyday payments and ask which fees would bite, if any.

A coffee in your own country. You pay in local currency from a card backed by USDC. The conversion from USDC to your currency happens somewhere in the chain, and the card does not say what it charges for it. If there is a conversion fee, it is here. If there is an FX fee, this is where it applies too, because your local currency is not the dollar. I cannot tell you the rate or the number.

A subscription bought online. Same conversion, plus the usual online-payments layer. A four-digit merchant category code classifies the business, and gambling (MCC 7995) is a category many issuers block by policy. The card does not publish its blocking list. Expect friction in the same places any prepaid or foreign-issued card meets a cautious merchant: address verification, which is mostly offered in the US, Canada and the UK and is generally unavailable for foreign-issued cards, so a decline is not unheard of. And a declined authorisation can leave a hold on your funds for several days.

Cash from an ATM. I cannot tell you whether this works. ATM withdrawal terms are not stated, and the everyday-use picture does not mention an ATM at all. Treat cash as out of scope until you have read the terms yourself.

The honest conclusion: you cannot budget this card from public information. Anyone who quotes you a fee for Sponge is quoting something that is not on its pages.

How to top it up

Top up means moving USDC collateral from the Sponge wallet into the card, using card fund. The example chain is base; the SDK mentions base or solana as an optional chain. No other coin is offered — it is USDC or nothing.

That is a much narrower door than most crypto cards. Here is what the background helps to explain. USDC is a US-dollar-pegged stablecoin, and it is the kind that can move on many networks — Circle lists USDC as natively supported on 38 networks as of 16 September 2026, including Ethereum, Solana, Base, Polygon PoS, Avalanche, Arbitrum and Stellar. Sponge is letting you in through two of them.

The practical rules that come with any such transfer:

• On-chain network fees are charged by the blockchain, not by Sponge. Sending on Ethereum will cost more than sending on base, and the difference is not Sponge’s to refund.
• The transfer has to go on a network the provider supports. Send on the wrong network, or to an address of another network, and the funds can be lost or need manual support recovery with no guarantee — blockchain transfers are irreversible.
• Minimums and fees for card fund are not published.

Getting money back out works the other way round: card withdraw returns your USDC collateral to the wallet, to two decimal places. Fees for that are not stated either.

Paying with it every day

Daily use is where this card is weakest, and the score reflects it. It is virtual only. There is no physical card described in the docs; whether physical delivery exists is not stated.

There is no consumer app. You use it through the CLI (npx spongewallet), the SDK, or MCP — which is another way of saying an AI agent can use it. Store ratings do not apply, because there is no store.

So the familiar things people ask about a card are simply absent from the picture:

• Apple Pay / Google Wallet. Not disclosed. You cannot assume the card can be added to a phone wallet.
• ATM. Not disclosed.
• Recurring payments and subscriptions. Nothing on the page describes how a stored-balance card behaves when an automatic charge hits an empty balance.
• Rewards or cashback. Not stated.
• Wallets behind the funding. Not stated.

None of that means these features are missing — it means they are not on the page, and I am not going to describe features I cannot confirm.

What can go wrong

The risks here are of two kinds: the ordinary risks of this category, and the specific risks of a card with no published terms.

On the company and the card itself. Sponge Inc. appears in the footer, and it is listed as “Sponge (YC W26)” in the starting data — a Y Combinator company, which is a signal of stage, not of financial strength. The card is issued by Rain, described as a Visa Principal Member; the issuing bank is not named and the terms are governed by US law. Licences are not stated. That combination — a named issuer, an unnamed bank, no licence information — means you cannot verify the licence the way you would verify an EMI in the EU’s register.

On complaints. No official incidents are published, and a search turned up no user reports or news stories (2026-10-21). There is no Trustpilot page or review page either. Read this carefully: the absence of complaints here is not evidence of a clean track record. It is mostly evidence that almost nobody outside the intended developer audience has used this card yet.

On security. The card number and CVC come back encrypted with a one-time secret key, and the docs tell you to treat them as secrets — do not log them, do not persist decrypted values. That is a sensible instruction and it also tells you something important: your card credentials exist in decrypted form somewhere in your pipeline at some point. The custody model, two-factor authentication and freeze controls are not stated, so I cannot tell you what happens if someone gets hold of that secret.

On the category’s baseline risks. A payment card number starts with a 6- or 8-digit issuer identification number that any merchant can look up, and merchants may apply extra scrutiny when the issuer country differs from the billing address. A card issued in one country can look foreign to a shop in another. Some merchants decline prepaid or foreign BINs for exactly that reason. And if you send funds on an unsupported network, or to an address of the wrong network, blockchain irreversibility means support recovery is a hope, not a right.

On the bigger picture. Programme closures happen in this industry. WaveCrest, a Visa card issuer that supplied crypto card brands, was suspended by Visa in Europe in 2018, closing all its Visa programmes. In November 2022 Visa said it had terminated its global agreements with FTX, and the FTX US debit card was wound down by its issuer. A closure typically means a notice period, then spending and loading stop, then you are asked to withdraw what remains.

What to take instead

If Sponge’s core idea appeals to you — a card your own code, or your own agent, can spend from — then it is worth comparing against cards that have published their terms. Here is where the alternatives stand next to it, on the numbers each has actually published.

The pattern is obvious. Xplace, ether.fi and Nexo all publish their annual fees, their FX fees and their eligible currencies. Sponge publishes none of it. That does not mean Sponge charges more; it means you cannot compare, and in a review that is the finding.

A few differences worth holding in mind as you look:

• Nexo serves residents and citizens of selected European countries including the EEA and the United Kingdom; no country list appears on the page and excluded jurisdictions are not named. It has no FX surprise on weekdays for EEA/UK/CH holders at 0.2%, 0.7% at weekends. It has a physical card too, but that path is gated: free shipping, yet it needs a balance above $5,000 in digital assets and at least the Gold tier.
• ether.fi issues only in listed jurisdictions, residence-based — a range including Andorra, Argentina, Australia, Austria, Brazil, Canada, Cyprus, Czech Republic, France, Germany, Hong Kong, Hungary, Italy, Japan, Mexico, Poland, Portugal, Singapore, Spain, Switzerland, UAE, UK, plus 31 US states, with Belgium and Ireland eligible without physical delivery. Its own page says that if your jurisdiction is not listed, you cannot apply. Cashback is generous (3% on lower tiers) but paid in ETHFI, locked for 7 days.
• Xplace has the clearest price ladder of the three and states “0% FX on Platinum” and no hidden spread on stablecoin spending, but its country list is not stated and its higher tiers cost real money annually.

Where none of these fit, and you want a card for ordinary life, the sensible comparison is not another crypto card at all — it is an ordinary bank card, and being honest with yourself about why you want this one.

Who I would recommend it to

I would recommend Sponge to exactly one person: a developer building an AI agent that needs to pay for something itself, who wants a USDC-backed Visa card it can hold, and who is at home in a terminal. For that person the card does a real job.

I would not recommend it to someone looking for a first card, someone who wants Apple Pay, someone who plans to travel and pay in local currency, someone who needs cash, or anyone who wants to read a fee schedule before committing. In every one of those cases the missing information is not a detail I can fill in for you — it is simply not published.

If you are still curious, the responsible order is: read the terms yourself, work out what a stablecoin-pegged balance means for your spending power, and treat every cost figure you have seen as unknown until you find it in writing.

Frequently asked questions

What is the Sponge card?

Sponge is a virtual Visa card that draws on USDC collateral held in a Sponge wallet. It is issued by Rain, described as a Visa Principal Member, and the homepage calls it a credit card accepted wherever Visa is accepted. The key thing to understand is that it is built for software: you create it through a command-line tool or SDK, not an app. No physical card is described.

How does the Sponge card work?

You fund a wallet with USDC, then move that collateral to the card with card fund on base or solana. The card’s status endpoint reports spending power that the collateral determines, so what you can spend follows what you have loaded. Card number and CVC come back encrypted with a one-time secret key, and the docs tell you not to log or persist them decrypted.

Is Sponge a bank?

Not on the published evidence. Sponge Inc. is the company behind it — a Y Combinator W26 company — and Rain is the issuer. The card’s terms say Rain is a Visa Principal Member, but the issuing bank is not named and no licences are stated. I cannot tell you which regulatory licence stands behind this card, because the pages do not say.

Who owns Sponge?

Sponge is operated by Sponge Inc., which appears in the site footer and is listed as a Y Combinator W26 company. The card programme itself sits with Rain as the Visa Principal Member. So there are two names to hold on to: Sponge, which runs the wallet and the developer-facing product, and Rain, which issued the card.

Is the Sponge card available in my country?

I cannot answer that, and neither can the card’s public pages. There is no country list, no eligibility rule and no list of excluded jurisdictions on the pages I checked. The platform terms set only a minimum age of 13 for the service. If you need to know before you apply, the terms are the only place to look.

Does the Sponge card require KYC?

Yes. You start a hosted KYC flow from the CLI or SDK with a redirect URI, then move to the issuer application after approval. That stage collects your occupation or SOC code, consent on several counts, and a billing address, email and phone. Which documents are accepted and what minimum age the card itself requires is not stated.

How do I top up the Sponge card?

You move USDC collateral from your Sponge wallet into the card using card fund, with base as the example chain and solana mentioned as an optional chain in the SDK. No other coin is accepted. Remember that on-chain network fees are charged by the blockchain, not by Sponge, and that sending on an unsupported network can mean lost funds.

Can I use the Sponge card in a wallet like Apple Wallet?

I would not assume so. Apple Pay and Google Pay are not covered anywhere in the public documentation I found, and adding a card number to a phone wallet works differently for a card issued abroad. If a mobile wallet matters to you, treat this as an open question and read the terms before you build a habit around it.

Is the Sponge card free?

The card’s public pages do not state an issuance fee, a monthly fee, a conversion fee or an FX fee — so I genuinely cannot tell you what it costs, and you should not take anyone’s number for it, including mine. What is clear is that spending power tracks your USDC collateral, and blockchain network fees are charged by the network on any transfer you make.

Is the Sponge card safe?

No card is safe and I would not promise it is. The sensible posture: the docs are careful about credentials — encrypted card number and CVC, treat as secret, never logged — but the custody model, two-factor authentication and freeze controls are not described. No official incidents and no user complaints were found, but with a card this new and this developer-facing, a quiet complaint record mostly reflects a small user base, not a spotless history.

Content created by the «cryptocardadvisor» team