Question:

Additional commentary?

It's also important to review exceptions you've made throughout the year that required opening any particular mcc's. There may be some folks that have an mcc that's been added to their account that's blocked for others. I look at all these factors to determine if I should add or block a new code. This is done in concert with a review of policy as there may be things that must be added or removed from our "prohibited transactions" list. Great survey idea - thank you!

Our organization could use some improvement in this area. A policy and having a more consistent audit and review of MCC codes would be ideal. Implementing this and getting buy-in internally from staff would be the most difficult parts, but it is something that's needed to stay on top of fraud and unauthorized spend.

Our provider allows us to have 10 custom MCC groupings which are assigned based on training (e.g., travel & food MCCS). Certain MCCs are restricted and can only be lifted as an exception. We have the ability to review MCCs on the provider web site plus our PCard reconciliation/approving/reporting software also gives us clear insight for when we need to make adjustments.

It would be great to fully understand how MCCs are assigned and by whom. There doesn't seem to be regulation around this, which opens up risk in card programs as unauthorized vendors are often under MCCs that cannot be restricted due to authorized vendors under the same code. In reality, there is another MCC that would fit these unauthorized vendors better that could be blocked, but somehow they get away with being under another MCC.

MCC are only a small clue into spend as they can be misleading since they are set by the supplier.

We review declines daily which provides the employees whose card declines due to an MCC code. This allows us to review daily with employees if the expenses are fraudulent or if we need temporarily open their card to make the purchase as it is within policy, but the MCC code is closed to our cardholders.

both MCC specific training and benchmarks to get it implemented.
We track aggregated numbers for reference

We use the bank's MCC profile that restricts codes for government agencies. We haven't had any unauthorized spend since we switched to this profile.
Previously, we used the opt-in selection for MCCs and the management of these codes was very time consuming.

We monitor declined authorizations and track requests to open MCCs to inform decisions about MCC changes.