FSA Debit Cards: How They Work

FSA debit cards give flexible spending account holders a direct payment mechanism for qualified medical expenses, eliminating the need to pay out-of-pocket and wait for reimbursement. This page explains how the cards function mechanically, what governs their approval logic, and where the system's boundaries create friction for account holders. Understanding these mechanics is essential for avoiding declined transactions and potential compliance issues with IRS rules.

Definition and scope

An FSA debit card is a stored-value payment card — typically issued on the Visa or Mastercard network — linked directly to a health care flexible spending account. The card draws funds from the pre-tax FSA balance rather than a personal bank account. The card issuer is generally a third-party administrator (TPA) contracted by an employer to manage FSA benefits under IRS rules governing FSAs.

The scope of eligible cards covers two primary account types:

Dependent care FSAs also issue debit cards in some plan configurations, though dependent care expenses carry different substantiation requirements and the cards function with greater merchant restrictions.

The legal framework governing FSA debit card substantiation comes primarily from IRS Revenue Ruling 2003-43 and subsequent IRS Notice 2006-69, which established the conditions under which card transactions can be treated as automatically substantiated without additional documentation from the cardholder.

How it works

When an FSA debit card is swiped, inserted, or tapped at a merchant terminal, a real-time approval process runs through at least three verification layers before funds are released.

Step 1 — Merchant category code (MCC) screening
Every merchant terminal broadcasts a four-digit MCC assigned by the card network. The card processor checks the MCC against an approved list. A pharmacy (MCC 5912), a hospital (MCC 8062), or an optician (MCC 5995) will pass this screen. A grocery store (MCC 5411) will generally fail unless the specific item qualifies under the inventory information approval system (IIAS).

Step 2 — IIAS matching at eligible retailers
Merchants that sell both FSA-eligible and non-eligible items — pharmacies and grocery stores with pharmacy departments — are required under IRS Notice 2007-2 to implement IIAS. At IIAS-enabled registers, the point-of-sale system scans each item and automatically separates FSA-eligible products from ineligible ones. The card charges only the eligible subtotal; the cardholder pays the remainder through another method. This system covers approximately 90% of pharmacy transactions in the United States, according to the Inventory Information Approval System standards administered by SIGIS (Special Interest Group for IIAS Standards).

Step 3 — Balance verification
After MCC and IIAS checks pass, the processor confirms that sufficient FSA funds exist. FSA plans are front-loaded: the full annual election amount is available on the first day of the plan year, even though payroll contributions arrive incrementally (FSA Contribution Limits). This means a card can approve a $1,800 purchase in January even if only $150 has been deducted from payroll so far.

Step 4 — Post-transaction substantiation
If a transaction is not auto-substantiated by IIAS or MCC rules, the TPA sends the cardholder a request for documentation — typically an Explanation of Benefits (EOB), an itemized receipt, or a provider statement. Failure to respond can result in the transaction being classified as an unsubstantiated non-qualified expense, which may trigger a card suspension or a requirement to repay the funds.

The full regulatory background for how these substantiation requirements interact with employer plan design is covered at the regulatory context for health savings reference section of this network.

Common scenarios

Scenario A — Prescription pickup at a pharmacy (IIAS-enabled)
The transaction auto-approves based on the prescription's item-level scan. No additional documentation is required. This is the lowest-friction FSA card use case.

Scenario B — Doctor's office copay
Most medical provider offices use MCCs that pass the initial screen. However, if the amount charged does not match any known copay amount in the plan record, the TPA may still request an EOB. Copay matching — where the card approves amounts equal to standard plan copay increments ($20, $30, $40, etc.) — is one of the three auto-substantiation methods outlined in IRS Notice 2006-69.

Scenario C — Over-the-counter (OTC) medication
The CARES Act of 2020 permanently removed the prescription requirement for OTC drugs and menstrual care products under IRC §223(d)(2)(A) (Public Law 116-136). FSA cards at IIAS-enabled merchants now approve these items at the register without a prescription.

Scenario D — Dental or vision purchase
Standard health care FSA cards cover dental and vision. Cardholders should verify the merchant's MCC — some vision centers operate under retail MCCs rather than medical MCCs, which can trigger a decline at non-IIAS terminals.

Scenario E — Ineligible purchase
If a cardholder uses the card for a non-qualified expense, the TPA will request substantiation. If none is provided, the employer plan may require repayment. The FSA claims and reimbursement process covers the resolution steps in detail.

Decision boundaries

Not all FSA card declines signal a prohibited purchase. The card system produces false negatives — legitimate expenses declined due to MCC mismatches — and can produce false positives at non-IIAS retailers where ineligible items slip through an incomplete item scan.

FSA card vs. manual reimbursement: when each applies

Factor FSA Debit Card Manual Reimbursement Claim
Merchant type IIAS or MCC-approved Any provider or retailer
Speed Immediate 3–15 business days typical
Documentation Often auto-substantiated Always required
Risk of error MCC or IIAS mismatch Incorrect expense category submission
Best use case Pharmacies, providers Reimbursable amounts already paid OOP

Two structural limits determine when a card stops working:

  1. Plan year boundary — FSA funds are tied to a plan year. A card configured for a January–December plan year will decline in January of the following year for the prior-year balance unless the plan offers a grace period or carryover (see FSA grace period vs. carryover).

  2. Use-it-or-lose-it rule — Unspent FSA funds generally forfeit at plan year end under the statutory forfeiture rule, though IRS modifications allow employers to offer one of two relief options: a 2.5-month grace period or a $640 carryover (the 2024 limit per IRS Revenue Procedure 2023-34). The card itself will not warn the cardholder of approaching forfeiture; that responsibility falls to the TPA's notification systems.

Card-level controls also vary by employer plan design. Some plans restrict the card to specific expense categories; others set per-transaction dollar limits. Cardholders can verify these parameters through the TPA's account portal or by reviewing the Summary Plan Description (SPD) required under ERISA.

For a full orientation to how FSAs fit within the broader landscape of tax-advantaged health accounts, the home page provides a structured entry point to all account types covered on this site.

References

The law belongs to the people. Georgia v. Public.Resource.Org, 590 U.S. (2020)