Blacklisted: MATCH, and Why the TMF Is Not the Same Thing
- MATCH is a shared database of terminated merchants. Land on it and no traditional merchant account will take you for 5 years
- Termination puts you there, not your ratio. A reason code applying at termination makes listing mandatory within five calendar days. Nobody has to warn you first
- Mastercard publishes the numbers. Code 04 is chargebacks over the previous three months above 1.5% of your Mastercard sales, plus USD 5,000 or more in chargebacks. Both, not either
- Code 05 is an 8% fraud-to-sales ratio over the previous three months, plus 10 or more fraudulent transactions of USD 5,000 or more. That's far above the fraud rate your processor chases you about
- Being listed isn't a ban. Mastercard says twice that an acquirer may still board you. Most won't, but that's appetite, not a rule
- You can ask to come off. Mastercard states in writing that you don't need a lawyer
Almost nobody who worries about MATCH ends up on it. Terminating you costs your processor money. So they warn first, and they'd rather you fixed the problem. Merchants get listed when they go quiet. A ratio that wobbles for one month won't do it.
What Is MATCH?
Mastercard runs the database. It's MATCH, the Member Alert to Control High-risk Merchants. The current rules brand it MATCH Pro.
Visa's TMF (Terminated Merchant File) is a different animal. Most pages get this wrong. The TMF is a file your acquirer keeps on you. That's Visa Core Rules 10.10.1.1. Merchant agreement, deposit history, correspondence, program reports. Visa's shared screening database is VMSS, the Visa Merchant Screening Service. Rule 10.17 covers that one separately.
Your processor will use the two names interchangeably. Fine. They're still separate systems, and even the clocks differ. Visa's clock starts at notice of intent to terminate. The listing is due one business day later. Mastercard gives your acquirer five calendar days from the decision.
Your processor adds you to MATCH for certain terminations. Every acquiring bank checks it before onboarding a new merchant. If you're on it, most legitimate processors won't touch you.
Think of it as the credit report for merchants. Except there's no score, just a scarlet letter.
The 11 MATCH Reason Codes
Your processor must specify why they're adding you. Each reason code tells future processors what happened.
| Code | Reason | Duration | How Common |
|---|---|---|---|
| 01 | Account Data Compromise | 5 years | Rare |
| 03 | Transaction Laundering | 5 years | Rare |
| 04 | Excessive Chargebacks | 5 years | Very Common |
| 05 | Excessive Fraud | 5 years | Common |
| 06 | Coercion | 5 years | Rare |
| 08 | Mastercard Questionable Merchant Audit Program | 5 years | Rare |
| 09 | Liquidation/Insolvency | 5 years | Uncommon |
| 10 | Violation of Standards | 5 years | Uncommon |
| 12 | PCI Data Security Standard Noncompliance | 5 years (early removal possible with PCI certification) | Uncommon |
| 13 | Illegal Transactions | 5 years | Rare |
| 14 | Identity Theft | 5 years | Rare |
Source: Mastercard, Security Rules and Procedures - Merchant Edition, 3 February 2026, section 11.14.1, Table 11.4, p.155.
Most of the internet still publishes the old fourteen.
Codes 02, 07 and 11 no longer exist. Common Point of Purchase folded into code 01 instead. That definition now ends "(i.e., Common Point of Purchase [CPP])". Fraud Conviction and Merchant Collusion were deleted outright.
Code 06 was "Reserved for Future Use" through the 6 August 2024 edition. It's Coercion now.
Code 03 is Transaction Laundering, not "Laundering". Its definition now ties to the merchant agreement. Code 09 dropped "Bankruptcy" and is just Liquidation/Insolvency. Code 08 is spelled out rather than abbreviated to QMAP.
The change landed in the 11 February 2025 edition. The 3 February 2026 one keeps it. If a page shows you 14 codes, it's quoting a dead rulebook.
Mastercard also adds listings itself. It uses codes you won't find in Table 11.4. Chapter 8 has 00 Questionable Merchant/Under Investigation, 20 Mastercard Questionable Merchant Audit Program, and 24 Illegal Transactions. You can sit under code 00 during an investigation. No termination, and no acquirer decision behind it.
For most SMBs, codes 04 and 05 are the threat. Excessive chargebacks and excessive fraud put small businesses on MATCH.
What Triggers MATCH Listing
Termination triggers it. Not the ratio.
Section 11.5 (p.149) is blunt about this. Say either side moves to end the acquiring relationship. A Table 11.4 condition applies at that moment, or the acquirer has reason to believe one does. Then the acquirer must add you to MATCH Pro within five calendar days. The ratio is the gate. Walking out the door opens it.
That cuts both ways. Section 11.4, item 8 is the half nobody ever quotes. A reason code "must be met or suspected (at decision to terminate) to justify a MATCH Merchant addition". Acquirers who use or threaten MATCH "as a collection tool for minor MATCH Merchant discretionary activity may be subject to a noncompliance assessment". So an acquirer who terminates you at 0.95% can't lawfully list you under code 04. You're under the floor. Item 9 of the same list runs the other way. Fail to list a merchant who does qualify, same assessment.
It's mandatory both ways. Your processor doesn't get to decide.
Reason Code 04, Excessive Chargebacks
Mastercard publishes this one in full. Table 11.4, verbatim:
With respect to a MATCH Merchant reported by a Mastercard Acquirer, the aggregate number of Mastercard chargebacks over the previous three months exceeded 1.5% of its Mastercard sales Transactions in that month, and those chargebacks equaled or exceeded USD 5,000 in total.
Two conditions, not one. 1.5% and USD 5,000. A small merchant can sit well above the percentage for months. They may still never clear the dollar floor.
The denominator is Mastercard only. Not your total card volume, not Visa, not Amex. Say Mastercard is a quarter of your sales. You can be far over 1.5% there while the blended dashboard looks calm. Table 11.4 draws no line between credit, debit, prepaid, card-present or card-not-present. Mastercard chargebacks over Mastercard sales, full stop.
One carve-out worth knowing: American Express acquirers report under ICA 102 through 125. For them, code 04 reads "exceeded the chargeback thresholds of American Express, as determined by American Express". No number. Entirely their call. The published 1.5% covers Mastercard-acquired merchants and nobody else.
Before February 2025 the test read differently: 1% in any single month, plus USD 5,000. Terminated before then, you were judged on the old single-month rule.
Read code 04 again, exactly as printed. "The aggregate number of Mastercard chargebacks over the previous three months exceeded 1.5% of its Mastercard sales Transactions in that month."
Three months of chargebacks. Divided by one month of sales. Nobody can compute that.
It happened in the February 2025 rewrite. The old text read "in any single month exceeded 1% of the number of Mastercard sales Transactions in that month". Someone stretched the numerator out to three months. "In that month" stayed in the denominator. Code 05 carries the same scar. "Fraud-to-sales dollar volume ratio was 8% or greater than the previous three months" isn't a sentence. Both errors have now survived two consecutive annual editions.
So here's the honest answer, the one no vendor hands you. The number is published: 1.5%, USD 5,000, three-month lookback. The formula isn't. Read literally, code 04 is arithmetically incoherent. Read charitably, it's three months over three months. That charity is ours, not Mastercard's. Got a clean code 04 calculator from a vendor? Ask which denominator it used. It picked one. Mastercard didn't.
Our estimate: when a processor actually pulls the trigger
Everything in the next table is our estimate, not a published standard. Mastercard's number says when a listing is permitted. It says nothing about when your processor decides to terminate. Termination is the event that starts all of this.
| Scenario | Likelihood of termination (our estimate) |
|---|---|
| One month at 0.95% ratio | Low - warning issued |
| Two months at 1.2% ratio | Medium - remediation required |
| Three or more months over 1.5% ratio | High - termination likely |
| Breach with no improvement after remediation | Very High |
| Ignoring processor warnings | Very High |
Read that as processor behavior and nothing else. A merchant at 1.2% is being watched. That same merchant isn't listable under code 04. They haven't cleared 1.5% on Mastercard volume with USD 5,000 in chargebacks behind it.
Processors don't want to MATCH you. Every terminated merchant is lost revenue. They'll work with you if you show effort. The merchants who get listed are typically those who:
- Ignored warnings
- Failed to implement remediation plans
- Showed no improvement over 3+ months
- Had ratio spikes above 2-3%
Reason Code 05, Excessive Fraud
This one's published too. The number is nothing like what merchants are told to fear. Table 11.4, verbatim:
The MATCH Merchant effected fraudulent Transactions of any type (counterfeit or otherwise) meeting or exceeding the following minimum reporting Standard: the MATCH Merchant's fraud-to-sales dollar volume ratio was 8% or greater than the previous three months, and the MATCH Merchant effected 10 or more fraudulent Transactions equal to or greater than USD 5,000 in the previous three months.
8%. Three conditions stacked: the ratio, 10 or more fraudulent transactions, and USD 5,000.
You'll see 0.9% and 1.5% printed under code 05. That's wrong, and it's the most common error on the subject anywhere. Those are processor tolerance numbers, and they belong to VAMP and ECM. Code 05 sits five to nine times higher. A merchant at 1.5% fraud has a real acquirer problem. Their network programs will notice too. Under code 05 they're nowhere close.
Other Common Triggers
PayFac terminations: A PayFac can list you the same way. Stripe, Square and PayPal can all do it when they terminate your account. Usually under Code 04 (excessive chargebacks) or Code 05 (excessive fraud). PayFacs tolerate less risk, because they're aggregating many merchants.
Code 10 (Violation of Standards): Selling prohibited products, misrepresenting your business, processing for someone else. Code 10 carries no number at all. That's exactly why an acquirer reaches for it. Being under the 1.5% floor stops code 04. It doesn't stop code 10.
How Long You Stay on MATCH
Five years, and Mastercard publishes that too. Section 11.10, p.153:
MATCH Merchant records remain on the MATCH Pro system for five years, at which point they are automatically purged from the MATCH Pro system.
Searches look back five years (11.6.1). Inquiry records are kept 365 days.
| Reason Code | Duration | Early Removal Possible? |
|---|---|---|
| 01, 03-06, 08-10, 13-14 | 5 years | Yes, by request through the acquirer that listed you |
| 12 (PCI) | 5 years | Yes, on achieving PCI compliance certification |
You can ask to come off, and you don't need a lawyer
Mastercard's own rules say so. Section 11.5.1, p.149:
Any MATCH Merchant may contact an Acquirer regarding a request to be removed from MATCH Pro. For the avoidance of doubt, there is no requirement for a MATCH Merchant to engage legal counsel regarding a request to be removed from MATCH Pro.
Mastercard wrote that second sentence on purpose. Consider who benefits from it staying obscure.
The request needs four things:
- Current and/or previous merchant name
- Current and/or previous merchant address
- Principal owner's first and last name
- Merchant website URL, if you have one
That's a letter, not a retainer.
What your acquirer owes you:
| Obligation | Deadline | Rule |
|---|---|---|
| Respond to a removal request | 30 calendar days | 11.4, item 1 |
| Answer your questions about the listing | 7 calendar days | 11.4, item 2 |
| Give you the listing ICA and the reason code | On request | 11.4, item 10 |
Mastercard removes a listing when the acquirer reports it was added in error (11.13). For code 12, PCI noncompliance, you can go direct to Mastercard. Email MATCHPro.help@mastercard.com if your acquirer won't file.
In the EEA or California you have a second lever. Appendix F.5 (p.225) confirms that GDPR rights apply to MATCH data. Access, rectification, erasure, portability, restriction and objection. CCPA rights to know, correct and delete come with it. Mastercard puts the work on your acquirer. They're "responsible for addressing the requests regarding the rectification or correction and erasure or deletion of Personal Information".
None of this makes removal easy. Your acquirer still has to agree it was an error. Most of the time they won't. But "no appeal, hire a lawyer" isn't what the rulebook says.
What Happens After MATCH Listing
Immediate Effects
- Your current processing stops. Accounts are closed.
- Reserves are held. Usually 6 months, sometimes longer.
- Pending payouts may be delayed. Until chargeback exposure passes.
Finding a New Processor
Mastercard says this twice, in section 11.2 (p.146) and again in 11.6.4. Lawyers write like this when they're tired of being misquoted: "For the avoidance of doubt, an Acquirer may onboard a Merchant (and a Payment Facilitator may onboard a Sponsored Merchant) listed in MATCH Pro."
The rule permits your rescue. The market usually declines it. Those are different sentences. Every page calling MATCH a five-year death sentence is describing acquirer appetite dressed up as a rule. Below is appetite.
You have three options:
| Option | Reality |
|---|---|
| Legitimate processors | Will almost always decline you. They all check MATCH, and a listing is a hard no at most underwriting desks. |
| High-risk specialists | Will consider you, at a price. |
| Cash only | Always available, but limits growth. |
High-Risk Processor Terms
If you go the high-risk route, expect:
| Term | Typical Range |
|---|---|
| Discount rate | 4-10% (vs. 2.5-3% for normal merchants) |
| Per-transaction fee | $0.25-0.50 (vs. $0.10-0.30) |
| Rolling reserve | 10-20% held for 6+ months |
| Monthly minimum | $25-50 |
| Chargeback fee | Above the $0-30 mainstream merchants pay, but no high-risk acquirer publishes a number |
| Setup fee | $0-500 |
High-risk acquirers don't publish rates. Treat every row here as a planning range. It's built from merchant reports, not verified figures. One number you can check is the mainstream comparison. Published US dispute fees at ordinary processors top out at $30. Most sit at $15 (verified table). Whatever a high-risk acquirer quotes above that, you're paying for the listing. Get it in writing before you sign.
Math check: $50k/month at 2.9% costs you ~$1,450 in processing. At 7% high-risk, you'd pay ~$3,500. That's $2,000/month extra, or $24,000/year.
Avoiding MATCH
Monitor Before You're in Trouble
Set your own line far below the network and processor limits:
| Metric | Where the line actually sits | Your internal threshold |
|---|---|---|
| Chargeback ratio | Visa VAMP flags a merchant at 1.5%, and only once you're also over 1,500 disputes in the month. Most processors set a house limit far lower, commonly around 0.9% | 0.65% |
| Monthly dispute count | Mastercard ECM needs 100-299 disputes and a 1.50-2.99% ratio in the same month. Both, not either. HECM starts at 300 and 3.00% | 50 |
| Fraud ratio | Processor-set, not network-set. 0.9% is the usual trigger. MATCH code 05 doesn't bite until 8% | 0.5% |
MATCH is the exception here, and it's the good kind. Codes 04 and 05 are published in full. We quote them verbatim above, with a section and page number.
The monitoring programs aren't. Section 8.3 of that same 2026 manual defines ECM and HECM. Then it defers every actual number to "Edit 2 in Chapter 8 of the Data Integrity Monitoring Program manual". That manual isn't public, and Visa publishes no VAMP thresholds either. So every ECM, HECM and VAMP number above came from acquirer notices. Ours included. Treat those as the going rate. Then ask your own processor for the numbers in your agreement. Those are the ones that can terminate you.
When you hit your internal threshold, start remediation. Don't wait for processor warnings.
Respond Immediately to Processor Warnings
When your processor sends a warning email:
- Reply within 24 hours. Silence looks like you don't care.
- Acknowledge the problem. Don't make excuses.
- Commit to a remediation plan. Be specific about actions and timelines.
- Ask what they need. "What would you need to see to be comfortable?"
Submit a Real Remediation Plan
Your plan should include:
| Element | What to Include |
|---|---|
| Root cause | Why chargebacks/fraud increased |
| Immediate actions | What you did in the first 48 hours |
| Short-term fixes | Changes this week (alerts, refund policy, etc.) |
| Long-term fixes | Systemic changes (product, process, policy) |
| Metrics commitment | "We expect to reach X% by [date]" |
| Reporting cadence | "We'll report weekly progress" |
Negotiate a Voluntary Exit
Termination's coming and you can't turn it around? Try negotiating:
Ask: "If we wind down processing voluntarily over 30 days, would you consider not listing us on MATCH?"
Some processors will agree to this because:
- It's less paperwork for them
- They avoid potential disputes
- You're showing good faith
This only works if:
- You're not egregiously over threshold
- You have no fraud indicators
- You're communicating proactively
- You haven't been deceptive
If You're Already on MATCH
Step 1: Confirm the Listing
There's no self-service lookup. You can't query MATCH yourself.
You can make the acquirer who listed you hand it over. Section 11.4, item 10 requires the listing ICA and the reason code. Ask them in writing:
- "What reason code did you list us under?"
- "What is the listing ICA?"
- "What is the listing date?"
They owe you an answer within 7 calendar days. Processors declining you may confirm a listing exists, so ask. But the acquirer who listed you is the one on the hook.
Step 2: Contact the Listing Processor
Reach out to the processor who listed you:
- Request documentation of why you were listed
- Ask about reserve release timeline
- File a removal request if the listing is wrong (30 calendar days for their response, and no lawyer required)
Step 3: Evaluate Your Options
Step 4: If Using High-Risk Processor
- Read the contract carefully. High-risk processors have stricter terms.
- Understand reserve terms. When do you get your money?
- Get chargeback thresholds in writing. They may be lower than you had before.
- Budget for the extra cost. Price your products accordingly.
Step 5: Plan for Life After MATCH
In 5 years, you'll be off the list. Prepare:
- Maintain clean processing records with high-risk processor
- Document your remediation and performance
- Build relationships for when you can return to normal processing
When to Get a Lawyer
Not for a removal request. Mastercard says so in the rules (11.5.1). A lawyer adds cost to that letter without adding leverage.
Legal help makes sense when:
| Situation | Why Legal Help |
|---|---|
| Erroneous listing | You were listed incorrectly |
| Processor breach | They didn't follow their own policies |
| Reserve disputes | They won't release your money |
| Contract violations | Either party |
| Significant losses | Business damage from wrongful listing |
Cost reality: Payment processing lawyers typically charge $300-600/hour. A dispute can cost $10,000-50,000+. Only worth it for significant errors or losses.
Test to Run
MATCH avoidance health check:
| Check | Action |
|---|---|
| Current ratio | Calculate today. Are you under 0.65%? |
| Trend | Compare last 3 months. Improving or worsening? |
| Processor relationship | When did you last communicate proactively? |
| Alert coverage | Do you have RDR/Ethoca/CDRN active? |
| Internal thresholds | Have you set warning thresholds below network limits? |
If you're above 0.65%: Start the Zero Point Nine Panic remediation now, before it's a crisis.
Scale Callout
| Volume | MATCH Risk Profile |
|---|---|
| Under $50k/mo | Low transaction count means a few chargebacks spike your ratio fast. Monitor closely. |
| $50k-$500k/mo | Most at-risk range. High enough to attract attention, not high enough to absorb losses. |
| Over $500k/mo | Processors work harder to keep you. More negotiating room, but bigger reserves if you breach. |
| PayFac merchants | Lower threshold for termination. Stripe/Square/PayPal have less patience than traditional acquirers. |
Where This Breaks
-
PayFac terminations. PayFacs (Stripe, Square, PayPal) can list you faster and with less warning than traditional processors. If you're on a PayFac and having issues, move to a traditional processor before termination.
-
Fraud you didn't cause. If you're a victim of a fraud attack, document everything. Ask your processor to note the circumstances if they must terminate.
-
Industry-wide issues. Some industries have structurally high chargeback rates (travel, supplements, subscriptions). Consider high-risk processors from the start.
-
Multiple MCCs. If you're processing under the wrong MCC code and get caught, that's a standards violation (code 10). Make sure your MCC matches your actual business.
Analyst Layer: Metrics to Track
| Metric | What It Tells You | Action Threshold |
|---|---|---|
| Days since last processor warning | Relationship health | If > 90 days, reach out proactively |
| Ratio trend (30/60/90 day) | Trajectory | Any upward trend = investigate |
| Distance to threshold | Risk buffer | Under 0.25% buffer = crisis mode |
| Chargeback reason code distribution | Root cause | Shift in distribution = new problem |
| Reserve balance | Cash flow exposure | Track what's held and release dates |
Early Warning Dashboard
Track weekly:
Chargeback ratio: [___]% (target: < 0.65%)
Distance to threshold: [___]% (target: > 0.25%)
Trend: [UP/DOWN/FLAT]
Chargebacks this month: [___] (target: < 50)
Alert coverage: [YES/NO]
Last processor contact: [___] days ago
Next Steps
Not on MATCH but worried?
- Calculate your current ratio → Chargeback Metrics
- Set up alerts → Setup Dispute Alerts Playbook
- Review your risk profile → Zero Point Nine Panic
Processor sending warnings?
- Respond immediately → Acknowledge and commit to action
- Build remediation plan → Use the template above
- Enable all deflection tools → Chargeback Alerts
Already on MATCH?
- Get the reason code and listing ICA → Ask the acquirer who listed you, they owe you both
- File a removal request if it's wrong → Four facts, 30-day response
- Explore high-risk options → Search "high risk merchant account [your industry]"
- Consider non-card alternatives → ACH, cash, invoicing
Sources
| Source | What it gave us | Kind | Date |
|---|---|---|---|
| Mastercard Security Rules and Procedures, Merchant Edition | The 11-code Table 11.4 (11.14.1, p.155), the verbatim code 04 and code 05 standards, the five-day listing duty (11.5), the removal process and the no-lawyer sentence (11.5.1), acquirer obligations (11.4), five-year retention (11.10), error removal and the code 12 route (11.13), "an Acquirer may onboard" (11.2 and 11.6.4), ECM/HECM deferral (8.3), Mastercard's own codes 00/20/24 (8.4.2, 8.4.6, 8.6.6), and privacy rights (Appendix F.5) | Primary, Mastercard's own published rules | Edition dated 3 February 2026, accessed 2026-08-02 |
| Mastercard Security Rules and Procedures, Merchant Edition, earlier editions | Dating the change. The 11 February 2025 edition already carries the 11-code table and the 1.5% test. The 22 February 2022, 7 February 2023, 6 February 2024 and 6 August 2024 editions all carry 14 codes, "Reserved for Future Use" at code 06, and the old "1% in any single month" code 04 | Primary, archived via the Wayback Machine | Accessed 2026-08-02 |
| Visa Core Rules and Visa Product and Service Rules | That the TMF is an acquirer-held file (10.10.1.1, ID# 0007371), that VMSS is the shared database (10.17), the one-business-day listing requirement, and that Visa publishes no numeric TMF standard at all | Primary, Visa's own published rules | 18 October 2025, V1.1 Visa Public edition |
Last verified: 2 August 2026.
See Also
- Zero Point Nine Panic - Crisis response before MATCH
- Network Programs Reference - VAMP, ECM thresholds
- Chargeback Metrics - Calculating your ratio
- Reduce Chargebacks Fast - Immediate triage
- Chargeback Alerts - RDR, Ethoca, CDRN
- Processor Management - Relationship management
- Holds and Reserves - Understanding reserves
- Buying Payments - Processor selection
- Fraud Prevention - Reducing fraud-based terminations
- PCI DSS Compliance - Avoiding code 12 listings