Mastercard GMAP: Suspended Since 2020, Reported Back for 2027
- Two different programs share the GMAP acronym, about seven years apart. Which one someone means changes the whole answer.
- The original is suspended. Mastercard's Security Rules and Procedures, Merchant Edition, 4 August 2026 gives section 8.2 one sentence and nothing else. Suspended since 15 October 2020. It never carried fines even when it ran.
- A second, different GMAP is reported for 1 April 2027. Fraud plus disputes, fine ladders, acquirers included. Three industry sources reported it at the end of July 2026. None could cite a bulletin number. Neither can anyone quoting an ECM or HECM figure REPORTED.
- Right now, in between the two, GMAP measures nothing. No merchant has been assessed under it since October 2020.
- Reason code 4849 is a QMAP code, not a GMAP code. Kount, Justt and Chargeback.io all still label it GMAP on live pages. All three are wrong.
- What you're actually measured against today: ECM and HECM for chargebacks, EFM for fraud, VAMP on Visa, and SMMP if you sell card-not-present.
Search GMAP today and you land on acquirer PDFs from 2019. An orphaned Mastercard eLearning module. Three vendors' reason-code libraries calling 4849 "the GMAP chargeback." Every one of them presents a suspended program as if it's running. Nobody publishes the correction, so here it is.
For the live programs, see Network Programs Reference.
The direct answer
GMAP stands for Global Merchant Audit Program. Two different Mastercard programs have carried that name. Seen GMAP described as both dead and coming? That's why. Both statements are true. Different programs, different years.
| The original GMAP | The reported 2027 GMAP | |
|---|---|---|
| Status | Suspended 15 October 2020. Still suspended in the 4 August 2026 rules | Reported for 1 April 2027 REPORTED |
| Measures | Fraud only, as a share of sales | Fraud reports plus non-fraud disputes, combined |
| Applies to | Merchant locations | Merchants and acquirers |
| Consequences | A fraud alert and training. No fines, ever | Fine ladders reported into six figures |
| Verified? | Yes, in Mastercard's own rulebook | No. No bulletin number exists in any source we found |
They share an acronym and nothing else. A fraud-only program with no fines isn't the same thing as a combined fraud-and-dispute program with a fine ladder. The likeliest reading is that Mastercard is reusing a shelved name, not restarting the old program. We can't prove that. Check the next published network update or ask your acquirer for its announcement number.
In the meantime, and that means right now, GMAP measures nothing. The gap between 15 October 2020 and 1 April 2027 is where you're sitting.
The original program comes first here. It's what generates the stale material people land on. Skip to the 2027 program if that's what you came for.
The original program
It was a Mastercard fraud program. It isn't running.
Mastercard's Security Rules and Procedures, Merchant Edition, dated 4 August 2026, cuts section 8.2 to one sentence.
The Global Merchant Audit Program (GMAP) has been suspended until further notice.
That's the entire section. No tiers, no thresholds, no dates. The 2021 and 2022 editions carried the same suspension with a date attached: effective 15 October 2020. Across seven editions in the Wayback Machine's index, the wording never quietly changed back.
No merchant has been measured against GMAP since October 2020. A compliance checklist, an onboarding pack, a reason-code lookup, a vendor deck: if it put GMAP in front of you, it's stale. That's not a judgment about your account. It's a judgment about the document.
Skip to what actually applies.
What GMAP was (history, not a live threshold)
Historical only. Effective 15 October 2020, suspended until further notice. These aren't thresholds anyone is measured against today.
GMAP watched fraud, not chargebacks. It ran three tiers. Each tier needed the fraud count, the fraud dollar amount and the fraud-to-sales ratio met together.
| Tier | Name | Fraud transactions | Fraud amount | Fraud-to-sales ratio | Consequence |
|---|---|---|---|---|---|
| 1 | Informational Fraud Alert | 3 | USD 3,000 | 3% to 4.99% | Notification |
| 2 | Suggested Training | 4 | USD 4,000 | 5% to 7.99% | Training recommendation |
| 3 | High Fraud Alert | 5 | USD 5,000 | 8%+ | Alert and remediation |
GMAP carried no fines. Not at any tier. You got a notification, a training recommendation, and a remediation conversation with your acquirer. Compare ECM, where month 19 costs USD 100,000 a month. Told you're "in GMAP" and bracing for an assessment? There was never an assessment to brace for.
GMAP didn't supersede ECM or HECM. It sat in Chapter 8 under fraud control, separate from the Excessive Chargeback Program. They ran alongside each other, measuring different things. Anyone saying GMAP replaced the chargeback programs is describing a 2027 claim, not a past fact.
Mastercard's eLearning module still sits at mastercard.com/elearning/gmap/story.html, unlinked from anywhere on the site. That's a big part of why the program still looks alive to a search engine.
Reason code 4849 is a QMAP code, not a GMAP code
Mastercard reason code 4849, Questionable Merchant Activity, belongs to QMAP, the Questionable Merchant Audit Program. Not GMAP. In the Chargeback Guide, Merchant Edition, dated 19 May 2026, 4849 is tied solely to QMAP.
QMAP is live. It's a fraud-driven audit needing three of four conditions. One of them is a fraud-to-sales transaction ratio of 70% or greater. No ordinary business gets near that. QMAP targets merchants whose transactions are mostly fraud. It's the one MATCH reason code (08) tied to a named audit program.
Kount, Justt and Chargeback.io all still market 4849 as the GMAP chargeback on live pages. They're wrong. The error is sticky, too. It gets copied into internal runbooks, dispute training and vendor comparison sheets, and it sits there for years.
What to do about it: a 4849 is a QMAP matter. The response looks nothing like a chargeback-ratio problem. Ask your acquirer whether an audit is open on your MID and what evidence they need. Don't go hunting for a GMAP tier to argue about.
What actually applies to you right now
Five programs. Two networks. GMAP isn't one of them.
| Program | Network | Measures | Live thresholds |
|---|---|---|---|
| ECM | Mastercard | Chargebacks | 100-299 chargebacks AND 1.50%-2.99% ratio |
| HECM | Mastercard | Chargebacks | 300+ chargebacks AND 3.00%+ ratio |
| EFM | Mastercard | Fraud | All entry tests must be met; see Network Programs for regional conditions |
| VAMP | Visa | Fraud + disputes combined | Regional ratio, count and acquirer conditions; see Network Programs |
| SMMP | Mastercard | Scam signals | Live since 24 July 2026. No ratio you're graded on, a 72-hour acquirer investigation clock |
Last verified: 2 August 2026.
Mastercard divides this month's chargebacks by last month's transactions. Growing fast? The Mastercard ratio runs hotter than you'd expect, because the denominator is a smaller month. Visa VAMP uses a different numerator too: fraud reports plus disputes over same-month settled CNP transactions, with exclusions. See Network Programs for the formulas.
The umbrella name is ACMP, the Acquirer Chargeback Monitoring Program. ECM, HECM and EFM live inside it. It has no thresholds of its own. It's the chapter, not the program. That's why the reported 2027 story about "retiring ACMP" reads as bigger news than it is.
One merchant-facing ACMP rule is in the Transaction Processing Rules, 9 June 2026, section 5.4.1. For covered subscription merchants, a receipt after each approved authorization becomes mandatory after four months or more of ACMP identification in the same audit period. Exceptions and charity treatment are in 5.4.1.1. Don't apply it to every recurring-payment business. NETWORK Checked 22 October 2026.
Scale Callout
| Volume | Focus |
|---|---|
| Under $100k/mo | Check both your Mastercard chargeback count and ratio. A small transaction count can breach the ratio before reaching ECM's count floor |
| $100k-$1M/mo | Watch count and ratio together. Dollar volume alone doesn't tell you whether 100 chargebacks is likely |
| Over $1M/mo | Ask your acquirer in writing whether they've received anything on a 2027 change. They see the Connect-gated manual and the announcements. You don't |
The reported 2027 GMAP
Everything in this section traces to three industry sources publishing within roughly 48 hours at the end of July 2026:
- Chargeback Gurus, 30 July 2026, chargebackgurus.com. By far the most detailed account, and the only one carrying tier definitions and fine ladders.
- Solidgate, updated 31 July 2026, solidgate.com/blog/mastercard-gmap.
- Corepay, roughly 29 July 2026, posted on LinkedIn.
Not one cites a Mastercard announcement or bulletin number. That objection is worth less than it sounds. The same is true of almost every number on this site. ECM's 1.5% and HECM's 3.0% appear in no public Mastercard document either. Both are defined by cross-reference to a manual behind an acquirer login. Every figure in circulation, ours included, reached the public through an acquirer. Three parties with acquirer channel access publishing inside two days, none able to link a document, is what a real acquirer-facing announcement looks like from outside.
So we treat it the way we treat ECM. Best available account, sourced and dated, not rumor. The caveats below are about specific figures that don't hold up, not about whether the program is real.
The opened 4 August 2026 Security Rules still mark the original GMAP suspended. The checked public network material doesn't confirm the reported new tiers. The newer Chargeback Guide wasn't retrievable in this check. Ask your acquirer for the announcement number and the current applicable manual. NOT PUBLISHED A verified public source for the reported new framework wasn't found in this check.
The August Security Rules postdate the July reports, while the other editions previously cited predate them. Neither date alone confirms or disproves an acquirer-facing change. Keep the reported figures separate from rules your acquirer confirms apply to your account.
All three agree on this much. A new Global Merchant Audit Program, effective 1 April 2027, tightening dispute monitoring on merchants and acquirers alike. Open audits carry over and month counts don't reset. The ratio is reported as fraud filed to the Fraud and Loss Database plus non-fraud chargebacks, over the prior month's sales. That at least matches how Mastercard already does the arithmetic.
They don't agree on what happens to the programs you're in today. Chargeback Gurus says ACMP is retired and ECM, HECM and EFM fold into the new framework. Corepay says ECM and HECM stay, running in tandem with an updated GMAP. Those are different architectures. Both can't be right. More below.
The reported tiers, all REPORTED:
| Reported tier | Applies to | Reported ratio |
|---|---|---|
| High Dispute Merchant (HDM) | Merchant | 500 bps (5%) |
| Excessive Dispute Merchant (EDM) | Merchant | 5,000 bps (50%) |
| High Dispute Acquirer (HDA) | Acquirer portfolio | 50 bps (0.5%) |
| Excessive Dispute Acquirer (EDA) | Acquirer portfolio | 70 bps (0.7%) |
Which of these numbers hold up
HDA at 0.5% and EDA at 0.7% match VAMP's acquirer portfolio ratios. VAMP has its own regional count and value tests. Matching two ratios doesn't confirm the reported Mastercard program or show that an acquirer needs no new work.
EDM at a 50% ratio is a scam-shop threshold. Half of everything you sell coming back as a dispute isn't a merchant having a bad quarter. If you're here worrying about your 1.2% ratio, EDM isn't a number in your life. HDM at 5% is still more than three times today's ECM trigger.
The reported transaction minimums need confirmation, not an arithmetic dismissal. Chargeback Gurus lists 1,500 cleared transactions and 1,500 fraud or non-fraud chargeback events for acquirers, while its ratio uses prior-month sales. Those minima don't force a 100% ratio: 1,500 events over 300,000 prior-month sales is 0.5%. Its merchant test also has dollar and ratio conditions, so five sales alone don't enroll everyone. Ask your acquirer to confirm the counts and denominator. REPORTED Chargeback Gurus, vendor article, checked 22 October 2026.
Chargeback Gurus' High Dispute Acquirer table reads USD 25,000 at months 12 through 18, then USD 10,000 at months 19 and beyond. The fine falls the longer the breach lasts. That's backwards from every other ladder Mastercard publishes, and from the article's own three others.
It's almost certainly a typo in that one table, not a reason to doubt the article. The other three ladders in the same piece escalate normally, HDM topping out at USD 25,000 and EDM at USD 300,000. Treat that row as unreliable in either direction, since there's no way to tell which of the two figures is the typo. Solidgate publishes no ladders at all, so every one of these amounts rests on one source.
Where the sources disagree with each other
| Question | Chargeback Gurus | Solidgate | Corepay |
|---|---|---|---|
| What happens to ECM and HECM | Folded into the new program | Not stated in detail | Kept "in tandem with" an updated GMAP |
| Fine ladders | Full tables for four tiers | None published | None published |
| ECM phase-down | 1.5%-2.99% for 2027-2028, 1.3% floor 2029, 1.1% 2030, 0.9% 2031 | 1.5% falling to 0.9% by 2031, starting 2029 | Says ECM thresholds are being reduced |
"Folded into" and "running in tandem with" are different architectures, not two wordings for the same thing. That's a real disagreement from two sources publishing a day apart.
The ECM phase-down is the part most likely to touch an ordinary merchant. It's also the thinnest. One source carries the detail, and even it says nothing changes before 2029. If it's real, today's 1.5% eventually becomes 0.9%. Those are reported future program figures, not your processor's limit today. Check Monitoring Thresholds, and ask your processor for its current limit in writing.
Chargebacks911 actively maintains Mastercard threshold pages and has published nothing about a 2027 GMAP. That's silence, not a rebuttal. Solidgate is odder. Its marketing blog carries the story. Its own product documentation still lists only ACMP with ECM, HECM and EFM. A vendor that hasn't updated its operational docs hasn't operationalized the claim.
Why this is so hard to verify
Mastercard publishes no numeric ECM, HECM or EFM threshold in any public document. The Security Rules define both chargeback programs by cross-reference to Chapter 8 of the Data Integrity Monitoring Program manual. That manual sits behind an acquirer login on Mastercard Connect. Merchants can't read it.
Visa's Core Rules defer to a VAMP Guide distributed to acquirers. But Visa also publishes a public VAMP fact sheet with numeric thresholds.
Keep that distinction clear: some figures are public network statements, others are acquirer or PSP relays. See Network Programs for the sources and conditions. Check the source date before reusing an old threshold.
We'd rather say that than pretend to a citation we don't have. VENDOR is read from Mastercard's own manual. REPORTED is a named third party with a date. NOT PUBLISHED is a search that failed, with the places we looked written down.
Where This Breaks
Your acquirer can set its own limit. Theirs is the one that can end the relationship. Ask for it in writing; don't assume it matches a network line. See Monitoring Thresholds.
A suspended program can come back. "Suspended until further notice" isn't "cancelled." If Mastercard reinstates GMAP, the numbers on this page become history twice over. The reported 2027 program may be exactly that reinstatement, or it may be three vendors amplifying one article.
Legacy tier numbers survive in internal documents. If anyone ever built a fraud dashboard against 3%, 5% and 8% GMAP tiers, those alerts are still firing against a program that stopped existing in 2020. Worth an afternoon to check.
Test to Run
One search and two questions. Fifteen minutes.
1. Search your own documents for GMAP. Onboarding pack, acquirer agreement, internal risk runbook, chargeback vendor dashboard. Anything naming GMAP as a live program is stale. Whatever else that document says deserves the same suspicion.
2. Ask your acquirer the ratio question:
"What's my current Mastercard chargeback ratio and count, which month's volume are you using as the denominator, and what internal threshold do you apply to me before the network's?"
That last clause is the one that gets you the useful answer.
3. Ask the 2027 question neutrally. Don't lead with the vendor blogs, or you'll get a salesperson's answer back:
"Have you received any Mastercard announcement about changes to the Acquirer Chargeback Monitoring Program or merchant monitoring thresholds taking effect in 2027? If so, can you send me the announcement number?"
An AN number means there's a primary source and you've found it. A vendor blog link back tells you something too.
Sources
| Source | What it gave us | Kind | Date |
|---|---|---|---|
| Mastercard Security Rules and Procedures, Merchant Edition | The verbatim suspension sentence at 8.2 and QMAP's conditions at 8.4. Its 2021 and 2022 editions, via the Wayback Machine, gave the 15 October 2020 date and the legacy tiers | Network rulebook, publicly published | Edition dated 2026-08-04 |
| Mastercard Chargeback Guide, Merchant Edition | Reason code 4849 tied solely to QMAP | Network rulebook, publicly published | Edition dated 2026-05-19 |
| Mastercard Transaction Processing Rules, sections 5.4.1-5.4.1.1 | ACMP as the umbrella for ECM, HECM and EFM, and the four-month subscription rule | Network rulebook, publicly published | Edition dated 2026-06-09, checked 22 October 2026 |
| Solidgate blog | The 2027 program shape, effective date, HDM and EDM ratios, ECM phase-down. Vendor selling chargeback services. Its own product docs still list only ACMP | Vendor marketing blog | Updated 2026-07-31 |
| Chargeback Gurus | The four reported tiers, the fine ladders, the ECM phase-down detail. Vendor selling chargeback services. Sole source for most specific figures | Vendor marketing blog | 2026-07-30 |
| Corepay, LinkedIn post | The "in tandem with" framing that conflicts with Chargeback Gurus | Vendor social post | Approximately 2026-07-29 |
| Chargebacks911 Mastercard threshold pages | Nothing. No mention of a 2027 GMAP on pages they actively maintain | Vendor pages, checked for non-corroboration | Accessed 2026-08-02 |
Security Rules edition checked 22 October 2026. The other rulebook and archive checks above retain their original 2 August 2026 access date.
Next Steps
Came here because something said GMAP applies to you?
- Network Programs Reference - the thresholds that are actually live
- Chargeback Metrics - work out where you really sit
- Processor Warnings - what a real notice looks like
Dealing with a fraud-side problem?
- Dispute Monitoring Programs - EFM and the fraud thresholds in detail
- Mastercard Reason Codes - what each code actually means
- MATCH and the TMF - reason code 08 and the QMAP listing
Ratio climbing right now?
- Chargeback Ratio Crisis - the emergency playbook
- Chargeback Alerts - RDR, Ethoca and CDRN
- Reduce Chargebacks Fast - tactical intervention
Related Pages
- Network Programs Reference - VAMP, ECM, HECM, EFM in one table
- SMMP - Mastercard's scam merchant monitoring, live since July 2026
- Dispute Monitoring Programs - the deep dive on each program
- Monitoring Thresholds - threshold detail by network
- MATCH and the TMF - the blacklist and its reason codes
- Mastercard Reason Codes - full code list
- Chargeback Metrics - ratio arithmetic, including the prior-month denominator
- Processor Warnings - reading a real notice
- Chargeback Ratio Crisis - crisis playbook
- Chargeback Prevention - the prevention hierarchy
- Mastercard Network Guide - QMAP and the wider rule set
- Money Held or Frozen - what program enrollment does to your cash