Compliance Metrics & Monitoring

Last updated 22 October 2026. Copy page as text

This page is the ratios behind the named network programs - VAMP, ECM, HECM, EFM - and where each line sits. Looking for win rates and costs?

None of these bites on a ratio alone. Each needs a minimum count too, so a scary percentage on low volume can mean nothing at network level.

TL;DR

Three numbers decide whether a network program comes after you: chargeback ratio, fraud ratio, and enumeration ratio.
Visa VAMP combines fraud reports and disputes over same-month settled CNP transactions, with exclusions. Mastercard divides this month's Mastercard chargeback count by last month's Mastercard sales count.
Mastercard ECM is 100-299 chargebacks and a 1.50-2.99% ratio. Both halves have to be true, so one without the other tells you nothing.
Visa VAMP merchant tests depend on region and acquirer status. Check the regional conditions before comparing your count and ratio.
Set your own alarms before the limits that apply to you. Leave time to investigate and fix the cause.
Visa publishes a public VAMP fact sheet. Mastercard program numbers below come through acquirer documentation; see Network Programs for sources.

You can't manage a ratio you see once a month, in an email, after the month closed. This page gets those three numbers onto your own dashboard daily, with an alarm that trips well before your acquirer's does.

Core Compliance Metrics

Three ratios drive every network monitoring program. Track one and ignore the rest, and the other two will blindside you.

Chargeback Ratio

Chargebacks divided by transactions. Your acquirer watches it. It triggers Mastercard's chargeback program. Visa VAMP uses a separate combined fraud-and-dispute ratio, below.

Mastercard formula:

Chargeback Ratio (%) = Mastercard chargebacks in Month N / Mastercard sales count in Month N-1 x 100

Where the lines sit: your processor can set its own limit. Ask which metric it measures, when it warns you, and what it expects if you breach the limit. Get the answer in writing. Check Monitoring Thresholds for the distinction from network programs.

Calculation differences:

Visa VAMP: TC40 fraud reports plus TC15 disputes over same-month settled Visa CNP transactions, with exclusions
Mastercard ECM: this month's Mastercard chargeback count over prior-month Mastercard sales count

That prior-month denominator matters. Cut spend in June and June's shrunken count becomes July's Mastercard denominator. July's chargebacks are still arriving from earlier sales. The ratio jumps without a single extra chargeback.

VAMP counts fraud reports too

A clean chargeback number on its own won't keep you out. Visa VAMP combines fraud reports and disputes. See Network Programs for the formula and exclusions.

Fraud Ratio

Keep your fraud-loss metric separate from network monitoring. You may track fraud dollars against sales dollars for your own losses. That isn't Mastercard EFM's count ratio.

Internal loss metric:

Fraud Loss Rate (%) = Fraud Amount in Month / Sales Amount in Month x 100

Program definition: Mastercard EFM uses the current month's fraud chargeback count over prior-month Mastercard sales count, plus other entry tests. See Network Programs for regional conditions. Use your processor's written limit too.

Where the number comes from:

TC40 reports (Visa) filed by issuers
Fraud-reason chargebacks (Mastercard)
Your own fraud detection system, which will disagree with both

Enumeration Ratio

Card testing. Somebody runs stolen numbers through your checkout to find the live ones. Every attempt lands on your account, not theirs.

Formula:

Enumeration Ratio = (Enumerated Authorizations) / (All Authorizations) × 100

Approvals and declines both count, on both sides of the line. A card-testing run is mostly declines. Measure it against settled transactions and you'd hide it.

Threshold: VAMP enumeration needs both 300,000 enumerated authorizations and a 20% ratio in the same month. Under either number, you're outside the program.

VAMP Ratio (Visa, 2025 onward)

Visa's consolidated number, replacing the old VDMP and VFMP split.

Formula:

VAMP Ratio (%) = Eligible (TC40 fraud reports + TC15 disputes) this month
                 / Settled Visa CNP transactions this month x 100

Check the exclusions

One transaction can contribute a TC40 fraud report and a TC15 dispute. Visa's fact sheet also excludes qualifying pre-dispute resolutions and CE 3.0 fraud, depending on data-extract timing. Use your acquirer's official figures; see Network Programs.

Thresholds: merchant tests depend on region and acquirer status. Don't apply one region's count floor to another. See the regional conditions.

Monitoring Dashboard Components

What to Track

Daily/Weekly Views:

Chargeback counts by day
Fraud amounts by day
Authorization decline rates
Alert volumes (Ethoca, Verifi)

Monthly Views:

Chargeback ratio vs. threshold
Fraud ratio vs. threshold
VAMP ratio calculation
Trend comparison (current vs. prior 3 months)

Breakdown Dimensions:

By reason code (identify root causes)
By merchant (for acquirers)
By BIN (for issuers)
By product type (credit vs. debit)
By channel (CNP vs. CP)

Alert Thresholds

Set your own alarms before the limits that apply to you. By the time a limit trips, you've already had the bad month.

Situation	Trigger	Action
Routine monitoring	No warning; track your trend and distance to the limit	Keep checking counts and ratios
Investigate	A rise from your baseline	Find the cause by reason code and segment
Remediate	Approaching your processor's limit	Start fixes and monitor progress
Respond	A warning arrives or a limit is breached	Confirm the metric, deadline and required response

Key Thresholds Reference

Where these numbers come from

Visa publishes numeric thresholds in its public VAMP fact sheet. Mastercard figures below are relayed through acquirer documentation. See Network Programs for sources and conditions. Confirm your processor's own limits in writing before you build alerts on them.

Program	Metric	Threshold
Visa VAMP (merchants, excessive)	VAMP ratio + regional count and value tests	Depends on region and acquirer status; see Network Programs
Visa VAMP (acquirers, above standard)	Portfolio VAMP ratio + regional minimums	See the acquirer criteria
Visa VAMP (acquirers, excessive)	Portfolio VAMP ratio + regional minimums	See the acquirer criteria
Visa VAMP (enumeration)	Count + ratio	300,000 enumerated transactions AND 20%
Mastercard ECM	CB count + ratio	100-299 AND 1.50-2.99%
Mastercard HECM	CB count + ratio	300+ AND 3.00%+
Mastercard EFM	Prior-month sales count + fraud chargeback amount + fraud chargeback count ratio + 3DS coverage	All entry tests must be met; see Network Programs for the regional criteria

Every row that says AND means it. A merchant at 4% with 40 chargebacks isn't in ECM. Neither is one with 900 chargebacks at 0.4%.

EFM is the strictest of the lot. It takes four conditions at once, not two. Most summaries print the money and the ratio and drop the other two. The transaction floor is what keeps small merchants out of it entirely. Check your 3DS coverage against the regional entry tests, alongside the other three conditions. One compliant month isn't the same as completed exit.

Early Warning Systems

Proactive Monitoring

Set internal alarms before the applicable limits:

Visa VAMP: track combined fraud reports and disputes, with the applicable count
Mastercard ECM: track chargeback count and ratio together
Check Network Programs for definitions and conditions

Monitor velocity, not just absolute numbers:

Week-over-week change percentage
Month-over-month trajectory
Seasonal adjustment factors

Flag anomalies:

MIDs/BINs with sudden increases
New merchants with unusual patterns
Specific reason codes spiking

Review Cadence

Situation	Review Frequency
Normal operations	Weekly compliance review
Ratio rising from baseline	Increase review frequency while investigating
Approaching a limit	Review progress against your remediation plan and deadline
Warning received or limit breached	Confirm the required reporting cadence with your processor

Issuer-Specific Metrics

If you're a merchant, skip this section. It's written for card issuers, and none of it shows up on a merchant statement.

Dispute Initiation Rate

How often your cardholders dispute transactions.

Dispute Initiation Rate = (Disputes Initiated) / (Total Transactions) × 100

Higher rates may indicate:

Fraud targeting your cards
Poor merchant partnerships
Cardholder education needs

Fraud Loss Rate by BIN

Split fraud losses by BIN to find the problem products.

Fraud Loss Rate = (Fraud Losses) / (Sales Volume) × 100

TC40 Filing Compliance

Issuers file TC40s for fraud claims. Those filings land on somebody else's ratio. Track:

Filing timeliness
Filing completeness
Filing accuracy

Visa Issuer Monitoring Program (VIMP)

Monitors issuer-side fraud and dispute rates for CNP
Includes dispute-to-transaction and fraud-to-sales ratios
Regional minimum volume thresholds apply

Acquirer/Merchant Metrics

Portfolio-Level Monitoring

For acquirers managing multiple merchants:

Metric	Calculation	Target
Portfolio VAMP ratio	Aggregate across all MIDs	Set an internal alarm before the applicable portfolio limit; see Network Programs
At-risk merchant count	MIDs approaching their applicable limits	Investigate and track each remediation plan
MATCH additions	New listings per quarter	Minimize

Individual Merchant Tracking

Metric	Frequency	Action Trigger
Chargeback ratio	Daily	Approaching the applicable limit; check count too
Fraud ratio	Weekly	Rising from baseline or approaching the applicable limit
VAMP ratio	Daily	Approaching the applicable program line; check count and acquirer status

BRAM/VIRP Status

Track registration and compliance status for high-risk merchants:

Registration current?
Monitoring reports filed?
Any violations flagged?

Reporting Cadence

Frequency	Report Type	Audience	Content
Daily	Alert/exception report	Operations	Threshold breaches, anomalies
Weekly	Trend summary	Risk managers	Ratio trends, reason code analysis
Monthly	Full compliance report	Leadership, regulators	All metrics, program status
Quarterly	Program review	Board, examiners	Strategic view, remediation status

Monthly Report Components

Executive Summary
- Overall compliance status (Green/Yellow/Red)
- Key metric trends
- Notable events
Metric Detail
- Chargeback ratio with trend
- Fraud ratio with trend
- VAMP ratio calculation
- Breakdown by segment
Program Status
- Current network program enrollments
- Remediation plan progress
- Upcoming threshold changes
Action Items
- Required responses
- Recommended improvements
- Timeline commitments

Building Your Dashboard

Essential Views

Real-Time (refreshed hourly):

Current day chargeback count
Current day fraud alerts
Authorization decline rate

Daily Summary:

Rolling 30-day chargeback ratio
Rolling 30-day fraud ratio
Comparison to same period prior month

Trend Analysis:

90-day trend chart
Projection to month-end
Threshold overlay

Data Sources

Data Type	Source	Frequency
Chargebacks	Processor reports, network files	Daily
Transactions	Authorization logs	Real-time
TC40s	Visa reporting	Daily
Fraud claims	Internal systems	Real-time
Alert resolutions	Ethoca, Verifi	Daily

Where This Breaks

You build the dashboard on your own transaction count. Your gateway's count and your acquirer's settled count won't match. Refunds, partial captures, voids and declines all get treated differently. Build the ratio off the acquirer's settled count. Reconcile your gateway to that, not the other way round.

You use one formula for both networks. Mastercard ECM uses this month's Mastercard chargebacks over prior-month Mastercard sales count. Visa VAMP uses fraud reports plus disputes over same-month settled Visa CNP transactions, with exclusions. A single "chargeback ratio" tile won't answer both programs. See Network Programs.

Chargebacks get counted on the date they're worked, not the date they're received. Networks count by received date. Clear a backlog in one week and your internal number spikes in a month the network calls quiet. Or it stays flat in a month the network calls bad.

Fraud looks fine because you're measuring your own fraud. Your ratio comes from TC40s that issuers filed, not from the fraud your rules caught. Ask your acquirer for the raw TC40 feed. If they can't provide it, that's a real gap in what you can see. Raise it before you need it.

Next Steps

Setting up compliance monitoring?

Track core metrics - Chargeback, fraud, enumeration ratios
Build your dashboard - Real-time, daily, trend views
Set alert thresholds - Before the applicable limits

Approaching thresholds?

Check key thresholds - VAMP, ECM, EFM limits
Increase review cadence - Match the trend, remediation plan and processor deadline
Follow remediation playbook - Emergency response

Building early warning systems?

Set internal alerts before your applicable limits - Leave time to investigate and fix the cause
Monitor velocity not just absolutes - WoW and MoM changes
Establish reporting cadence - Weekly, monthly, quarterly

Other Metrics Pages

Tracking compliance is just one piece. See also: Payments Metrics · Fraud Metrics · Chargeback Metrics · Operations Metrics

Core Compliance Metrics​

Chargeback Ratio​

Fraud Ratio​

Enumeration Ratio​

VAMP Ratio (Visa, 2025 onward)​

Monitoring Dashboard Components​

What to Track​

Alert Thresholds​

Key Thresholds Reference​

Early Warning Systems​

Proactive Monitoring​

Review Cadence​

Issuer-Specific Metrics​

Dispute Initiation Rate​

Fraud Loss Rate by BIN​

TC40 Filing Compliance​

Visa Issuer Monitoring Program (VIMP)​

Acquirer/Merchant Metrics​

Portfolio-Level Monitoring​

Individual Merchant Tracking​

BRAM/VIRP Status​

Reporting Cadence​

Monthly Report Components​

Building Your Dashboard​

Essential Views​

Data Sources​

Where This Breaks​

Next Steps​

See Also​