Skip to main content

Network Rules

TL;DR
  • Three kinds of program: monitoring (VAMP, ECM/HECM), high-risk registration (VIRP, MRP), terminated-merchant lists (MATCH, VMSS)
  • You never deal with the network. Your acquirer does, and it passes the fines to you
  • MATCH is the one that ends businesses. Five years on the list
  • Most acquirers won't board you while you're on it
  • Rules update twice a year, effective April and October
  • Neither network publishes its numbers. Every figure here came out through an acquirer
  • Get your acquirer to put your limits in writing before you need them

Nobody sends you the rulebook when you open a merchant account. You find out these programs exist when a fee lands on a statement. Or when an underwriter says they can't board you and won't say why. This section is the map. Which programs exist, what each one measures, and which ones can put you out of business.

Network Compliance Overview​

Visa and Mastercard aren't your regulator. They just write the rules everyone downstream has to follow. How transactions get processed, how disputes work, how fraud gets handled. Updates land twice a year, normally effective April and October. They reach you through your acquirer or not at all.

Merchants are governed through their acquirer. Issuers are governed directly. When something goes wrong the money flows the same way. The network bills the acquirer. The acquirer bills you, usually with a markup. You rarely get told what the underlying fee was. Serious violations end in a MATCH listing. That shuts a merchant out of card processing almost completely. For a member bank it's expulsion.

Key Programs by Network​

Visa Programs​

ProgramPurposePrimary Audience
VAMPConsolidated fraud and dispute monitoringAcquirers, Merchants
VIRPHigh-risk merchant registrationAcquirers
VMSSTerminated merchant databaseAcquirers
Visa Secure3DS liability shift rulesAll parties
VIMPIssuer monitoringIssuers

VAMP (Visa Acquirer Monitoring Program): The consolidated program that replaced VDMP and VFMP. It monitors fraud (TC40) and non-fraud disputes (TC15) as one combined ratio. So cleaning up chargebacks on their own won't move it. Effective April 2025, enforcement from October 2025. Merchant excessive is 1.5%, or 2.2% in CEMEA. It only bites once you're at 1,500 combined fraud reports and disputes.

VIRP (Visa Integrity Risk Program): Registration and monitoring for high-risk merchants, in three tiers. Replaced GBPP in May 2023. If you're in a VIRP category you'll know. Registration costs money, and your acquirer will have told you.

VMSS (Visa Merchant Screening Service): Visa's database of terminated merchants. Acquirers query it before boarding anyone. They add the merchants they terminate. It's the Visa equivalent of MATCH, and it's checked just as routinely.

Mastercard Programs​

ProgramPurposePrimary Audience
ECPExcessive chargeback monitoring (ECM/HECM)Acquirers, Merchants
EFMExcessive fraud merchant monitoringAcquirers, Merchants
BRAMIllegal/brand-damaging activityAcquirers
MRPHigh-risk merchant registrationAcquirers
MATCHTerminated merchant listAcquirers

ECP (Excessive Chargeback Program): Two tiers. ECM is 100-299 chargebacks and a 1.50-2.99% ratio. HECM is 300+ and 3.00%+. Both halves have to be true at once. A tiny merchant with a horrible ratio sits outside it. So does a huge merchant with a horrible count. That surprises people every time.

EFM (Excessive Fraud Merchant): Fraud monitoring for e-commerce specifically, with 3DS usage in the calculation. It runs separately from ECP. You can be clean on chargebacks and still land in EFM.

BRAM (Business Risk Assessment and Mitigation): Not a ratio program. BRAM is about what you sell, not how badly it goes. Synthetic drugs, counterfeit goods, unlicensed gambling, the rest of the prohibited list. BRAM fines don't track your chargeback rate, and they arrive with no warning period.

MATCH (Member Alert to Control High-Risk): Mastercard's database of terminated merchants. You stay on it five years. You generally aren't told when you're added. Most acquirers won't board a listed merchant at all.

GMAP is suspended, and the numbers you'll find online are dead

Mastercard's Global Merchant Audit Program has been suspended since 15 October 2020. The 3 February 2026 rulebook still marks it suspended. Its old 3%/5%/8% tiers circulate on chargeback vendor blogs as if they were live thresholds. They aren't. A separately reported GMAP carries a 1 April 2027 date. See GMAP for what's actually in force.

Program Comparison​

AreaVisa ProgramMastercard Program
Chargeback/dispute monitoringVAMPECP (ECM/HECM)
Fraud monitoringVAMPEFM
High-risk registrationVIRPMRP
Prohibited/brand-damaging activityVIRP (integrity tiers)BRAM
Terminated merchant listVMSSMATCH
Issuer monitoringVIMPVarious

Section Contents​

Dispute Monitoring​

Visa VAMP, Mastercard ECM/HECM, and the programs around them. Thresholds, fees, remediation, and what prevention tools do to the numbers.

Surcharging​

Network limits on credit card surcharges. State law, disclosure rules, and the difference between a surcharge, a convenience fee and a cash discount.

Resources​

Visa Documentation​

  • Visa Core Rules and Visa Product and Service Rules: published twice yearly, 1,000+ pages, free to download
  • Visa Business News: bulletins with rule changes, acquirer-facing
  • Visa Online: member portal, and you won't have a login

Mastercard Documentation​

  • Mastercard Rules, Security Rules and Procedures, Chargeback Guide: all public PDFs, all worth searching before you accept a fee explanation
  • Mastercard Connect: member portal
  • Global Operations Bulletins: rule change announcements

The public rulebooks are genuinely useful. Most merchants have never opened one. If your acquirer quotes you a rule, ask which document and which section. If they can't say, that's an answer too.

Stay current

Ask your acquirer to forward the Visa Business News and Mastercard Global Operations Bulletin items that hit your MCC. They already receive them. Most won't pass them on unless you ask. The April and October dates arrive whether you've read them or not.

Verified August 2026, and none of it is officially published

The numeric thresholds here reached the public through acquirer channels. Visa and Mastercard don't publish them. Nothing here can be checked against a public document. Confirm your own limits with your acquirer in writing. Re-check after each April and October release.

Next Steps​

New to network compliance?

  1. Understand dispute monitoring programs - VAMP, ECM/HECM thresholds and fees
  2. Review chargeback metrics - Track your ratios before problems start

Concerned about thresholds?

  1. Implement chargeback prevention - Reduce dispute counts
  2. Set up alerts - Ethoca, RDR, CDRN tools

Already in a monitoring program?

  1. Reduce chargebacks fast - Emergency response playbook
  2. Work with your processor - Remediation plan support

See Also​

Last updated on