VAMP compliance for high-risk merchants
Do you regularly process online, card-not-present transactions? Are disputes a common part of your business model? If yes, then Visa’s new VAMP rules likely apply to you.
Apply in 60 seconds
Tell us about your business. It's free to apply.
Your information is encrypted & never shared.
With the alarming rise of digital fraud, merchant losses to online payment fraud are projected to top $362 billion globally between 2023 and 2028, with $91 billion in 2028 alone. And since Visa has pledged to hold everyone accountable for unchecked fraud, high-risk merchants now face extremely heightened scrutiny from acquiring banks.
VAMP stands for the Visa Acquirer Monitoring Program. It is a compliance and risk monitoring framework created by Visa to identify merchants whose payment activity shows elevated levels of fraud, chargebacks, or other behaviors that can threaten the stability and integrity of the card network.
VAMP is how Visa evaluates whether acquiring banks and payment processors are effectively managing the merchants they sponsor. While acquirers are the entities formally monitored, the impact of VAMP is directly felt by merchants, especially those operating in moderate to high-risk industries.
Under VAMP, Visa aggressively reviews transaction data, dispute patterns, and fraud indicators tied to individual merchant accounts. When certain thresholds are exceeded, those accounts may be flagged for increased surveillance. In some cases, this can lead to restrictions, higher reserves, or even account termination if corrective action is not taken.
For high-risk merchants, VAMP doesn’t penalize growth. Rather, it scrutinizes how that growth shows up in your payment activity.
Visa uses VAMP to monitor whether transaction volume, chargebacks, and customer behavior stay within its specified risk thresholds. Businesses with recurring billing, international customers, or rapidly scaling revenue tend to draw closer review, even when they’re operating fully above board.
Understanding how VAMP works is essential to protecting your merchant account, avoiding financial penalties, and maintaining stable payment processing as your business grows.
VAMP fundamentally changes how acquiring banks manage fraud and dispute risk across their entire merchant portfolios. Think of it as shared responsibility. Visa looks at how all of an acquirer’s merchants perform together, not just in isolation.
Acquirers are now held accountable for any and all events of elevated fraud, chargeback, and enumeration activity in their merchant portfolio. These values are measured through a new unified VAMP ratio that combines TC40 fraud and TC15 dispute events against total settled transactions.
Under VAMP, if an acquirer’s overall performance exceeds defined thresholds (“Above Standard” or “Excessive”), Visa can issue a corrective action, enhanced monitoring, or enforcement fees tied to each disputed or fraudulent transaction, often without merchant-specific fault.
Visa rates an acquirer's portfolio as Above Standard at a 0.5% VAMP ratio and Excessive at 0.7%. That's why your bank may react to your numbers long before you reach the merchant threshold.
This shift means acquirers must:
In short, acquirers are expected to employ rigorous oversight and faster remediation when thresholds are approached. VAMP is a direct financial incentive to push merchants toward stronger fraud and dispute management.
Visa announced VAMP in 2024, and it took effect on April 1, 2025, to better combat fraud and enumeration attacks as digital commerce continues to expand. With more online transactions come higher (and more sophisticated) fraud, more disputes, and less stable payment behavior, especially in high-volume and cross-border industries.
Earlier monitoring programs focused on chargebacks, which appear after serious problems are already well underway. VAMP takes a broader view, examining fraud patterns, dispute activity, and merchant behavior so risk can be identified and adequately addressed earlier.
VAMP also reinforces accountability. Because Visa doesn’t work directly with most merchants, it relies on acquiring banks and processors to properly underwrite and manage the businesses they support. The program ensures acquirers stay actively involved in monitoring risk, not just reacting once issues escalate.
And while that scrutiny can feel frustrating, VAMP isn’t meant to punish legitimate businesses. It’s meant to surface risk sooner and get ahead of suspicious activity, all before small issues turn into account freezes, processing interruptions, or even bigger problems down the road.
Bottom line: Visa wants acquiring banks and processors to take chargebacks and payment card fraud much more seriously.
Visa’s Acquirer Monitoring Program evaluates merchant risk using defined ratios and behavioral indicators that signal instability within the payments ecosystem.
While Visa formally monitors acquiring banks, these measurements are driven by merchant-level transaction data.
For high-risk merchants, understanding these ratios is essential to maintaining VAMP compliance:
The VAMP ratio is a core metric used to assess overall risk tied to a merchant’s payment activity, specifically involving both domestic and cross-border card-not-present transactions. It evaluates the relationship between these two values over a defined monitoring period:
A rising VAMP ratio indicates that a merchant’s transactions are producing an unacceptable level of fraud and disputes relative to their transaction volume. This can stem from weak fraud controls, high-risk customer acquisition channels, insufficient authentication, or poor transaction filtering.
The numbers: VAMP launched on April 1, 2025, and its 2.2% “excessive” threshold for US merchants took effect on June 1, 2025, after an advisory period that ran through September 30, 2025. Since April 1, 2026, the threshold is 1.5%, with at least 1,500 combined fraud reports and disputes in a month. Those merchant thresholds apply when the acquirer's own portfolio is in good standing; if the acquirer is flagged, merchants can be identified at ratios as low as 0.5%. Merchants over the line face fees passed on by their acquirer, tighter account controls and, eventually, the loss of Visa processing privileges.
How to calculate your monthly VAMP ratio: (fraudulent card-not-present transactions, TC40 + disputed card-not-present transactions, TC15) ÷ settled card-not-present transactions, TC05.
The tricky part? One bad transaction can count as two strikes. If a payment is flagged as fraud and later disputed, it gets logged twice under VAMP. Think of it like one missed payment triggering both a late fee and a ding on your credit score.
For deeper dives, see how the VAMP program impacts your business, our breakdown of Visa's VAMP changes and the 2026 VAMP threshold guide.
RDR-resolved disputes not counted
VAMP also holds acquirers accountable when merchants fail to stop large-scale “enumeration” attacks, a type of fraud where criminals rapidly submit thousands of card attempts to test stolen card numbers and confirm which ones are active.
If a merchant allows this activity to spiral, Visa requires the acquirer to step in and fix it. Visa doesn't fine enumeration the way it does the VAMP ratio, but it does require remediation, and your acquirer may restrict your account until the attacks stop. A merchant is flagged when both of these are true in a month:
The good news is that most enumeration attacks are preventable. Simple safeguards like CAPTCHA tests, caps on payment attempts, and authorization controls can stop these attacks before they become a serious problem.
How to calculate your monthly enumeration ratio: enumerated authorization attempts (approved + declined) ÷ all authorization attempts (approved + declined).
Beyond these two ratios, acquiring banks watch other risk signals in your account, such as:
These signals are assessed in context, taking into account the merchant’s industry, business model, and historical behavior.
For high-risk merchants, VAMP compliance depends on proactively controlling fraud and enumeration risk rather than reacting after the above ratios deteriorate.
VAMP compliance isn’t just a concern for deceptive merchants. It affects legitimate businesses whose models often carry more fraud and dispute exposure. If your company processes high volumes, bills customers repeatedly, offers digital payment options, or operates across borders, VAMP should definitely be on your radar.
This includes businesses in higher-risk categories, such as:
The Visa Dispute Monitoring Program (VDMP) was Visa’s original program for monitoring disputes and chargebacks. But as of April 1, 2025, Visa rolled those dispute rules, along with the Visa Fraud Monitoring Program (VFMP), into an updated umbrella program: VAMP.
In other words, VAMP is the “all-in-one” transaction monitoring system. It evaluates risk using combined signals, like disputes and fraud, instead of treating them as entirely separate programs.
For merchants and acquirers, the practical takeaway is simple: You can’t manage chargebacks in isolation anymore. Fraud controls and dispute prevention now live under a single compliance framework.
VAMP replaced Visa's separate dispute and fraud programs with one combined measure.
| VDMP (retired) | VFMP (retired) | VAMP (current) | |
|---|---|---|---|
| What it counted | Disputes | Fraud reports | Fraud reports (TC40) and disputes (TC15) together |
| How it measured | Dispute count against sales count | Fraud dollars against sales dollars | Fraud and dispute count against card-not-present sales |
| Card testing | Not measured | Not measured | Enumeration ratio |
| Status | Replaced April 2025 | Replaced April 2025 | In effect since April 1, 2025 |
When a merchant’s payment activity exceeds Visa’s acceptable risk thresholds under the Visa Acquirer Monitoring Program, enforcement rarely begins with immediate termination. Instead, action usually escalates in stages, guided by Visa requirements and carried out by the acquiring bank. Essentially, acquirers have also become auditors.
The first step is heightened oversight. Acquirers may be required to submit additional reports to Visa, closely track transaction activity, and document the corrective steps being taken. Merchants are often asked to adjust fraud controls, refine billing practices, or strengthen customer authentication during this phase.
If risk indicators continue to rise, acquirers may impose protective controls on the account. These can include higher rolling reserves, delayed settlements and payouts, transaction volume limits, or tighter authorization rules. The goal is to reduce exposure while giving the merchant time to stabilize payment activity.
When non-compliance persists, enforcement can escalate to processing restrictions or, as a last resort, account termination. In these cases, the acquiring bank may be required to end the relationship to remain compliant with Visa’s obligations. Merchants may also be placed on the MATCH list, which can make securing future payment processing significantly more difficult.
Merchants are often unaware that risk is rising until intervention begins, at which point options are more limited, and timelines are tighter. This is why early detection and proactive risk management are critical. Addressing fraud and enumeration activity sooner is far less disruptive than trying to recover after compliance action has already been triggered.
Important note: Visa assesses VAMP fees on the acquirer, not on you, and it doesn't publish the full fee schedule. Acquirers usually pass those per-dispute fees on, and industry sources report around $8 per fraudulent or disputed transaction in the US. Some sources also describe a grace period for a first-time issue, but don't count on one. Bring your ratio down as soon as it starts rising.
Monthly risk review
Well under Visa's 1.5% line
Protecting your payments today is about staying one step ahead. Vigilant monitoring and proactive controls help keep risk in check as your business grows. To meet updated VAMP requirements, make the following key compliance strategies a normal part of your business:
Use layered fraud controls that stop high-risk transactions before approval. This includes velocity limits, device and IP analysis, and adaptive rules that respond to changing traffic patterns. Reducing unauthorized fraud directly improves VAMP ratio performance.
Layer in tools like 3D Secure, Address Verification Service (AVS), and Card Verification Value (CVV) checks to help block unauthorized transactions. To prevent “friendly fraud,” use clear, recognizable billing descriptors so customers can easily identify charges on their statements.
Enumeration activity escalates fast and can trigger monitoring even during short bursts. Merchants should implement authorization throttling, bot mitigation, and alerts for abnormal low-value or repeated attempts. Rapid response matters more than long-term averages here.
Visa evaluates trends, not just totals. Sudden spikes in volume, sharp drops in approval rates, or inconsistent refund behavior can all raise flags. Gradual scaling, predictable billing cycles, and clear refund practices help maintain stable patterns.
Regularly review your TC40 (fraud) and TC15 (dispute) activity to understand how your numbers contribute to your overall VAMP ratio. As a proactive step, many teams choose to set internal alerts well before the official thresholds, so they have time to spot trends and course-correct early.
The best compliance strategies don’t wait for a warning. By the time an acquirer reaches out, risk metrics have often already slipped. Ongoing monitoring helps high-risk merchants stay steady as they grow.
Partnering with a specialized, tech-savvy provider has never been more important. It’s not just about who’s willing to take on “risky” businesses, but who’s able to keep these merchants afloat when major card networks like Visa tighten their regulatory ropes. To safeguard revenue under VAMP, businesses need:
With all of the above, plus an extensive banking network, Adaptiv Payments is already built to help high-risk merchants stay compliant and ahead of the curve.
Getting approved is one thing. Staying approved — and in Visa’s good graces — is another. Apply for a specialized merchant account with Adaptiv, and gain a team that protects your account so growth doesn’t come at a cost.
Fast approvals don’t matter much if you’re hit with crippling penalty fees, account restrictions, or termination later on. Now more than ever, merchant account providers who utilize thorough underwriting are a massive green flag for high-risk merchants. The right provider offers built-in safeguards, matches you with the best acquiring bank, and provides clear guidance on risk mitigation. The wait is worth it.
VAMP enforcement is administered through acquiring banks under rules set by Visa. When merchants encounter compliance issues, acquirers are required to take action. That action depends on whether a merchant’s processor can demonstrate active oversight, timely intervention, and a credible remediation plan.
Tools can surface data, but they cannot:
Effective VAMP compliance requires active account management. That includes continuous monitoring, early identification of emerging risk, and direct coordination with banking partners when adjustments are needed.
It also requires understanding how different business models, growth patterns, and customer bases affect risk ratios over time.
For high-risk merchants, compliance is not a static setting. It is an ongoing process that must evolve alongside the business. Tools can support that process, but they cannot replace experienced payment oversight.
At Adaptiv, we take an active role in long-term VAMP compliance. Our dedicated support team remains closely aligned with acquiring banks, keeps a pulse on emerging risk, and helps merchants make smart adjustments before minor issues turn into bigger disruptions. We understand how Visa evaluates activity under VAMP and how growth, traffic sources, and billing models influence risk over time. The result is more stable payment processing and fewer surprises as your business grows.
We start with your numbers under the Visa Acquirer Monitoring Program and build the plan around what's actually driving your ratio.
Processing statements
The last 3 to 6 months
Fraud and dispute reports
Your TC40 and TC15 history
Checkout flow
How cards are entered and verified
Traffic sources
Where your customers come from
Billing model
Trials, renewals and refund terms
Current tools
Alerts, RDR or fraud filters in place
Measure your ratio
We calculate your VAMP ratio the way Visa does, with RDR resolutions excluded.
Find the sources
We trace fraud reports and disputes back to products, channels and billing events.
Stop card testing
Velocity limits, CAPTCHA and attempt caps keep enumeration off your account.
Resolve disputes early
Alerts, Visa RDR and Order Insight stop disputes before they count and reduce chargeback risk.
Review monthly
We track your ratio every month and work with your bank before it gets close.
If you process online transactions, fraud and chargebacks are inevitable. And when you know the pressure is coming, the answer isn’t to play defense and hope for the best. It’s to prepare, adapt, and stay one step ahead.
That’s where Adaptiv shines. We know payments. We manage compliance. And while we’re handling the complexity behind the scenes, merchants are free to focus on what matters most: running and growing their business.
Stable payments start with the right partner. Contact our sales team today to ask questions or get started on your application for a merchant account.
VAMP counts more than chargebacks. Here's what moves your ratio and how to stay compliant and in good standing.
A TC40 fraud report counts even with no chargeback, and a refund doesn't remove it.
Disputes count when they're filed, so winning one doesn't lower your ratio.
A transaction with both a fraud report and a dispute counts twice.
20% of authorization attempts and 300,000 enumerated attempts in a month gets you flagged.
Altering merchant data to dodge VAMP draws Visa fines of $25,000 per merchant per month.
Merchants in Visa's Secure Excessive Fraud program lose the 3DS liability shift.
The Visa Acquirer Monitoring Program. It measures fraud reports and disputes on card-not-present sales for acquiring banks and the merchants they sponsor.
Add your TC40 fraud reports and TC15 disputes for the month, then divide by your settled card-not-present transactions (TC05). Only card-not-present transactions count.
Since April 1, 2026, a merchant is flagged at a 1.5% ratio with at least 1,500 fraud reports and disputes in a month. Before that the limit was 2.2%. If your acquirer's own portfolio is flagged, stricter thresholds apply. Our 2026 threshold guide covers the details.
Visa rates an acquirer's whole portfolio as Above Standard at a 0.5% VAMP ratio and Excessive at 0.7%. Banks near those levels tighten up on the merchants driving their numbers.
No. The VAMP ratio only counts card-not-present transactions, both domestic and cross-border. Card-present sales don't add to the ratio or to the count.
VAMP. On April 1, 2025, Visa folded its Dispute Monitoring Program and Fraud Monitoring Program into VAMP, which measures fraud and disputes together.
No. Once the cardholder's bank files a fraud report, it counts even if you refund the order. Review and void suspicious orders before you capture the payment instead.
No. Disputes count when they're filed, whatever the outcome. Winning gets your money back, but only preventing disputes lowers your ratio.
Yes. If a transaction gets a fraud report and is later disputed, it appears in both reports and counts twice toward your ratio.
Yes. Disputes resolved through Visa Rapid Dispute Resolution (RDR) or deflected with Order Insight before they're filed are excluded from your VAMP ratio.
Yes. A fraud report that qualifies under Compelling Evidence 3.0, using two earlier undisputed orders on the same card, is excluded from your VAMP ratio.
It measures card testing attacks. You're flagged when enumerated attempts make up 20% or more of your card-not-present authorization attempts and reach at least 300,000 in a month. Visa requires remediation rather than fines.
Visa assesses fees on the acquirer, which usually passes them on to the merchants responsible. Visa doesn't publish the full fee schedule, so ask your processor how they handle it.
Your acquirer will usually start with closer monitoring and a remediation plan, then add reserves, delayed payouts or volume limits if the ratio keeps climbing. Accounts that stay over can be closed.
It can. If your account is closed over excessive fraud or chargebacks, your bank can add you to the MATCH list, where records stay for five years.
Yes. Mastercard's Excessive Chargeback Merchant program flags merchants with at least 100 chargebacks and a 1.5% ratio in a month, with a higher tier at 300 chargebacks and 3%.
Often, yes. Many high-risk merchants come to us after a processor froze or closed their account over chargebacks or fraud. We look at why it happened and what's changed. We also work with merchants on the MATCH list.
More tools that come with a high-risk merchant account.