High-risk payments

What makes a merchant high-risk

“High-risk” is not a legal category. It is a label that card schemes, acquirers and payment providers attach to businesses whose payments are more likely to end in fraud, disputes, regulatory trouble or reputational damage for the payment network. iGaming and betting, adult and dating services, nutraceuticals sold on subscription, crypto, forex and other trading platforms, and many card-not-present subscription businesses usually fall into it. See high-risk merchant.

The card schemes formalise this. Visa’s Visa Integrity Risk Program (VIRP) took effect on 1 May 2023, replacing the Global Brand Protection Program, and sorts “high-integrity risk” merchants into three tiers by merchant category code:

• Tier 1: 5967 (adult content), 7273 (dating and escort services), 7995 (gambling), 5122 and 5912 (pharmacies).
• Tier 2: 6051 and 6012 for crypto merchants, 4816 (cyberlockers and similar file-sharing), 5816 card-absent games of skill.
• Tier 3: 6211 card-absent trading platforms, 5966 outbound telemarketing, 5968 card-absent subscription “negative option” merchants, 5993 cross-border card-absent tobacco.

Acquirers that board merchants in Tier 1 and Tier 2 must pass a Visa control assessment. Mastercard runs its own registration requirements for specialty merchant categories. In practice this means more paperwork at onboarding, registration fees passed on to the merchant, and closer monitoring afterwards.

Merchant accounts, acquirers and PSPs

To accept cards you need a merchant account with an acquirer — a bank or licensed institution that is a member of the card schemes and settles card payments to you. The cardholder’s bank on the other side is the issuer. Each account is identified by a MID.

A PSP (payment service provider) sits between you and one or more acquirers: it provides the checkout, the gateway, fraud tools and often local payment methods. Some PSPs act as a payment facilitator and board you under their own master account; others resell acquirer accounts as an ISO agent. For a high-risk business the key questions are whose licence and whose MID your payments run on, and who decides to freeze or close the account.

MCCs and card-scheme rules

The merchant category code is a four-digit code that tells the network what your business does; the code set is standardised in ISO 18245. The MCC drives which scheme programmes apply to you (see the VIRP tiers above), how issuers approve or decline your transactions and what interchange applies. Card schemes require the code to reflect the real business — processing gambling or adult payments under an unrelated low-risk code is a scheme violation that can lead to fines for the acquirer and termination for the merchant.

Your billing descriptor — the name the customer sees on their statement — matters just as much: an unrecognisable descriptor is a common reason for “I don’t recognise this charge” disputes.

Reserves, holds and settlement

Because chargebacks can arrive weeks or months after a sale, acquirers of high-risk merchants usually keep part of the money as security. A rolling reserve withholds a percentage of each settlement for a fixed period and then releases it; a hold freezes funds outright, often during a review. The percentage, the period and the conditions for release are set in your contract — read them before you sign, and model the cash-flow effect with the rolling reserve calculator.

Settlement timing (how many days after the transaction money reaches you) and payout rules are the other half of cash flow. The all-in cost of the account — rate, fixed fees, FX markup, chargeback fees and lost declines — is what the payment processing cost calculator adds up.

Chargebacks and monitoring programmes

A chargeback is a forced reversal initiated by the cardholder’s bank. Too many of them, or too many fraud reports, put a merchant into a card-scheme monitoring programme with fees and, eventually, the loss of the ability to accept that card brand.

• Visa VAMP. On 1 April 2025 the Visa Acquirer Monitoring Program replaced the separate dispute (VDMP) and fraud (VFMP) programmes. The VAMP ratio counts fraud reports (TC40) plus disputes (TC15) and divides them by settled card-not-present transactions. From 1 April 2026 the merchant “Excessive” threshold is 1.5% with at least 1,500 counted events a month in most regions (it was 2.2% before).
• Mastercard. The Excessive Chargeback Program divides a month’s chargebacks by the previous month’s transactions; “Excessive Chargeback Merchant” starts at 1.5% and 100 chargebacks, “High Excessive” at 3% and 300.

Check where you stand with the chargeback ratio calculator. Prevention tools — 3-D Secure, clear descriptors, fast refunds, and pre-dispute alerts such as Ethoca and Visa RDR — target the main causes, including friendly fraud.

APMs, open banking and instant payments

Cards are not the only rail. Alternative payment methods — e-wallets, bank transfers and local schemes — often matter more in high-risk verticals because they have no card chargeback and different approval logic.

In the EU, the second Payment Services Directive (PSD2, Directive (EU) 2015/2366) created regulated payment initiation and account information services — the basis of open banking — and introduced strong customer authentication. National instant payment systems such as Pix in Brazil, UPI in India, SEPA Instant in Europe and Interac in Canada are now core cashier options for operators in those markets.

Crypto rails

Crypto processing lets merchants accept digital assets — most often stablecoins — and settle in crypto or fiat, while on-ramps let customers buy crypto with a card or bank transfer. The providers involved are virtual asset service providers: under FATF Recommendation 16 (the travel rule) they must pass originator and beneficiary information with transfers, and in the EU crypto-asset service providers are licensed under MiCA (Regulation (EU) 2023/1114). A crypto rail removes card chargebacks, but not KYC/AML duties, and Visa’s VIRP lists crypto merchants on cards in Tier 2.

Choosing and cascading providers

No single provider is enough for most high-risk merchants. Cascading retries a declined payment through another provider, smart routing picks the provider most likely to approve each transaction, and payment orchestration platforms manage several PSPs behind one integration. The goal is a higher approval rate and resilience when one provider fails or closes the account.

Before signing, do your own due diligence on the provider, just as it runs KYB on you:

• Whose licence and acquirer are behind the account, and in which jurisdiction?
• Does the provider accept your licence, MCC and target countries in writing?
• Reserve terms, settlement schedule, chargeback and termination fees, and how long funds are held after termination.
• Uptime and incident history — follow it on PSP Pulse, our live status board built on providers’ own status pages.
• Security and compliance basics such as PCI DSS.

Who does this work

Payments in high-risk businesses are run by dedicated teams: payments and acquiring managers who negotiate and route, risk and anti-fraud specialists who keep ratios down, and AML/KYC teams who handle onboarding on both sides.