In short
- Since 1 April 2026, Visa flags an EU merchant once fraud reports and disputes reach 1.5% of card-not-present sales and at least 1,500 cases a month.
- Mastercard's programme starts at around 100 chargebacks and 1.5%, and it divides this month's chargebacks by last month's sales.
- The reserve, not the fee, is what hurts cash flow: a 10% rolling reserve held for 180 days on EUR 400,000 a month ties up EUR 240,000.
- Stablecoins settled to EUR through a licensed provider add a second route with no chargebacks, but they do not replace cards for every customer.
Your acquirer judges you on one number that it checks every month: how many of your card payments come back as fraud reports or disputes. A high risk merchant account is the arrangement a bank or processor offers when it expects that number to be high, and it prices the risk in reserves, fees and tighter limits.
Since 1 April 2026, Visa flags a merchant in the EU, the US, Canada and Asia Pacific once fraud and disputes reach 1.5% of card-not-present sales and at least 1,500 cases a month. Mastercard's programme, according to acquirers' published guides, starts at around 100 chargebacks and 1.5%. This guide explains why banks refuse or cap high-risk businesses, how those thresholds work, what reserves cost you in cash flow, how to pick a provider, and why stablecoin payments settled to EUR through a licensed provider have become a second route for merchants whose card processing is under pressure.
What makes a business a high risk merchant?#
A high risk merchant is a business that banks and card schemes expect to produce more chargebacks, fraud or regulatory trouble than average. The label is statistical, not moral. A licensed, profitable company can be high risk simply because of what it sells, how it bills or where its customers are. Acquirers build these judgements from years of transaction data across their portfolios, so a single merchant with clean history can still inherit the reputation of its vertical. The usual triggers are the industry (gambling, adult content, crypto, CBD and supplements, travel and ticketing), the sales model (card-not-present, subscriptions, free trials that convert to paid plans, delivery weeks after payment), the customer base (cross-border cards, several regions at once), and history (a past chargeback problem, a previous account closed, fast growth with no track record). Mastercard writes part of this list into its rules. Its Security Rules and Procedures (edition of 4 August 2026) make acquirers register "specialty merchants" by category code before processing for them.
Those categories include non-face-to-face adult content (MCC 5967 and 7841), non-face-to-face gambling (7801, 7802, 7995), cryptocurrency merchants (6051), high-risk securities (6211) and negative option billing merchants that sell physical products on subscription (5968). If your business sits in one of these codes, your acquirer has extra paperwork and extra monitoring for you before the first payment.
Why do banks refuse high risk merchant accounts?#
Banks refuse high-risk businesses because the acquirer, not the merchant, answers to Visa and Mastercard for what goes wrong. When a cardholder wins a dispute, the money comes back from the acquirer, which then tries to recover it from you. If you have closed or run out of cash, the loss stays with the bank. Each scheme also watches the acquirer's whole portfolio. Under Visa's Acquirer Monitoring Program, an acquirer is "Above Standard" when its fraud-and-dispute ratio reaches 0.5% and "Excessive" at 0.7%, according to Visa's 2025 fact sheet. A few problem merchants can push a mid-sized acquirer over that line and bring scheme scrutiny on everything it processes. Visa's fact sheet says it plainly: "Entities identified as exceeding program thresholds are required to implement risk mitigation control measures." So the acquirer's choice is rarely between accepting and refusing you. It is between accepting you on terms that cover its exposure, and not accepting you at all.
Approval has also become harder to get. Card schemes require acquirers to register merchants in specialty categories such as gambling and crypto before processing for them, so a bank that wants to add such merchants faces extra review and extra monitoring of its whole portfolio.
What are the Visa VAMP and Mastercard ECP chargeback limits in 2026?#
Visa and Mastercard each run a monitoring programme with a ratio and a minimum count, and a merchant is caught only when both are exceeded. Visa's programme is VAMP, the Visa Acquirer Monitoring Program. In 2025 it replaced the separate Visa Dispute Monitoring Program (VDMP) and Visa Fraud Monitoring Program (VFMP), so guides that still quote a 0.9% VDMP limit describe a programme that no longer exists. Mastercard's is the Excessive Chargeback Program (ECP), with two levels: Excessive Chargeback Merchant (ECM) and High Excessive Chargeback Merchant (HECM). The two schemes count different things. Visa adds fraud reports from card issuers to disputes; Mastercard counts chargebacks only, and divides this month's chargebacks by last month's sales. Once a merchant is flagged, the scheme expects the acquirer to act, and the acquirer passes the pressure on: a remediation plan, a higher reserve, lower limits or a closed account.
Visa VAMP#
According to the Visa Acquirer Monitoring Program fact sheet, the VAMP ratio is the count of fraud reports (TC40) plus disputes (TC15), divided by the count of settled card-not-present transactions. Disputes resolved through pre-dispute tools and fraud cases that qualify for Compelling Evidence 3.0 are excluded. A merchant is "Excessive" at 2.2% and at least 1,500 fraud reports and disputes a month; on 1 April 2026 the ratio dropped to 1.5% in Asia Pacific, Canada, the EU and the US. Latin America already used 1.5%. In the CEMEA region the limit stays at 2.2% with a lower count of 150 cases and at least USD 75,000.
A fraud report counts even when the cardholder never files a dispute. Refunding a suspicious order does not remove the issuer's fraud report from your ratio.
Mastercard ECP#
Mastercard defines the ratio in basis points: chargebacks received in a calendar month divided by the merchant's Mastercard transactions in the preceding month, multiplied by 10,000. The exact limits sit in Mastercard's rules manual; acquirers' published guides, for example Braintree's, list them as 100 to 299 chargebacks with a ratio of 1.50% to 2.99% for ECM, and 300 or more chargebacks at 3.00% or above for HECM. To leave the programme, a merchant must stay below the ECM thresholds for three consecutive months. Because the divisor is last month's sales, a slow month after a busy one pushes the ratio up even if disputes stay flat. After six months in the programme, Mastercard may require the acquirer to undergo a formal risk review, according to the Mastercard Security Rules and Procedures.
Key moments
| Programme | What is counted | Merchant threshold (EU) | Minimum count | How you exit |
|---|---|---|---|---|
| Visa VAMP | Fraud reports + disputes ÷ settled card-not-present sales | 1.5% (since 1 April 2026) | 1,500 a month | Ratio back under the limit |
| Mastercard ECM | Chargebacks this month ÷ sales last month | 1.50% to 2.99% | 100 to 299 a month | Set by Mastercard's rules |
| Mastercard HECM | Same as ECM | 3.00% or more | 300 or more a month | Set by Mastercard's rules |
The MATCH list#
The heaviest consequence is a MATCH listing. MATCH is Mastercard's list of merchants whose acquirers terminated them for specific reasons, excessive chargebacks among them. Other acquirers check that list before they sign anyone, so a listing follows a business from bank to bank.
How much does a high risk merchant account cost?#
A high risk merchant account usually costs more in three ways: higher processing fees, a reserve that holds back part of your money, and stricter contract terms. The reserve is the one that hurts cash flow. In a rolling reserve, the acquirer keeps a percentage of each day's card sales and releases it after a fixed period, so there is always a cushion to pay chargebacks if you stop trading. Some acquirers instead ask for a fixed upfront deposit or hold back the first weeks of settlements. Reserve percentages and hold periods are set contract by contract; there is no scheme rule that fixes them. Underwriting is also slower and deeper than for a standard account: expect to show company documents, beneficial owners, processing history, refund and cancellation policies, website terms, proof of fulfilment and, in regulated industries, your licence. The account will often come with a monthly volume cap that rises only after a clean track record.
An illustration with round numbers shows the effect. A subscription business processes EUR 400,000 a month in card sales. Its contract sets a 10% rolling reserve released after 180 days. Each month EUR 40,000 is held back, and nothing comes back for six months. By then the acquirer holds EUR 240,000 of your revenue. That is working capital you cannot spend on marketing or stock, and it is why the reserve terms matter as much as the headline rate when you compare offers.
Can a high risk ecommerce business get a merchant account?#
Yes, but usually on high-risk terms rather than as a standard account. An online store sells card-not-present by definition, which is exactly the traffic Visa's VAMP ratio measures, so an ecommerce business in a risky vertical such as supplements, CBD, travel or subscriptions is priced on its dispute risk from the first day.
What improves the odds is the evidence an underwriter asks for anyway: a clear refund and cancellation policy on the site, proof of fulfilment such as tracking numbers, a billing descriptor customers recognise on their statement, and processing history from a previous provider. Subscriptions and free trials need explicit consent at checkout and an easy way to cancel; Mastercard makes acquirers register merchants that sell physical products on subscription as negative option billing merchants (MCC 5968). Expect a monthly volume cap at the start that rises only after a clean track record.
How do you choose a high risk merchant account provider?#
Choose a provider on whether it can keep you processing for years, not on its headline rate. In high-risk verticals, the expensive event is a sudden account closure or a frozen settlement; a few tenths of a percent in fees matter far less. Ask who the actual acquiring bank is: many high-risk offers come from resellers who place you with a bank they do not control, and the bank's risk appetite is what decides whether you stay. Ask how many merchants in your vertical the bank already serves, because an acquirer with no gambling or crypto merchants can drop the whole category after one bad month. Ask for every reserve term in writing, including how and when it is released after the contract ends. Ask which dispute tools the provider supports, since Visa excludes cases resolved through pre-dispute solutions from the VAMP ratio. And ask for the notice period before termination, plus what happens to funds held at that moment.
Spreading risk helps too. Merchants that run several providers at once often route traffic between them through payment orchestration across providers, so losing one account does not stop sales. Keep each account healthy on its own: the schemes measure ratios per merchant ID, and splitting traffic to hide a dispute problem is exactly what acquirers and schemes look for.
I would add one test of my own: ask the provider what it did for its last merchant that crossed the VAMP threshold. A specific answer about remediation plans and dispute tools tells you more than a sales deck.
Is there an alternative to a high risk merchant account?#
Stablecoin payments give high-risk businesses a payment channel that sits outside the card schemes, so there is no chargeback, no scheme monitoring ratio and no card reserve. A customer sends USDC or another stablecoin from a wallet or an exchange account; a licensed provider receives it, converts it and pays euros to your IBAN. A blockchain transfer cannot be reversed by the payer's bank or by a card scheme. If a customer wants money back, you decide whether to refund, as you would with a bank transfer. That makes the route attractive for merchants whose card processing is squeezed by disputes: travel sellers with long delivery windows, subscription businesses, digital goods. It is not a replacement for cards for every customer. Many shoppers do not hold stablecoins, and conversion at checkout will be lower than for a card button. The realistic goal is a second route that takes part of the volume, especially from repeat and higher-value customers, and keeps revenue moving when a card account is capped or closed.
The other payment methods high-risk merchants try are not free of reversals either. Under PSD2, Article 77, a payer can ask for a refund of a SEPA direct debit for 8 weeks after the money was taken.
| Route | Can the payer reverse it? | Scheme monitoring | Typical holdback | Money arrives as |
|---|---|---|---|---|
| Cards via high-risk acquirer | Yes, through chargebacks | VAMP and ECP ratios | Rolling reserve or deposit | EUR, after settlement and reserve |
| SEPA direct debit | Yes, refund on request for 8 weeks | Bank's own limits | Often a deposit or cap | EUR |
| Stablecoins via licensed provider | No, refunds are your decision | None from card schemes | None from card schemes | EUR on your IBAN after conversion |
Check the provider's licence. Under MiCA, the EU crypto-asset regulation, nobody may provide crypto-asset services in the Union without authorisation as a crypto-asset service provider (CASP), and the transition for firms operating under national rules ended on 1 July 2026 (Article 143(3)). As a merchant you normally do not need that licence yourself; the provider that converts the stablecoins does. We explain the checks in our guide to choosing a crypto to fiat payment gateway.
Where it does not help
- Many shoppers do not hold stablecoins, so conversion at checkout will be lower than for a card button.
- Stablecoins do not change your own regulatory status: an online casino still needs its gambling licence.
- The licensed provider runs its own KYB review, so a business it considers too risky can be refused there as well.
What should you do if your card processing is under pressure?#
Start with your numbers, then add routes. Pull last month's fraud reports, disputes and settled card-not-present sales for each merchant ID and compute both ratios: Visa's (fraud plus disputes over sales) and Mastercard's (this month's chargebacks over last month's sales). If either is climbing toward 1.5%, act before the schemes do: add pre-dispute tools, clearer billing descriptors and easier cancellation. Read your reserve terms and work out how much cash your high risk merchant account holds back today. Then decide which customers could pay another way, and set up the second route before you need it. Merchants who wait until the termination letter arrives usually lose weeks of revenue while they find an alternative. If you want the operational side of the second route in more detail, see our guide on how to accept crypto payments automatically.
If you want to accept stablecoins and receive euros without building the stack yourself, ItisPay provides the API, invoicing and reconciliation. Licensing, KYC and settlement to your IBAN run through our EU-licensed CASP + Payment Institution partner, and onboarding, from KYB to first transaction, can be completed in under a week. Whether your business model qualifies is decided in the partner's KYB review.
This article is for informational purposes only and does not constitute legal or regulatory advice.
