What Makes a Business High Risk to a Payment Processor

Why does the acquirer care about your risk?

When a customer disputes a charge, the money is pulled back from the merchant. If the merchant's account is empty or the business has closed, the acquirer still owes the card network. Visa's Acceptance Risk Standards (opens in a new tab) say plainly that acquirers are liable for the actions of their merchants, and they require every acquirer to set a written risk appetite and an underwriting policy for different business segments.

Underwriting is the review an acquirer does before approving an account. Visa's standards tell acquirers to sort merchants into risk categories such as low, medium and high, with examples of higher-risk activity that include future sales, Visa's high integrity risk categories, and payment links sent by chat or email. The OCC's 2008 guidance to banks on payment processor relationships (opens in a new tab) similarly tells banks to check merchants' creditworthiness and business practices, with tighter controls for merchant types that show high return and chargeback rates.

Which industries are flagged by the card networks?

Every merchant account is assigned a merchant category code (MCC), a four-digit number that describes the type of business. Acquirers must assign the MCC that most accurately describes what the merchant sells, which is why describing the business honestly on the application matters.

Visa groups certain legal but sensitive business types into its Visa Integrity Risk Program (opens in a new tab) (VIRP). Visa defines these as businesses that are legal but, without proper controls, face a higher risk of processing illegal transactions. In the April 2023 document, the program has three tiers, and every listed category is defined for card-absent (online, phone or mail) sales:

Under the program, the acquirer must hold a Visa high integrity risk registration and, with one exception for pharmacies accredited by NABP or certified by LegitScript, must register each of these merchants with Visa before processing for them. Visa reassesses the list periodically, so confirm the current version with your processor. Businesses outside these tiers can still be high risk to a given acquirer, since each sets its own risk appetite.

How do chargebacks and refunds affect your risk rating?

A chargeback is a card payment reversed through the card network after a customer disputes it. The chargebacks explainer covers how disputes work. For underwriting, what matters is the pattern: Visa's standards tell acquirers to review a merchant's prior processing history, including past terminations, excessive chargebacks and fraud, and to check that dispute and refund levels fit the type of business.

Your chargeback ratio, the share of transactions that turn into disputes, sums up that pattern; the article on chargeback ratios explains the calculation.

What else raises the risk?

Paying now, delivering later

Visa's standards single out future-service merchants, businesses paid well before they deliver, for credit risk monitoring. If the business fails before it delivers, customers can dispute the charges, and the acquirer may have to absorb what the merchant cannot repay.

Example (illustrative numbers): a venue sells $40,000 of tickets a month for events about five months out. At any given time it holds roughly $200,000 of sales for events that have not happened yet. If the venue closes, the acquirer's possible exposure is close to that full amount.

Card-not-present sales

Card-not-present (CNP) sales are made online, by phone or by mail, without the physical card. Visa's standards tell acquirers to watch for changes in a merchant's mix of card-present and card-absent sales, and every high integrity risk category in Visa's April 2023 document is defined for card-absent selling.

Legal and regulatory exposure

Visa's standards require acquirers to make sure each transaction is legal in both the merchant's and the cardholder's jurisdictions. Businesses whose legality varies by location, or that need licenses, get more scrutiny. Models Visa links to deceptive marketing, such as negative option subscriptions, sit in its Tier 3.

Owners, credit and finances

Underwriting covers the people behind the business: credit history, financial statements, existing debts, public records and ownership. Weak finances matter most when exposure is large, as with prepayment.

What happens when you are classified as high risk?

Visa's standards describe three possible outcomes for an application: approve, decline, or approve with conditions. Conditions can include reserves, holds on funds, limits on business activity or personal guarantees. A reserve is money the acquirer holds back from settlements to cover future losses; the guide to rolling reserves explains how they work.

Other common effects:

• Pricing: reserves and holds tie up funds, and rates are negotiated separately, so ask for every fee in writing.
• Documentation: Visa's standards describe reviews of identity and ownership, business licenses, financial statements, prior processing history, websites, delivery methods and return policies. The step-by-step approval guide covers the application itself.
• Ongoing monitoring: acquirers watch for sudden changes in volume, refunds, disputes and the online share of sales.

What is the MATCH list?

MATCH (Member Alert to Control High-Risk Merchants) is Mastercard's shared database of merchants terminated for cause. Visa runs a similar file called VMSS, and its standards require acquirers to check terminated merchant files before signing a new merchant. According to Stripe's documentation on terminated merchant files (opens in a new tab), a processor's summary of Mastercard's rules, as of October 2026:

• Reasons for listing include fraud, data compromise, laundering, PCI DSS non-compliance and excessive chargebacks.
• The excessive chargeback code applies when monthly Mastercard chargebacks exceed 1% of monthly Mastercard sales transactions and total $5,000 or more in the same month.
• Listings stay active for five years, and generally only the acquirer that added the listing can remove or correct it.

Thresholds change, so confirm current criteria with your processor. A listing makes approval elsewhere much harder, which is one more reason to keep disputes and data security under control.