Visa VAMP

Active · Jun 1, 2025

Visa Acquirer Monitoring Program. Replaced the retired VDMP (dispute monitoring) and VFMP (fraud monitoring) with a single combined, count-based ratio. There is exactly one merchant tier — Excessive; the "Above Standard" tier exists only at the acquirer level. Figures per Visa's VAMP fact sheet (PDF).

TierLevelCombined ratioMinimum activityEnforcement
Excessive MerchantMerchant≥ 1.50%≥ 1,500 fraud+disputes/moRemediation + offboarding risk; per-transaction assessments per acquirer advisories
Above StandardAcquirer≥ 0.50%portfolio-levelAcquirer-side Visa enforcement
ExcessiveAcquirer≥ 0.70%portfolio-levelAcquirer-side Visa enforcement, escalated
Enumeration monitoringMerchant≥ 20% enumeration ratio≥ 300,000 enumerated auths/moMonitoring only — no fines assessed
  • Formula: count of (TC40 fraud + TC15 disputes) ÷ count of settled (TC05) card-not-present VisaNet transactions, per calendar month — count-based, not dollar-based
  • Merchant threshold: 1.5% since April 1, 2026 in AP, Canada, EU, and US (reduced from 2.2%); LAC was already 1.5%; CEMEA remains 2.2%
  • Minimum-count gate: the ratio only applies at ≥1,500 fraud+dispute transactions per month (CEMEA: ≥150 and ≥USD 75,000)
  • Exclusions: disputes resolved via RDR/CDRN pre-dispute tools and TC40s qualified under Compelling Evidence 3.0 are excluded from the numerator
  • Acquirer vs merchant: merchant-level thresholds apply only when the merchant's acquirer is itself below Above Standard (<0.5%)
  • Exit: identification reassessed monthly — Visa publishes no formal multi-month exit window

Full operator's guide: Visa VAMP Explained →

Mastercard ECP (ECM & HECM tiers)

Active · Long-standing

Excessive Chargeback Program (ECP) is the program; its two tiers are ECM (Excessive Chargeback Merchant) and HECM (High Excessive Chargeback Merchant). Both tiers require the chargeback count and the ratio to be breached. Figures per Stripe's monitoring-programs documentation.

TierChargeback countRatioEnforcement
Below ECP< 100/moor < 1.50%None
ECM100–299/mo1.50%–2.99%Monthly fines from month 2 (up to $100k at month 19+)
HECM≥ 300/mo≥ 3.00%Steeper fines: $100k months 12–18, $200k month 19+
  • Formula: current-month chargeback count ÷ preceding month's captured transaction count
  • ECM fines: Mo 1: $0 · Mo 2–3: $1,000 · Mo 4–6: $5,000 · Mo 7–11: $25,000 · Mo 12–18: $50,000 · Mo 19+: $100,000
  • HECM fines: Mo 1: $0 · Mo 2: $1,000 · Mo 3: $2,000 · Mo 4–6: $10,000 · Mo 7–11: $50,000 · Mo 12–18: $100,000 · Mo 19+: $200,000
  • Issuer Recovery Assessment: USD 5 per chargeback above 300, from month 4 onward, in both ECM and HECM. Example: a month-4 ECM merchant with 400 disputes owes $5,000 + (400−300)×$5 = $5,500
  • Exit: Both ratio + count below thresholds for 3 consecutive months
  • Nuclear outcome: Persistent breach can lead to MATCH list placement (5-year ban from Mastercard processing)

Full operator's guide: How to Exit Mastercard ECM →

Mastercard EFM

Active · Less commonly triggered

Excessive Fraud Merchant — Mastercard's separate fraud monitoring track, distinct from chargeback-focused ECM.

TierRatioVolume floorEnforcement
Below< 0.50% (fraud-to-sales)anyNone
EFM≥ 0.50% fraud-to-sales≥ $50K monthly fraud + 1,000+ transactionsAcquirer enforcement + fines
  • Formula: fraud dollar amount ÷ total sales dollar amount, per month
  • Volume floor: $50,000 in monthly fraud AND 1,000+ transactions
  • Notes: EFM is dollar-based, not transaction-count-based. A subscription app with many small fraud transactions can stay under the $50K floor even at elevated fraud ratios

American Express CMP

Active · Bilateral enforcement

Chargeback Monitoring Program. Amex operates a closed loop (acquirer + issuer in one), so enforcement is typically more direct and faster than Visa/Mastercard.

IndicatorApproximate thresholdEnforcement
CMP entry threshold~1.00% chargeback ratioAmex risk team review
Immediate review~$1,000+ monthly chargeback exposureDirect merchant outreach
  • Note: Amex thresholds are less publicly documented than Visa/Mastercard. Specific values are typically disclosed only to merchants directly during enforcement
  • Volume floor: Effectively none for Amex — they can review at low volume
  • Exit: Bilateral; depends on Amex risk team assessment of remediation
  • Practical: For most subscription apps, Amex transaction share is small enough that Amex enforcement comes later than Visa/Mastercard

Discover Excessive Chargeback Merchant Program

Active · US-centric

Discover's program mirrors Mastercard ECM in structure — chargeback ratio + absolute count, with US-focused enforcement.

IndicatorApproximate thresholdEnforcement
Standard chargeback ratio~1.00%Discover risk monitoring
Excessive chargeback~1.50%+Per-dispute fines, processor escalation
  • Note: Discover's program is functionally similar to Mastercard ECM but with smaller volume and US-focused enforcement
  • Practical: Most subscription apps Discover-volume is <5% of total — enforcement here is rarely the binding constraint

MATCH List (Mastercard, cross-network reach)

Nuclear outcome

Member Alert to Control High-risk merchants. A 5-year placement that effectively bars the merchant principal from acquiring relationships across most major networks.

  • Owner: Mastercard maintains the list; queried by Visa and other networks during merchant onboarding
  • Duration: 5 years from placement
  • Common triggers: Excessive chargebacks, fraud convictions, identity theft, money laundering, bankruptcy/insolvency, illegal merchant activity
  • Reason codes: 13 numeric reason codes — for subscription apps, the most common are 12 (excessive chargebacks) and 04 (excessive fraud)
  • Exit: Not removable on demand; serves the full 5-year term unless successfully challenged
Avoiding MATCH — A merchant in active ECM/EFM with cooperative remediation rarely lands on MATCH. The list is generally reserved for merchants who failed to remediate, abandoned the account, or operated unlawfully. Diligent program-exit work is the primary preventive control.

What changed in 2025–2026

  • March 31, 2025: Legacy VDMP and VFMP retired. Their 0.9% Standard tiers are historical only and no longer apply anywhere.
  • June 1, 2025: Visa VAMP took effect with a single combined fraud-plus-dispute ratio, advisory-only through September 30, 2025.
  • October 1, 2025: VAMP enforcement began — merchant Excessive at 2.2% (LAC at 1.5%).
  • April 1, 2026: Merchant Excessive reduced to 1.5% in AP, Canada, EU, and US. CEMEA remains at 2.2%.
  • 2026 outlook: No publicly announced threshold changes for Mastercard ECP/EFM.

Threshold changelog

DateChangeSource
2025-03-31Legacy VDMP and VFMP retired (0.9% Standard tiers are historical only)Visa VAMP fact sheet (PDF)
2025-06-01VAMP effective — advisory period only, no enforcementVisa VAMP fact sheet (PDF)
2025-10-01VAMP enforcement begins — merchant Excessive 2.2% (LAC 1.5%)Visa VAMP fact sheet (PDF)
2026-04-01Merchant Excessive reduced to 1.5% in AP, Canada, EU, US — CEMEA stays 2.2%Visa VAMP fact sheet (PDF)
2026-06-10Page last verified against Visa and acquirer documentationStripe monitoring-programs docs

Machine-readable version of every figure on this page: Download the dataset (JSON) · maintained with a dated changelog on GitHub (CC BY 4.0).

How this page is maintained. Threshold values are verified each calendar quarter against publicly available card network announcements, operating guide updates, and acquirer communications. Material changes between updates are noted with a dated revision below. If you spot a value that has changed and isn't yet reflected here, email me and I'll verify and update.

FAQ

How often are these thresholds updated by the card networks?

Card networks update programs roughly every 2-4 years, usually announced with a 6-12 month transition window. Visa's most recent change sequence: legacy VDMP and VFMP retired March 31, 2025; VAMP took effect June 1, 2025 (enforcement from October 1, 2025); the merchant Excessive threshold dropped from 2.2% to 1.5% on April 1, 2026 in AP, Canada, EU, and US (CEMEA stays at 2.2%). Mastercard's ECP program has been structurally stable for years. Amex and Discover thresholds change less publicly and are usually negotiated bilaterally with acquirers.

Are these the official sources?

Visa VAMP figures on this page are verified against Visa's own VAMP fact sheet PDF; Mastercard ECP figures (ECM and HECM tiers, fine schedules) are verified against acquirer documentation such as Stripe's monitoring-programs docs. Each card network publishes its compliance rules in operating regulations that acquirers receive directly; merchants typically see these only through their acquirer or by reading network announcements. The page is updated quarterly or when a material change is announced.

Why don't I see my acquirer's specific thresholds?

Acquirers (Stripe, Adyen, Braintree, Checkout.com, etc.) often layer additional internal risk thresholds on top of the network-level programs. For example, a processor might place a merchant under enhanced review well below the VAMP merchant Excessive line of 1.5%, because the acquirer itself is monitored at 0.5% (Above Standard) and 0.7% (Excessive) across its whole portfolio. Those internal thresholds are processor-specific and usually disclosed only in the merchant agreement.

What's the difference between fraud monitoring and chargeback monitoring?

Fraud monitoring tracks first-party fraud reports (TC40 messages on Visa) — transactions reported to the issuing bank as unauthorized. Chargeback monitoring tracks dispute reason codes including non-fraud disputes (product not received, subscription cancellation, etc.). VAMP's innovation in June 2025 was combining both into a single count-based ratio. Mastercard's ECP program remains chargeback-only; a separate Mastercard Excessive Fraud Merchant (EFM) program tracks fraud independently.

Use the calculator

To estimate your own current-month position against these thresholds, use the free interactive tool:

Open the Risk Calculator →

Related guides

Approaching a threshold?

Need a structured exit playbook?

The 90-day rescue program ships working code, deployed rules, and compliance documents the processor accepts — not slides.

Book an Intro Call → See the Rescue Program
Georges Rayess
About the author

Georges Rayess is a Product Manager & Fraud/AI Consultant. Product Manager since 2020 at a privacy-focused subscription mobile app with 200,000+ active users — drove the chargeback rate from 13% to below 1% and exited Mastercard ECM with compliance documents accepted by the processor.

Watch · walkthrough

Every Card-Network Chargeback Threshold, One Page (VAMP, ECM, EFM, Amex)

The exact point each card network steps in — verified against public network documentation. Visa VAMP (effective April 1, 2025) uses one combined fraud-and-d...
Video transcript

Note: this video was recorded before the April 2026 threshold update. Corrected figures as of 10 June 2026 — Visa VAMP has one merchant tier, Excessive, at a 1.5% combined fraud-plus-dispute ratio with a 1,500 fraud+dispute monthly minimum (CEMEA 2.2%); acquirer tiers sit at 0.5% and 0.7%. Mastercard's ECP program tiers are ECM (100–299 chargebacks and 1.5%–2.99%) and HECM (300+ and 3.0%+). See the changelog above.

Every threshold, on one page — the exact point each card network steps in, verified against public network documentation across Visa, Mastercard, Amex, and Discover.

Start with Visa VAMP. It uses one combined ratio: fraud plus disputes, divided by settled transactions, bringing acquirer monitoring, remediation plans, and offboarding risk at the Excessive tier.

Mastercard's ECP program is chargeback-only, plus an absolute count floor. ECM, the lower tier, brings monthly fines and formal enrollment; HECM, the higher tier, brings a steeper fine schedule. Exit requires both the ratio and the count below threshold for three consecutive months.

Three more, side by side. Mastercard EFM is fraud-to-sales at 0.50% — but it is dollar-based, needing $50K in monthly fraud and 1,000-plus transactions to trigger. American Express CMP sits around 1.00%; because Amex is a closed loop, enforcement is faster and more direct. Discover's excessive tier sits around 1.50%, mirroring Mastercard's structure with US-focused enforcement. The programs don't share a formula — the same month can breach one program and miss another entirely.

Above all of them sits the MATCH list: a 5-year placement Mastercard maintains, which Visa and other networks query when you open a new merchant account. Remediate and you rarely land there — MATCH is for the merchants who walked away. This page is verified every quarter; bookmark it, then run your numbers through the free risk calculator.

Continue learning

Card Network Monitoring Programs

The full landscape of card network compliance programs subscription apps need to know.

Read →

VAMP Survival Guide

Visa Acquirer Monitoring Program explained — combined ratio formula and thresholds.

Read →

ECM Exit Guide

The 90-day playbook to exit Mastercard ECM, including the five chargeback root causes.

Read →