Visa VAMP

Active · Apr 1, 2025

Visa Acquirer Monitoring Program. Replaced VDMP (dispute monitoring) and VFMP (fraud monitoring) with a single combined ratio.

TierCombined ratioVolume floorEnforcement
Below Standard< 0.30%noneNo enforcement
Above Standard≥ 0.30%noneAcquirer monitoring + remediation plan
Excessive≥ 0.90%nonePer-dispute assessments + offboarding risk
  • Formula: (TC40 fraud + TC15 disputes) ÷ settled transactions, per calendar month
  • Volume floor: None — ratio applies at any volume
  • Exit: Below threshold for 3 consecutive months
  • Acquirer-level threshold: 0.50% combined ratio triggers acquirer-side Visa enforcement
  • Region notes: Combined ratio + thresholds are global; some regional acquirers add stricter internal limits

Full operator's guide: Visa VAMP Explained →

Mastercard ECM / ECP

Active · Long-standing

Excessive Chargeback Program (ECP) and Excessive Chargeback Merchant (ECM). Chargeback-only ratio with absolute count floor.

TierRatioVolume floorEnforcement
Below< 1.00%anyNone
ECP (Early Warning)≥ 1.00%≥ 100 chargebacksAcquirer monitoring begins
ECM (Full)≥ 1.50%≥ 100 chargebacksPer-dispute assessments + formal enrollment
  • Formula: chargeback count ÷ transaction count, per calendar month
  • Volume floor: 100 chargebacks in a single month required for enrollment
  • Exit: Both ratio + count below thresholds for 3 consecutive months
  • Nuclear outcome: Persistent ECM breach can lead to MATCH list placement (5-year ban from Mastercard processing)

Full operator's guide: How to Exit Mastercard ECM →

Mastercard EFM

Active · Less commonly triggered

Excessive Fraud Merchant — Mastercard's separate fraud monitoring track, distinct from chargeback-focused ECM.

TierRatioVolume floorEnforcement
Below< 0.50% (fraud-to-sales)anyNone
EFM≥ 0.50% fraud-to-sales≥ $50K monthly fraud + 1,000+ transactionsAcquirer enforcement + fines
  • Formula: fraud dollar amount ÷ total sales dollar amount, per month
  • Volume floor: $50,000 in monthly fraud AND 1,000+ transactions
  • Notes: EFM is dollar-based, not transaction-count-based. A subscription app with many small fraud transactions can stay under the $50K floor even at elevated fraud ratios

American Express CMP

Active · Bilateral enforcement

Chargeback Monitoring Program. Amex operates a closed loop (acquirer + issuer in one), so enforcement is typically more direct and faster than Visa/Mastercard.

IndicatorApproximate thresholdEnforcement
CMP entry threshold~1.00% chargeback ratioAmex risk team review
Immediate review~$1,000+ monthly chargeback exposureDirect merchant outreach
  • Note: Amex thresholds are less publicly documented than Visa/Mastercard. Specific values are typically disclosed only to merchants directly during enforcement
  • Volume floor: Effectively none for Amex — they can review at low volume
  • Exit: Bilateral; depends on Amex risk team assessment of remediation
  • Practical: For most subscription apps, Amex transaction share is small enough that Amex enforcement comes later than Visa/Mastercard

Discover Excessive Chargeback Merchant Program

Active · US-centric

Discover's program mirrors Mastercard ECM in structure — chargeback ratio + absolute count, with US-focused enforcement.

IndicatorApproximate thresholdEnforcement
Standard chargeback ratio~1.00%Discover risk monitoring
Excessive chargeback~1.50%+Per-dispute fines, processor escalation
  • Note: Discover's program is functionally similar to Mastercard ECM but with smaller volume and US-focused enforcement
  • Practical: Most subscription apps Discover-volume is <5% of total — enforcement here is rarely the binding constraint

MATCH List (Mastercard, cross-network reach)

Nuclear outcome

Member Alert to Control High-risk merchants. A 5-year placement that effectively bars the merchant principal from acquiring relationships across most major networks.

  • Owner: Mastercard maintains the list; queried by Visa and other networks during merchant onboarding
  • Duration: 5 years from placement
  • Common triggers: Excessive chargebacks, fraud convictions, identity theft, money laundering, bankruptcy/insolvency, illegal merchant activity
  • Reason codes: 13 numeric reason codes — for subscription apps, the most common are 12 (excessive chargebacks) and 04 (excessive fraud)
  • Exit: Not removable on demand; serves the full 5-year term unless successfully challenged
Avoiding MATCH — A merchant in active ECM/EFM with cooperative remediation rarely lands on MATCH. The list is generally reserved for merchants who failed to remediate, abandoned the account, or operated unlawfully. Diligent program-exit work is the primary preventive control.

What changed in 2025–2026

  • April 1, 2025: Visa VAMP took effect, replacing VDMP and VFMP with a single combined ratio. Many merchants comfortable under the split-program regime crossed the new combined threshold immediately on cutover.
  • Throughout 2025: Acquirers adjusted internal thresholds to align with VAMP — most major processors now flag merchants at 0.40-0.50% combined ratio for enhanced review (below the Visa 0.30% acquirer threshold).
  • Q4 2025: Stripe issued updated Radar default rule sets reflecting post-VAMP fraud patterns. Subscription apps on the old defaults were measurably more likely to cross VAMP Above-Standard.
  • 2026 outlook: No publicly announced threshold changes for Mastercard ECM/EFM. Visa has signaled it may publish quarterly VAMP ratio reports to merchants directly, currently delivered only through acquirers.
How this page is maintained. Threshold values are verified each calendar quarter against publicly available card network announcements, operating guide updates, and acquirer communications. Material changes between updates are noted with a dated revision below. If you spot a value that has changed and isn't yet reflected here, email me and I'll verify and update.

Use the calculator

To estimate your own current-month position against these thresholds, use the free interactive tool:

Open the Risk Calculator →

Related guides

Approaching a threshold?

Need a structured exit playbook?

The 90-day rescue program ships working code, deployed rules, and compliance documents the processor accepts — not slides.

Book an Intro Call → See the Rescue Program