VAMP in 2026: New Thresholds for High-Risk Merchants

VAMP guidelines 2025
VAMP guidelines 2025

VAMP stopped being a future problem on 1 April 2026. The merchant threshold dropped. The ratio now counts things it did not count before. A shop that was comfortably compliant in March can be enrolled in April. Nothing about how it sells has to change.

This is what the programme looks like now and what the numbers mean. And what to do if your ratio is drifting towards the line.

Contents

What VAMP is, in plain words

VAMP is the Visa Acquirer Monitoring Program. It watches fraud and disputes at the level of an acquirer. Inside that, it watches individual merchants. It is not a law and not a court. It is a measurement with thresholds attached, run by the card scheme. Its output is enrolment, fees and pressure from your acquirer.

Nobody sends you a warning letter from Visa. You hear about it from your provider, usually with a deadline already attached.

What changed on 1 April 2026

  • The merchant excessive threshold fell from 2.2% to 1.5%. That is a 32% tightening of the headline number in a single step.
  • The acquirer thresholds tightened from 1 January 2026: 0.5% above standard, 0.7% excessive.
  • The ratio counts fraud and disputes together. Reported fraud (TC40) plus disputes (TC15), divided by settled card-not-present transactions.
  • Enrolment carries a fee of 8 USD per fraudulent or disputed transaction. A first violation in a rolling twelve months gets a three-month grace period.

These figures are the published state of the programme as of September 2026. Scheme rules change. Your acquirer may apply stricter internal limits than Visa does. Treat the numbers as the floor of the conversation, not the whole of it.

Why your ratio can rise without a single new chargeback

This is the part that catches people. Fraud reports are filed by issuers when a cardholder says a transaction was not theirs. Many of those never become chargebacks. The issuer writes it off. Or the customer is refunded. Or nothing further happens at all.

Under the current ratio, those reports count anyway. So the number can climb even where chargebacks are flat and refunds are prompt. The numerator now includes events that never touched the dispute process.

Two practical consequences. First, refunding quickly no longer removes the whole problem: it prevents the dispute, not the fraud report. Second, your own dashboard is not enough. Ask your provider for the fraud-report side of the number. That is the half you cannot see.

The thresholds, in one place

  • Merchant, excessive: 1.5% from 1 April 2026.
  • Acquirer, above standard: 0.5%.
  • Acquirer, excessive: 0.7%.
  • Enumeration (card testing) is monitored separately, on its own ratio and volume triggers.
  • Small merchants are not enrolled below the programme’s minimum monthly count of fraud and dispute events. The acquirer can and does act long before Visa would.

Only card-not-present transactions go into the calculation, which is why this programme bites e-commerce and subscription businesses hardest.

Who is most exposed

Not the biggest merchants — the ones with a thin denominator and a lumpy numerator. A shop doing a few thousand transactions a month reaches 1.5% with a couple of dozen events. Three things move the number fast. A campaign that brings unusual traffic. A product that generates “I did not recognise this” calls. A subscription that renews quietly. Each one moves it faster than volume can dilute it.

How to stay below the line

  • Make the descriptor recognisable. The shop name the buyer used, not a holding company. Unrecognised lines are the single largest source of fraud reports.
  • Answer faster than the bank. A customer who reaches you does not reach their issuer.
  • Refund the marginal cases the same day. It costs less than a dispute and it stops the escalation.
  • Warn before every recurring charge, and make cancellation a single screen.
  • Rate-limit card testing: caps on attempts per card, per address and per session, plus a hold on first orders.
  • Read declines by reason, not as one percentage — a rising share from one issuer or one country is a signal, not noise.

A thirty-day plan when the number is drifting

Week one: get the exact definition from your provider. Which month counts the fraud reports, which month counts the transactions, and what is included. Fix the descriptor. Refund everything borderline.

Week two: sort the events by reason, product and traffic source. One row almost always dominates. Fix that row rather than tightening every rule you have.

Week three: recover the good declines — proper retries, full data in the authorisation, a second acceptance channel where it helps. Do not buy volume to dilute the ratio: it works for a month and produces the next letter two months later.

Week four: report your own progress to the provider, weekly, with the number and what you changed. A merchant who reports is treated differently from one who goes quiet.

A simplified example

A shop settles 20,000 card-not-present transactions in a month. Fraud reports: 180. Disputes: 140. The ratio is 320 divided by 20,000, which is 1.6% — above the 1.5% line, with chargebacks alone at only 0.7%. The half that pushed it over is the half most merchants never look at.

Where the cost lands

Programme fees are only part of the bill. On our side the figures are these. A chargeback costs 100.00 EUR on top of the returned amount. A refund costs 50.00 EUR. MDR runs 3%–5% depending on the type of business, plus 0.50 EUR per transaction. Settlement in EUR over SEPA is 0.20% at T+7. The rolling reserve is 10% for 180 days. The published lines sit on the pricing page, and the exact figure is set per merchant.

The reserve exists because of the risk this programme measures. So a stable ratio is the strongest argument you have when asking for a review.

Align the ratio with your processing setup

Two things do most of the work here. A second acceptance channel means a retry can be routed, not repeated into the same wall. Clean reporting means you see the number first, before your provider has to tell you. Both are part of how payment processing is set up rather than something bolted on afterwards.

What to put in place

  • A weekly view of fraud reports and disputes as separate lines.
  • A refund rule support can apply without asking anyone.
  • Evidence collected at the time of sale, not at the time of dispute.
  • A named owner for the number, and a date each month when it is read.

Then VAMP becomes a metric you manage, and the merchant account keeps the terms you signed up for. Conditions depend on the vertical, the documents and the processing history, and each case is assessed individually.

Read next