--- title: "High-Risk Payment Processing: A Guide for PSPs" description: "High-risk payment processing for PSPs and acquirers: who counts as high risk, who carries the liability, Visa VAMP thresholds, reserves and gateway setup." url: "https://ecomcharge.com/guides/high-risk-payment-processing/" lang: "en" date_published: "2026-11-12" last_updated: "2026-11-12" author: "Oksana Mikhailovskaya" image: "https://ecomcharge.com/static/assets/img/guides/high-risk-payment-processing/preview.7a7e46237f08.jpg" breadcrumbs: "Home > Guides > High-Risk Payment Processing: Scheme Rules, Monitoring and the Gateway You Need" --- [Guides](https://ecomcharge.com/guides/) White Label # High-Risk Payment Processing: Scheme Rules, Monitoring and the Gateway You Need ![Oksana Mikhailovskaya](https://ecomcharge.com/static/assets/img/authors/oksana-mikhailovskaya.ba234e7ec63f.jpg) [Oksana Mikhailovskaya](https://www.linkedin.com/in/oksana-mikhailovskaya-2b661725/) Nov. 12, 2026 12 min read High-risk payment processing is card acceptance for merchants whose category, model or location brings more fraud, chargeback or legal exposure, under stricter scheme rules. This guide is for PSPs and acquirers that take such merchants and must set up the [white-label payment gateway](https://ecomcharge.com/white-label-payment-gateway/) behind them. ### Key takeaways 1. High risk is defined by the card schemes and your acquirer, not by you: Visa lists the merchant category codes it treats as high integrity risk. 2. The acquirer carries the scheme liability, so it sets the reserve, the limits and the right to terminate. Your job is to keep merchants inside them. 3. Since 1 April 2026, Visa counts a merchant in Europe, the US, Canada or Asia-Pacific as Excessive at 150 basis points of fraud and disputes. 4. The gateway gives you the controls: routing, cascading, 3-D Secure rules, limits and history checks. It does not take the liability. 5. One acquirer is a single point of failure for high-risk volume. Plan a second one before you need it. ## What Is High-Risk Payment Processing? High-risk payment processing is the same authorization, clearing and settlement flow as any card payment, run with more controls. The merchant is registered with the scheme, watched more closely, paid out with a reserve held back and routed through acquirers that accept its category. The difference lies in rules and limits, not in the message format. You meet it from the PSP side. Your [PSP software](https://ecomcharge.com/guides/payment-service-provider-software/) receives the payment, applies your rules and sends it to an acquirer that has agreed to take the merchant. Every decline, dispute and fraud report then counts against that merchant and against your portfolio with the acquirer. Merchant onboarding is out of scope here. How you verify and underwrite a merchant before its first payment is covered in the guide to [high-risk merchant onboarding](https://ecomcharge.com/guides/automate-high-risk-onboarding/). This guide starts at the first live transaction. Definition High integrity risk Visa’s term for merchant categories that carry more legal and reputational exposure, such as betting or adult content. An acquirer must be approved by Visa to take them and must register each such merchant, as set out in the [Visa Core Rules](https://usa.visa.com/dam/VCOM/download/about-visa/visa-rules-public.pdf). ## Which Merchants Are High-Risk? A merchant is high-risk when its merchant category code (MCC), business model or market carries more fraud, chargeback or legal exposure. The clearest line is Visa’s list of high integrity risk MCCs for card-not-present payments. Your acquirer adds its own categories, such as future delivery and subscriptions, and higher-risk countries. The table follows the [Visa Merchant Data Standards Manual](https://usa.visa.com/dam/VCOM/download/merchants/visa-merchant-data-standards-manual.pdf). It shows the categories that need registration, not the full list of what acquirers decline. Examples of Visa high integrity risk MCCs for card-not-present payments | MCC | Category | Why acquirers treat it as high risk | | --- | --- | --- | | 7995 | Betting, lottery tickets, casino chips, games of chance | Licensing differs by country; deposits are disputed as unauthorised | | 5967 | Adult content and services | Reputational exposure and “friendly fraud” disputes | | 7273 | Dating services | Recurring billing that customers do not recognise | | 5966 | Outbound telemarketing | Sales pressure and high refund requests | | 5122, 5912 | Drugs and pharmacies | Prescription rules and counterfeit risk | Source: Visa Merchant Data Standards Manual, October 2026 Forex and trading platforms are a frequent case for PSPs, and they need the same scheme checks. eComCharge has a separate page on [iGaming and Forex PSPs](https://ecomcharge.com/solutions/igaming-and-forex/). If your merchants are mostly retail, the [low-risk PSP setup](https://ecomcharge.com/solutions/psp/) is the closer fit. ## Who Carries the Risk? The acquirer carries the scheme liability for every merchant it signs, including the ones you bring as a PSP. That is why it sets the reserve, the limits and the termination terms. The issuer decides whether to authorize and raises the dispute. You run the controls and pass the costs on to the merchant under your agreement. Who does what in a high-risk card payment | Party | What it does | What it carries | | --- | --- | --- | | Merchant | Sells, describes the charge, answers disputes with evidence | Chargeback amounts and fees, the reserve | | PSP (you) | Routes, screens, sets limits, monitors merchants | Contractual losses, the acquirer relationship | | Acquirer | Registers the merchant, settles funds, reports to the scheme | Scheme liability, monitoring programme fees | | Card scheme | Sets rules, MCCs and monitoring thresholds | Rule enforcement, not losses | | Issuer | Authorizes, reports fraud, raises disputes | Fraud losses on 3-D Secure authenticated payments, where liability shifts to it | Based on the Visa Core Rules and Visa Product and Service Rules Liability for fraud can move. When a payment is authenticated with 3-D Secure, liability for fraud disputes generally shifts to the issuer. In the European Economic Area, strong customer authentication (SCA) is required under the [PSD2 technical standards](https://eur-lex.europa.eu/eli/reg_del/2018/389/oj), with exemptions the issuer may refuse. Card data is a shared duty too. If card numbers pass through your systems, part of the [PCI DSS](https://www.pcisecuritystandards.org/document_library/) scope is yours, part sits with your gateway provider. A [tokenization vault](https://ecomcharge.com/platform/tokenization/) keeps raw card data out of your merchants’ systems and narrows that scope. ## What Is a High-Risk Merchant Account? A high-risk merchant account is an acquiring agreement with extra terms that protect the acquirer: registration with the scheme, a rolling reserve, volume and ticket limits, settlement delays and quick termination rights. The terms come from the acquirer’s risk policy. You enforce them on the merchant side and in your gateway. #### Rolling reserve A share of each payment is held for a set number of days, then released. Visa’s [Acceptance Risk Standards](https://africa.visa.com/dam/VCOM/download/merchants/visa-global-acquirer-risk-standards.pdf) treat it as the merchant’s property, held in a segregated account. #### Transaction limits Caps per payment, per card and per day. You set them in the gateway; see the post on [setting transaction limits](https://ecomcharge.com/blog/setting-transaction-limits/). #### Settlement delay The acquirer pays out later than for low-risk merchants, so chargebacks can be netted from funds it still holds. #### Termination and MATCH A merchant terminated for excessive disputes or fraud is added to Mastercard’s [MATCH file](https://developer.mastercard.com/product/match/), which other acquirers check before signing it. Write the reserve and limits into your own merchant agreement with the same numbers your acquirer uses. If your terms are softer, the gap is your loss. ## How Do Visa VAMP Thresholds Work? The Visa Acquirer Monitoring Program (VAMP) divides a merchant’s card-not-present fraud reports and disputes by its settled transactions each month. Above the threshold, the merchant is identified and the acquirer must apply risk controls. For high-risk merchants this ratio decides whether you keep the account. 150 bps Excessive merchant ratio in Europe, the US, Canada and Asia-Pacific from 1 April 2026 1,500 Minimum monthly count of fraud reports and disputes in those regions 50 bps Acquirer portfolio “Above Standard” level; Excessive at 70 bps Source: Visa Acquirer Monitoring Program fact sheet, 2025 The ratio counts fraud reports (TC40, the issuer’s fraud record) plus disputes (TC15) over settled transactions (TC05), as the [VAMP fact sheet](https://corporate.visa.com/content/dam/VCOM/corporate/visa-perspectives/security-and-trust/documents/visa-acquirer-monitoring-program-fact-sheet-2025.pdf) sets out. Disputes resolved through pre-dispute tools, which let the merchant refund or answer the issuer before a dispute is filed, are left out. The 150 bps merchant threshold applies when the acquirer’s own portfolio is neither Above Standard nor Excessive. The acquirer level matters to you as a PSP. If your acquirer’s whole portfolio is above 50 bps, it is the one under review, and it will cut limits across all of its merchants, yours included. Illustrative example ### A merchant close to the line Assumptions: a merchant in the EU settles 100,000 card-not-present Visa payments in a month. Issuers file 900 fraud reports and 700 disputes on them. | Fraud reports + disputes | 900 + 700 = 1,600 | | --- | --- | | VAMP ratio | 1,600 ÷ 100,000 = 160 bps | | Result | Above 150 bps and above 1,500 items: Excessive | Cutting 150 disputes with refunds before they are filed brings the merchant to 145 bps and below the minimum count. eComCharge white-label platform ### Keep High-Risk Traffic Under Control eComCharge combines Smart Routing, SmartCheck history and in-house 3DS for PSPs that process high-risk volume. - PCI DSS Level 1 since 2012 - 170+ connectors - SaaS launch from 1 week [Request demo](https://ecomcharge.com/contacts/sales/) ## What Does a High-Risk Payment Gateway Need? A high-risk payment gateway needs controls you can change per merchant, card segment and acquirer without a release: routing rules, cascading, 3-D Secure rules, limits, blacklists and checks against payment history. The gateway applies your policy. The acquirer and scheme rules still define what is allowed. #### Routing rules Send each payment to the acquirer that takes its MCC, country and card type. See [payment routing](https://ecomcharge.com/guides/payment-routing/). #### Cascading Retry a soft decline on another acquirer, within the scheme limits on [cascading payments](https://ecomcharge.com/guides/recover-declined-transactions-cascading/). #### 3-D Secure per segment Force authentication on risky segments and skip it where the risk is low, using a [3DS server](https://ecomcharge.com/platform/3ds-server/). #### Payment history Check a card’s past chargebacks and failures before routing with [SmartCheck signals](https://ecomcharge.com/platform/smartcheck/). #### Automated actions Alert, blacklist or reject when a condition is met, with [Action Rules](https://ecomcharge.com/use-cases/action-rules/). #### Reporting Track dispute ratios per merchant and acquirer in [FinStatHub reports](https://ecomcharge.com/platform/finstathub/). Cascading needs care in high-risk traffic. A hard decline such as “stolen card” must not be retried anywhere, and the schemes limit how often a declined card may be retried, as the guide on [scheme retry rules for cascading](https://ecomcharge.com/guides/recover-declined-transactions-cascading/) explains with the scheme sources. Set your cascade to soft declines only. Routing and fraud rules belong in one engine. When [Smart Routing](https://ecomcharge.com/platform/smart-routing/) evaluates anti-fraud and 3DS conditions in the same rule set, a payment cannot be screened by one policy and routed by another. ## Why Use More Than One Acquirer? Because a high-risk portfolio depends on the acquirer’s risk appetite, which can change overnight. A termination, a freeze or a new limit stops all volume routed to that bank. A second acquirer that already accepts your MCCs lets you move traffic instead of stopping it. #### One acquirer - Termination stops all merchants at once - No fallback when the acquirer goes down - No bargaining power over reserve and limits #### Two or more acquirers - Volume moves when limits are cut - Outages are routed around - Each acquirer sees a smaller share of risk Moving a merchant is not free. The new acquirer registers it again, and stored cards must move with it. Keep tokens portable; the [token migration case](https://ecomcharge.com/case-studies/token-migration-one-week/) shows an acquirer switch with no customer impact. The full plan is in the [multi-acquirer strategy](https://ecomcharge.com/guides/multi-acquirer-protection-strategy/) guide. Scheme rule ### Do not hide a merchant from monitoring Splitting a merchant across acquirers or changing its data to stay under VAMP is circumvention. Visa may charge the acquirer USD 25,000 per merchant per month and disqualify the merchant and its principals (section 12.5.3.2 of the [Visa Core Rules](https://usa.visa.com/dam/VCOM/download/about-visa/visa-rules-public.pdf)). ## Risks, and Who Does Not Need It High-risk processing earns more per merchant but puts your acquirer relationships, cash and licence at stake. Each risk below has a control you can set before the first payment. If your merchants are mostly low-risk retail, you do not need this setup at all. High-risk processing risks and how to reduce them | Risk | How to reduce it | | --- | --- | | One merchant pushes the portfolio over VAMP | Per-merchant dispute alerts well below 150 bps; reserve sized to the dispute rate | | Acquirer terminates or freezes you | A second contracted acquirer; portable tokens | | Merchant leaves with unpaid chargebacks | Reserve and settlement delay mirrored from the acquirer’s terms | | Card testing on your checkout | Velocity limits, blacklists, forced 3-D Secure on new cards | | Merchant sells where it is not licensed | Country rules in routing; block issuing countries outside the licence | Good to know ### When a simpler option is better If you sign a few high-risk merchants a year, refer them to an acquirer that specialises in the category instead of building controls for them. A dedicated setup pays off when high-risk volume is a core line of your business. ## What to Check Before You Go Live Before the first high-risk payment, confirm that your acquirer has registered the merchant and that every limit in its agreement is set in your gateway. Then test that each control fires. The list below is the minimum to check with your acquirer and your gateway team. ### Go-live checklist for a high-risk merchant - The acquirer confirms Visa and Mastercard registration of the merchant and its MCC. - The reserve, settlement delay and limits match the acquirer’s terms. - Routing sends the merchant only to acquirers that accept its MCC and countries. - Cascading retries soft declines only. - 3-D Secure rules are set for new cards and high-value payments. - Dispute and fraud alerts per merchant fire below the VAMP threshold. - A backup acquirer is contracted and tested with live traffic. Review the merchant monthly against the same report the acquirer sees. A [SmartCheck overview](https://ecomcharge.com/blog/smart-check/) explains how history signals help high-risk PSPs act before the acquirer does. ## High-Risk Processing with eComCharge eComCharge is a white-label online payment gateway for PSPs and acquiring banks, with 14 years of processing high-risk traffic. More than 125 PSPs run their payment operations on it, high-risk and low-risk alike. - 170+ connectors to acquirers, PSPs and alternative payment methods, with new ones in 1 week. - Smart Routing with routing, anti-fraud and 3DS rules in one engine, plus cascading. - SmartCheck signals such as chargeback and failed-transaction history as routing conditions. - An in-house 3DS server and a PCI DSS Level 1 card vault. - FinStatHub for custom analytics, reports and dashboards. The [acquirer failure case](https://ecomcharge.com/case-studies/acquirer-failure-contained/) shows how traffic was moved when one acquirer failed. eComCharge pricing depends on the client’s specific needs: deployment model, volume, connectors and customisation. [Contact sales](https://ecomcharge.com/contacts/sales/) for a quote. ## Frequently asked questions ### What is high-risk payment processing? It is card acceptance for merchants whose category, business model or location brings more fraud, chargeback or legal exposure. The payment flow is the same as for any merchant. What changes is the scheme registration, the monitoring, the reserves and limits, and how carefully the PSP routes and screens each payment. ### What is a high-risk merchant account? It is an acquiring agreement for a merchant in a high-risk category. Compared with a standard account it usually comes with scheme registration, a rolling reserve, transaction and volume limits, closer monitoring and stricter termination terms. The acquirer sets these terms because it carries the scheme liability for the merchant. ### What is a high-risk payment gateway? It is a gateway set up for traffic with higher fraud and dispute rates. It needs routing across several acquirers, cascading within scheme rules, 3-D Secure rules per segment, limits and blacklists, and history-based checks on cards and customers. The gateway does not take on the liability; it gives the PSP the controls. ### What are the Visa VAMP thresholds for merchants? Since 1 April 2026, a merchant in Europe, the US, Canada or Asia-Pacific is Excessive at a VAMP ratio of 150 basis points with at least 1,500 fraud reports and disputes a month. The ratio counts card-not-present fraud and disputes over settled transactions. Ask your acquirer which of its own limits apply on top. ### Why do high-risk merchants pay a rolling reserve? Because chargebacks can arrive weeks after the merchant has been paid out. A rolling reserve holds back a share of each payment for a set period and then releases it, so money is there to cover late disputes. Visa treats the reserve as the merchant's property, held in a segregated account. ### Can a PSP process high-risk payments with one acquirer? It can, but the whole business then depends on one bank's risk appetite. A termination, freeze or limit change stops all volume at once. Most high-risk PSPs contract a second acquirer that already knows the merchant categories, so traffic can move when the first one cuts limits. ### How much does high-risk payment processing cost with eComCharge? eComCharge pricing depends on the client's specific needs: the deployment model, volume, connectors and any customisation. Acquirer fees and reserves are set by your acquirers, not by the platform. For a quote, [contact the sales team](https://ecomcharge.com/contacts/sales/). --- ### Respectfully, the eComCharge Team eComCharge develops and delivers the PCI DSS Level 1 certified white-label payment platform for Payment Service Providers and Payment Orchestration. [Request demo](https://ecomcharge.com/contacts/sales/) ## Set up your payment processing system in 7 days, not a year [Request demo](https://ecomcharge.com/contacts/sales/)