White-label payment infrastructure for acquiring banks
White-label payment gateway for low-risk PSPs
Built for high-risk PSPs — full control over your channels
How PSPs and acquirers process high-risk card payments: which merchants count as high risk, who carries the liability, Visa VAMP thresholds, reserves and limits, the gateway features you need, multiple acquirers and the risks.
High-risk payment processing is card acceptance for merchants whose category, model or location brings more fraud, chargeback or legal exposure, under stricter scheme rules. This guide is for PSPs and acquirers that take such merchants and must set up the white-label payment gateway behind them.
High-risk payment processing is the same authorization, clearing and settlement flow as any card payment, run with more controls. The merchant is registered with the scheme, watched more closely, paid out with a reserve held back and routed through acquirers that accept its category. The difference lies in rules and limits, not in the message format.
You meet it from the PSP side. Your PSP software receives the payment, applies your rules and sends it to an acquirer that has agreed to take the merchant. Every decline, dispute and fraud report then counts against that merchant and against your portfolio with the acquirer.
Merchant onboarding is out of scope here. How you verify and underwrite a merchant before its first payment is covered in the guide to high-risk merchant onboarding. This guide starts at the first live transaction.
Visa’s term for merchant categories that carry more legal and reputational exposure, such as betting or adult content. An acquirer must be approved by Visa to take them and must register each such merchant, as set out in the Visa Core Rules.
A merchant is high-risk when its merchant category code (MCC), business model or market carries more fraud, chargeback or legal exposure. The clearest line is Visa’s list of high integrity risk MCCs for card-not-present payments. Your acquirer adds its own categories, such as future delivery and subscriptions, and higher-risk countries.
The table follows the Visa Merchant Data Standards Manual. It shows the categories that need registration, not the full list of what acquirers decline.
| MCC | Category | Why acquirers treat it as high risk |
|---|---|---|
| 7995 | Betting, lottery tickets, casino chips, games of chance | Licensing differs by country; deposits are disputed as unauthorised |
| 5967 | Adult content and services | Reputational exposure and “friendly fraud” disputes |
| 7273 | Dating services | Recurring billing that customers do not recognise |
| 5966 | Outbound telemarketing | Sales pressure and high refund requests |
| 5122, 5912 | Drugs and pharmacies | Prescription rules and counterfeit risk |
Source: Visa Merchant Data Standards Manual, October 2026
Forex and trading platforms are a frequent case for PSPs, and they need the same scheme checks. eComCharge has a separate page on iGaming and Forex PSPs. If your merchants are mostly retail, the low-risk PSP setup is the closer fit.
The acquirer carries the scheme liability for every merchant it signs, including the ones you bring as a PSP. That is why it sets the reserve, the limits and the termination terms. The issuer decides whether to authorize and raises the dispute. You run the controls and pass the costs on to the merchant under your agreement.
| Party | What it does | What it carries |
|---|---|---|
| Merchant | Sells, describes the charge, answers disputes with evidence | Chargeback amounts and fees, the reserve |
| PSP (you) | Routes, screens, sets limits, monitors merchants | Contractual losses, the acquirer relationship |
| Acquirer | Registers the merchant, settles funds, reports to the scheme | Scheme liability, monitoring programme fees |
| Card scheme | Sets rules, MCCs and monitoring thresholds | Rule enforcement, not losses |
| Issuer | Authorizes, reports fraud, raises disputes | Fraud losses on 3-D Secure authenticated payments, where liability shifts to it |
Based on the Visa Core Rules and Visa Product and Service Rules
Liability for fraud can move. When a payment is authenticated with 3-D Secure, liability for fraud disputes generally shifts to the issuer. In the European Economic Area, strong customer authentication (SCA) is required under the PSD2 technical standards, with exemptions the issuer may refuse.
Card data is a shared duty too. If card numbers pass through your systems, part of the PCI DSS scope is yours, part sits with your gateway provider. A tokenization vault keeps raw card data out of your merchants’ systems and narrows that scope.
A high-risk merchant account is an acquiring agreement with extra terms that protect the acquirer: registration with the scheme, a rolling reserve, volume and ticket limits, settlement delays and quick termination rights. The terms come from the acquirer’s risk policy. You enforce them on the merchant side and in your gateway.
A share of each payment is held for a set number of days, then released. Visa’s Acceptance Risk Standards treat it as the merchant’s property, held in a segregated account.
Caps per payment, per card and per day. You set them in the gateway; see the post on setting transaction limits.
The acquirer pays out later than for low-risk merchants, so chargebacks can be netted from funds it still holds.
A merchant terminated for excessive disputes or fraud is added to Mastercard’s MATCH file, which other acquirers check before signing it.
Write the reserve and limits into your own merchant agreement with the same numbers your acquirer uses. If your terms are softer, the gap is your loss.
The Visa Acquirer Monitoring Program (VAMP) divides a merchant’s card-not-present fraud reports and disputes by its settled transactions each month. Above the threshold, the merchant is identified and the acquirer must apply risk controls. For high-risk merchants this ratio decides whether you keep the account.
Source: Visa Acquirer Monitoring Program fact sheet, 2025
The ratio counts fraud reports (TC40, the issuer’s fraud record) plus disputes (TC15) over settled transactions (TC05), as the VAMP fact sheet sets out. Disputes resolved through pre-dispute tools, which let the merchant refund or answer the issuer before a dispute is filed, are left out.
The 150 bps merchant threshold applies when the acquirer’s own portfolio is neither Above Standard nor Excessive. The acquirer level matters to you as a PSP. If your acquirer’s whole portfolio is above 50 bps, it is the one under review, and it will cut limits across all of its merchants, yours included.
Assumptions: a merchant in the EU settles 100,000 card-not-present Visa payments in a month. Issuers file 900 fraud reports and 700 disputes on them.
| Fraud reports + disputes | 900 + 700 = 1,600 |
|---|---|
| VAMP ratio | 1,600 ÷ 100,000 = 160 bps |
| Result | Above 150 bps and above 1,500 items: Excessive |
Cutting 150 disputes with refunds before they are filed brings the merchant to 145 bps and below the minimum count.
A high-risk payment gateway needs controls you can change per merchant, card segment and acquirer without a release: routing rules, cascading, 3-D Secure rules, limits, blacklists and checks against payment history. The gateway applies your policy. The acquirer and scheme rules still define what is allowed.
Send each payment to the acquirer that takes its MCC, country and card type. See payment routing.
Retry a soft decline on another acquirer, within the scheme limits on cascading payments.
Force authentication on risky segments and skip it where the risk is low, using a 3DS server.
Check a card’s past chargebacks and failures before routing with SmartCheck signals.
Alert, blacklist or reject when a condition is met, with Action Rules.
Track dispute ratios per merchant and acquirer in FinStatHub reports.
Cascading needs care in high-risk traffic. A hard decline such as “stolen card” must not be retried anywhere, and the schemes limit how often a declined card may be retried, as the guide on scheme retry rules for cascading explains with the scheme sources. Set your cascade to soft declines only.
Routing and fraud rules belong in one engine. When Smart Routing evaluates anti-fraud and 3DS conditions in the same rule set, a payment cannot be screened by one policy and routed by another.
Because a high-risk portfolio depends on the acquirer’s risk appetite, which can change overnight. A termination, a freeze or a new limit stops all volume routed to that bank. A second acquirer that already accepts your MCCs lets you move traffic instead of stopping it.
Moving a merchant is not free. The new acquirer registers it again, and stored cards must move with it. Keep tokens portable; the token migration case shows an acquirer switch with no customer impact. The full plan is in the multi-acquirer strategy guide.
Splitting a merchant across acquirers or changing its data to stay under VAMP is circumvention. Visa may charge the acquirer USD 25,000 per merchant per month and disqualify the merchant and its principals (section 12.5.3.2 of the Visa Core Rules).
High-risk processing earns more per merchant but puts your acquirer relationships, cash and licence at stake. Each risk below has a control you can set before the first payment. If your merchants are mostly low-risk retail, you do not need this setup at all.
| Risk | How to reduce it |
|---|---|
| One merchant pushes the portfolio over VAMP | Per-merchant dispute alerts well below 150 bps; reserve sized to the dispute rate |
| Acquirer terminates or freezes you | A second contracted acquirer; portable tokens |
| Merchant leaves with unpaid chargebacks | Reserve and settlement delay mirrored from the acquirer’s terms |
| Card testing on your checkout | Velocity limits, blacklists, forced 3-D Secure on new cards |
| Merchant sells where it is not licensed | Country rules in routing; block issuing countries outside the licence |
If you sign a few high-risk merchants a year, refer them to an acquirer that specialises in the category instead of building controls for them. A dedicated setup pays off when high-risk volume is a core line of your business.
Before the first high-risk payment, confirm that your acquirer has registered the merchant and that every limit in its agreement is set in your gateway. Then test that each control fires. The list below is the minimum to check with your acquirer and your gateway team.
Review the merchant monthly against the same report the acquirer sees. A SmartCheck overview explains how history signals help high-risk PSPs act before the acquirer does.
eComCharge is a white-label online payment gateway for PSPs and acquiring banks, with 14 years of processing high-risk traffic. More than 125 PSPs run their payment operations on it, high-risk and low-risk alike.
The acquirer failure case shows how traffic was moved when one acquirer failed. eComCharge pricing depends on the client’s specific needs: deployment model, volume, connectors and customisation. Contact sales for a quote.
It is card acceptance for merchants whose category, business model or location brings more fraud, chargeback or legal exposure. The payment flow is the same as for any merchant. What changes is the scheme registration, the monitoring, the reserves and limits, and how carefully the PSP routes and screens each payment.
It is an acquiring agreement for a merchant in a high-risk category. Compared with a standard account it usually comes with scheme registration, a rolling reserve, transaction and volume limits, closer monitoring and stricter termination terms. The acquirer sets these terms because it carries the scheme liability for the merchant.
It is a gateway set up for traffic with higher fraud and dispute rates. It needs routing across several acquirers, cascading within scheme rules, 3-D Secure rules per segment, limits and blacklists, and history-based checks on cards and customers. The gateway does not take on the liability; it gives the PSP the controls.
Since 1 April 2026, a merchant in Europe, the US, Canada or Asia-Pacific is Excessive at a VAMP ratio of 150 basis points with at least 1,500 fraud reports and disputes a month. The ratio counts card-not-present fraud and disputes over settled transactions. Ask your acquirer which of its own limits apply on top.
Because chargebacks can arrive weeks after the merchant has been paid out. A rolling reserve holds back a share of each payment for a set period and then releases it, so money is there to cover late disputes. Visa treats the reserve as the merchant's property, held in a segregated account.
It can, but the whole business then depends on one bank's risk appetite. A termination, freeze or limit change stops all volume at once. Most high-risk PSPs contract a second acquirer that already knows the merchant categories, so traffic can move when the first one cuts limits.
eComCharge pricing depends on the client's specific needs: the deployment model, volume, connectors and any customisation. Acquirer fees and reserves are set by your acquirers, not by the platform. For a quote, contact the sales team.
eComCharge develops and delivers the PCI DSS Level 1 certified white-label payment platform for Payment Service Providers and Payment Orchestration.
A practitioner's guide to launching a payment service provider: choosing a model, signing an acquirer, licensing, PCI DSS, platform choice, cost drivers and a 9-step launch plan.
How PSPs, acquiring banks and EMIs onboard high-risk merchants: which MCCs count as high risk, the KYB, UBO and sanctions checks EU law requires, underwriting and reserves, Visa registration and monitoring, what to automate and how to keep an evidence trail.
How a PSP protects itself from a sudden acquirer shut-off, outage or limit change: concentration risk, scheme and underwriting triggers, backup acquirers, portable tokens, volume split, an outage runbook, costs and who does not need it.
A guide to cascading payments for PSPs and acquiring banks: soft, hard and technical declines, which Visa response codes may cascade, cascade design, duplicate-charge prevention, 3DS, scheme rules, recovery KPIs and who should not cascade.
A guide for PSPs, banks and platforms on custom payment solutions: custom build vs off-the-shelf vs white-label, what can be customised, how a connector or payout flow is scoped and delivered, what drives cost and time, and the risks.
The four types of payment tokenization service provider for PSPs and banks, network vs gateway tokens, token portability and migration, PCI DSS scope, and the questions to ask before you choose.