{"id":383,"date":"2026-07-06T10:49:20","date_gmt":"2026-07-06T10:49:20","guid":{"rendered":"https:\/\/unitycorporate.com\/?p=383"},"modified":"2026-07-10T20:49:59","modified_gmt":"2026-07-10T20:49:59","slug":"visa-vamp-virp-merchant-crackdown","status":"publish","type":"post","link":"https:\/\/unitycorporate.com\/ua\/blog\/visa-vamp-virp-merchant-crackdown\/","title":{"rendered":"\u0412\u0435\u043b\u0438\u043a\u0438\u0439 \u0434\u0435\u0440\u0438\u0441\u043a\u0456\u043d\u0433: \u044f\u043a \u0437\u0432\u0435\u0434\u0435\u043d\u043d\u044f \u043f\u0440\u0430\u0432\u0438\u043b Visa \u0437\u0430\u043a\u0440\u0438\u0432\u0430\u0454 \u043e\u043d\u043b\u0430\u0439\u043d-\u043c\u0435\u0440\u0447\u0430\u043d\u0442-\u0430\u043a\u0430\u0443\u043d\u0442\u0438"},"content":{"rendered":"

An investigation into VAMP, VIRP, and the compliance squeeze that has kept card acquiring “in a storm” since 2025 \u2014 plus a practical playbook for surviving it.<\/em><\/p>\n

For more than a year, the market for online card acceptance has been running through a slow-motion crisis. Merchants wake up to termination notices with 30 days’ warning and no stated cause. Payment service providers quietly tighten onboarding until whole categories of legitimate business can no longer get a merchant account. Acquiring banks \u2014 the institutions that connect a merchant to Visa and Mastercard \u2014 are shrinking their high-risk books rather than risk the fines waiting on the other side of a threshold.<\/p>\n

The trigger is not a new law or a regulator. It is Visa’s own rulebook, rewritten across 2023\u20132026 into two programs that together changed the economics of who gets to accept a card online: the Visa Integrity Risk Program (VIRP)<\/strong> and the Visa Acquirer Monitoring Program (VAMP)<\/strong>. Mastercard has moved in near-lockstep with its own monitoring regime. The stated goals are unimpeachable \u2014 less fraud, fewer disputes, no illegal transactions on the network. The practical effect has been a wave of de-risking that catches good businesses alongside bad ones.<\/p>\n

This piece breaks down exactly what changed, with the real numbers, and then turns to what merchants and acquirers can actually do about it.<\/p>\n

\n

A note on sourcing.<\/strong> Where a figure comes from Visa’s or Mastercard’s own documents, it is labeled as such. Where a figure is reported by acquirers, processors, or chargeback-mitigation vendors \u2014 some of whom sell fear \u2014 it is flagged. Dollar penalty amounts in particular are frequently not<\/em> published by the networks themselves and reach the market through acquirer advisories. Several widely repeated statistics turned out to be superseded or unsourced; those are called out rather than repeated.<\/p>\n<\/blockquote>\n

Part 1 \u2014 What actually changed<\/h2>\n

VAMP: Visa merged fraud and disputes into a single ratio<\/h3>\n

Before April 2025, Visa policed merchant risk with two separate programs: the Visa Dispute Monitoring Program (VDMP)<\/strong>, which tracked chargebacks, and the Visa Fraud Monitoring Program (VFMP)<\/strong>, which tracked fraud. A merchant could be in trouble on one axis or the other.<\/p>\n

On 1 April 2025<\/strong>, Visa folded that structure into a single framework \u2014 the Visa Acquirer Monitoring Program (VAMP)<\/strong> \u2014 launching it with a six-month advisory period; the updated program thresholds then took effect on 1 June 2025<\/strong>. In Visa’s own words from its VAMP fact sheet, the change was about “consolidating the existing VAMP, Visa Fraud Monitoring Program, and Visa Dispute Monitoring Program into a single global program,”<\/em> streamlining what Visa describes as dozens of separate remediation processes into one. (Visa, Introducing VAMP<\/a>; Visa VAMP Fact Sheet 2025<\/a>)<\/p>\n

The structural heart of VAMP \u2014 and the reason it caused so much turbulence \u2014 is a single combined ratio<\/strong>:<\/p>\n

\n

VAMP Ratio = ( Fraud reports [TC40] + Disputes [TC15] ) \u00f7 Settled card-not-present transactions [TC05]<\/strong><\/p>\n<\/blockquote>\n

It is count-based, not dollar-based<\/strong>, and it applies to card-not-present<\/strong> (online) VisaNet transactions only. (Visa VAMP Fact Sheet 2025<\/a>)<\/p>\n

That looks innocuous until you notice the double-counting problem. A single fraudulent transaction can hit the numerator twice<\/strong> \u2014 once as a TC40 fraud report and again, when the cardholder disputes it, as a TC15 dispute. (Ravelin<\/a>; Riskified<\/a>) Merchants who were comfortably inside the old separate limits suddenly found themselves measured against a metric that adds their fraud and their disputes together.<\/p>\n

The thresholds (current, per Visa’s fact sheet):<\/strong><\/p>\n\n\n\n\n\n\n\n\n\n\n
Level<\/th>\nTier<\/th>\nThreshold<\/th>\nEnforced from<\/th>\n<\/tr>\n<\/thead>\n
Acquirer (portfolio)<\/strong><\/td>\nAbove Standard<\/td>\n\u2265 0.50% (50 bps)<\/td>\n1 Jan 2026<\/td>\n<\/tr>\n
Acquirer (portfolio)<\/strong><\/td>\nExcessive<\/td>\n\u2265 0.70% (70 bps)<\/td>\n1 Oct 2025<\/td>\n<\/tr>\n
Merchant<\/strong> (AP, Canada, EU, US)<\/td>\nExcessive<\/td>\n\u2265 2.20% (220 bps) \u2192 1.50% from 1 Apr 2026<\/strong><\/td>\n1 Oct 2025<\/td>\n<\/tr>\n
Merchant<\/strong> (LAC)<\/td>\nExcessive<\/td>\n\u2265 1.50% (150 bps)<\/td>\n1 Oct 2025<\/td>\n<\/tr>\n
Merchant<\/strong> (CEMEA)<\/td>\nExcessive<\/td>\n\u2265 2.20% (220 bps)<\/td>\n1 Oct 2025<\/td>\n<\/tr>\n
Enumeration<\/strong> (card-testing)<\/td>\n\u2014<\/td>\n\u2265 20% ratio and<\/strong> \u2265 300,000 enumerated auth attempts\/month<\/td>\n\u2014<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

There is no “above standard” tier for merchants<\/strong> \u2014 only “excessive.” A merchant enters the program only after clearing a floor of \u2265 1,500 combined fraud + dispute events in a month<\/strong> (in CEMEA, \u2265 150 events and<\/em> \u2265 USD 75,000). (Visa VAMP Fact Sheet 2025<\/a>)<\/p>\n

Note the regional split that matters for European operators: Western Europe (the “EU” bucket) is on the tightening path to 1.5%, but CEMEA \u2014 Central Europe, Middle East and Africa \u2014 stays at 2.2%<\/strong> with a much lower event floor. Intra-Europe, the same business can face a different standard depending on where its acquirer books it. Latin America has been at 1.5% since launch; Brazil, Chile and India were carved out for a later, separate rollout.<\/p>\n

The enforcement calendar<\/strong> is the part that turned a rule change into a market event:<\/p>\n