What Makes a Business High Risk? Triggers Underwriters Use
Credit card processing for high-risk merchants starts with underwriting. See the six triggers banks weigh, Visa and Mastercard limits, and what to fix.
Photo: Pixabay
On this page 9 sections
- Why Banks Underwrite Credit Card Processing for High-Risk Merchants Differently
- Industry and MCC: The Trigger You Can't Change
- Chargeback and Fraud Ratios Against Network Limits
- Billing Models That Widen the Bank's Exposure
- Owner Credit and Past Terminations Follow You
- Sales Patterns That Raise Flags in Any Industry
- What Underwriters Look for on Your Website
- High-Risk Triggers You Can Fix and Ones You Can't
- Before You Apply, Build the File Underwriters Want
Key takeaways
- Visa's VAMP ratio adds fraud reports to disputes. A store with a 0.7% chargeback rate can still be "Excessive" at Visa's 1.5% line.
- Mastercard's Excessive Chargeback Merchant tier needs both conditions in the same month: 100 or more chargebacks and a ratio of at least 1.5%.
- A MATCH or VMSS listing lasts five years, and only the acquirer that filed it can ask for removal. Miscoding to dodge a high-risk label risks exactly that outcome.
- Visa's free-trial rules apply whether or not the FTC ever brings back a click-to-cancel rule. They cover consent, confirmation, online cancellation and, for trials longer than seven days, a reminder seven days before conversion.
A business is high risk when the bank behind its merchant account expects more chargebacks and fraud losses from it than from the average account. Credit card processing for high-risk merchants is priced around that expectation, so these accounts come with reserves and closer monitoring. Underwriters reach the label through six triggers: what you sell, your dispute and fraud history, how you bill, the owners' credit and the business's track record, your sales patterns, and what your website shows. You can't change your industry. Most of the other triggers improve with work, and that work shows up in the terms you're offered.
Why Banks Underwrite Credit Card Processing for High-Risk Merchants Differently
The acquiring bank that sponsors your account stands behind your transactions. If disputes outrun your balance, or you close before shipping what you sold, the bank absorbs the loss. Underwriting is the bank's estimate of that exposure before your first sale. "High risk" is a statistical label, not an accusation.
Underwriters don't give a simple yes or no. They sort accounts into tiers. One or two factors can put you in a medium-risk middle tier, and several put you fully in high-risk territory. For how the account itself works, see what a high-risk merchant account is and who needs one.
Industry and MCC: The Trigger You Can't Change
Every merchant account carries a merchant category code (MCC), a four-digit code that tells the card networks what kind of business you run. Categories with long dispute and fraud histories are underwritten as high risk no matter how well an individual business runs.
Your MCC has to describe what you actually sell. Coding a supplement store as general retail is miscoding. Running CBD sales through another company's account is transaction laundering. Both break card network rules. Acquirers must report merchants they terminate for fraud, severe policy violations or excessive chargebacks to Mastercard's MATCH list or Visa's VMSS file, and must screen every applicant against both, according to Stripe's documentation. Listings stay active for five years. Only the acquirer that filed a listing can ask to have it removed or corrected.
Nutraceuticals and Supplements
Free-trial and "just pay shipping" offers that roll into monthly shipments produce disputes from customers who didn't realize they enrolled. Underwriters also read your product claims, and wording that suggests a supplement treats or cures a condition draws regulatory questions. Many sellers learn that mainstream payment platforms restrict supplement sales, which is why nutraceutical merchant accounts go through specialized underwriting.
CBD and Delta 8
Federal law is changing for these sellers. P.L. 119-37, signed November 12, 2025, redefined hemp by total THC, including THCA, and capped finished products at 0.4 milligrams of total THC per container, as the Congressional Research Service explains. A stopgap bill signed September 2, 2026 pushed most of the change from November 12 to December 11, 2026. Bills to delay or replace it are pending, per Hemp Law Group's tracker. State laws add another layer of differences.
Underwriters ask which states you ship to, how you verify age, and whether you hold a certificate of analysis for each product. Some banks decline the category outright. Providers that work with CBD and Delta 8 businesses ask for that file up front, including an age verification tool that passes review. This is general information, not legal advice. Confirm your product's status with a qualified attorney.
Chargeback and Fraud Ratios Against Network Limits
If you've processed cards before, your recent statements are the strongest evidence an underwriter has. The reviewer checks your chargeback ratio, whether it is rising or falling, the chargeback reason codes behind it, and your refund rate. Heavy refunds point to product or fulfillment trouble even when disputes look fine.
Underwriters measure those numbers against two network programs. Both are network rules, not processor pricing:
- Visa Acquirer Monitoring Program (VAMP). Visa adds fraud reports (TC40s) to disputes (TC15s) and divides by settled card-not-present transactions. Since April 1, 2026, a U.S. merchant is "Excessive" at a ratio of 1.5%, down from 2.2%, once it also passes 1,500 combined fraud reports and disputes in a month, according to IntelliPay's VAMP compliance guide. The same guide puts the fine at $8 per disputed or fraudulent transaction, with no warning tier. Our explainer on Visa's VAMP thresholds goes deeper.
- Mastercard Excessive Chargeback Program. A merchant enters the Excessive Chargeback Merchant tier at 100 or more chargebacks and a ratio of 1.5% or higher in the same month. The high-excessive tier starts at 300 chargebacks and 3%, per Chargeback.io's summary. Fines start in the second straight month over the line. Here is what happens if you're enrolled.
Worked Example: A 0.7% Chargeback Rate That Still Fails Visa's Test
Merchants often miss that Visa's ratio counts fraud reports as well as chargebacks. Take an illustrative online store. Every number below is assumed:
| Assumption (one month, Visa only) | Figure |
|---|---|
| Settled card-not-present transactions | 100,000 |
| Disputes (TC15) | 700 |
| Fraud reports (TC40) that never became disputes | 900 |
The owner sees 700 ÷ 100,000 = 0.7%, well under Mastercard's 1.5% line. Visa computes (700 + 900) ÷ 100,000 = 1.6% on 1,600 combined events. That clears both the 1,500-event floor and the 1.5% ratio, so the store is Excessive. Forter also notes that a single transaction with both a fraud report and a dispute can be counted twice, which pushes real-world ratios higher still.
Refunds don't erase fraud reports. Address verification and 3-D Secure authentication help cut fraud at checkout, before it turns into reports. Underwriters also weigh direction: a moderate ratio that is falling reads better than a low one that just doubled.
Billing Models That Widen the Bank's Exposure
Free trials and introductory offers. Visa's subscription policy sets four requirements:
- express consent at enrollment
- an emailed or texted confirmation, even when nothing is charged
- for trials longer than seven days, a reminder with a cancellation link at least seven days before the trial converts
- a way to cancel online, however the customer signed up
Short trials still carry a disclosure duty. When a trial or introductory period lasts seven days or less, Visa expects the enrollment confirmation to include what the reminder would have said, such as the end date and a simple way to cancel. Mastercard's rules are covered in our guide to free trial and subscription billing rules from Visa and Mastercard.
Recurring billing. The FTC's Click-to-Cancel rule is not in effect. The Eighth Circuit vacated it on July 8, 2025, as WilmerHale reported, and the FTC has restarted rulemaking, per Jones Day. The federal Restore Online Shoppers' Confidence Act (ROSCA) still requires clear renewal terms before you collect billing details, Cooley notes. Many states also have automatic renewal laws of their own. This is general information. Confirm your obligations with a qualified professional.
Future delivery. Travel bookings, pre-orders, event tickets and custom goods all open a gap between payment and fulfillment. The longer the gap, the bigger the bank's exposure. That gap is the main reason travel merchant accounts are underwritten as high risk.
Illustrative example: A tour operator takes $40,000 in January bookings for June trips. If those trips are canceled, the bank faces up to $40,000 in disputes on money that settled five months earlier. That exposure is why underwriters ask future-delivery merchants about booking windows, and why the terms they offer can include a rolling reserve.
Owner Credit and Past Terminations Follow You
Most applications include a personal credit check on the principal owners. Recent bankruptcies or collections can push an otherwise ordinary business into a higher tier. A new business has no track record, so a startup in a high-risk category gets the closest look.
An undisclosed past termination will show up in MATCH and VMSS screening, so explain it in writing before you're asked. A MATCH listing doesn't end every conversation, but it narrows the field sharply. If a platform recently shut you down, read why Stripe closes accounts and what to do next.
Sales Patterns That Raise Flags in Any Industry
Online and phone orders carry more fraud risk than chip transactions in person. A ticket that is high for your industry raises the loss per dispute. Cross-border sales bring more fraud and sometimes different product laws. The most avoidable problem is a volume spike your application never mentioned, such as an unannounced launch, which can trigger a review or a hold on funds. Estimate your volume honestly, and tell your provider before a big promotion.
What Underwriters Look for on Your Website
For online sellers, the website works as a second application. Reviewers check it against a short list:
| What Underwriters Look For | Common Red Flag |
|---|---|
| Refund and cancellation policies | Missing or buried |
| Phone number and physical address | Contact form only |
| Terms of service and privacy policy | Copied templates naming another company |
| Accurate product descriptions | Health claims or "guaranteed results" |
| Price and renewal terms at checkout | Pre-checked boxes, hidden recurring charges |
| Age gate for age-restricted products | None on CBD or vape products |
Your billing descriptor matters too. If customers don't recognize the name on their statement, you get "I don't recognize this charge" disputes.
High-Risk Triggers You Can Fix and Ones You Can't
| Risk Factor | Can You Change It? | What Helps |
|---|---|---|
| Industry and MCC | No | A provider experienced in your category |
| Product legal status | No | Documented state-by-state compliance |
| Chargeback and fraud ratios | Yes, over months | Recognizable descriptors and fraud screening |
| Refund ratio | Yes | Accurate descriptions, reliable fulfillment |
| Trial and subscription setup | Yes, quickly | Visa-compliant reminders and online cancellation |
| Future delivery window | Partly | Shorter booking windows, deposits instead of full payment |
| Owner credit | Slowly | Resolve collections, explain past issues |
| Business age | Only with time | A clean processing history |
| Website compliance | Yes, quickly | Clear policies and no product claims |
Fixing the "yes" rows won't move you out of your category. It does change the reserve levels and pricing you're offered and how periodic reviews go, and that is how you work toward standard terms and a smaller reserve.
One rule has no exceptions: don't hide what you are. Splitting transactions or running sales through another merchant's account leaves you worse off than an honest high-risk designation, because it can end in a five-year MATCH listing.
Before You Apply, Build the File Underwriters Want
- Pull your recent processing statements. Ask your current processor for your monthly Visa fraud-report counts, then work out your ratio the way VAMP does.
- Gather formation documents and owner IDs using our high-risk underwriting document checklist.
- Check your website against the red-flag table above.
- If you bill by subscription, sign up and cancel the way a customer would.
- Write a short explanation of any past account closure or dispute spike.
MannyPay provides high-risk merchant accounts and is a registered ISO/MSP of Esquire Bank, Merrick Bank and Mission Valley Bank. Approval and terms depend on underwriting. Once your file is ready, request a free processing quote, and a MannyPay specialist will respond within one business day.
Sources
- Visa: Updated Policy for Subscription Merchants Offering Free Trials or Introductory Promotions
- Visa: Updated Policy for Subscription Merchants Offering Free Trials (Visa Business News, trial periods of seven days or less)
- IntelliPay: VAMP Compliance After April 2026
- Forter: Visa's Updated VAMP Program: What Merchants Need to Know
- Chargeback.io: Mastercard Chargeback Monitoring Program: ECM vs. EFM
- Stripe Docs: Terminated Merchant Files (MATCH and VMSS)
- Congressional Research Service: Changes to the Statutory Definition of Hemp and Issues for Congress (IF13136)
- Hemp Law Group: Federal Hemp Law in 2026: Where Things Stand
- WilmerHale: Eighth Circuit Vacates the FTC's "Click to Cancel" Rule
- Jones Day: FTC Revives Click-to-Cancel Rule
- Cooley: Click to Cancel Just Got Cancelled
This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.
