Visa VAMP and Mastercard Monitoring Programs: How Enrollment Works and How to Stay Out

The notice almost never comes from the network. It comes from your acquirer, in a short email, saying you have been identified under a monitoring program and they need a remediation plan by the end of the week. By then the month that flagged you is already closed, the disputes are already counted, and your options have narrowed to arguing about a number that is no longer moving. Most high-risk merchants meet these programs this way, after the fact, with no idea that enrollment was already three months in the making. The ratio tells you whether you are over a line. The program tells you what happens for the next six months, who is deciding, and what it costs to get out. This post covers the program side: what VAMP replaced, how the combined ratio is shaped, how enrollment and exit work, what Mastercard runs in parallel, and the controls that keep you off the list.

VDMP and VFMP are gone, and that matters

If you are working from a compliance checklist written before 2025, it probably names two Visa programs. The Visa Dispute Monitoring Program tracked non-fraud chargebacks. The Visa Fraud Monitoring Program tracked fraud-tagged volume through TC40 reports. They ran separately, with separate thresholds, and a merchant could sit comfortably under both while being a mess in aggregate.

Visa consolidated them into the Visa Acquirer Monitoring Program in 2025. VAMP combines fraud reports and non-fraud disputes into one numerator over settled card-not-present transactions. The practical consequence is that the old hedge no longer works. Merchants used to trade one category against the other, absorbing friendly fraud as non-fraud disputes to keep the fraud program clean. Under VAMP both land in the same number, so there is nothing to trade.

The second consequence is the program name. It is an acquirer monitoring program. Visa's primary counterparty is your processor, not you, and the thresholds that carry the most weight are measured against the acquirer's whole portfolio. Your acquirer is being graded on a much tighter line than you are, and their line decides whether you keep processing.

How the combined ratio is shaped

Visa evaluates fraud reports and non-fraud disputes together against the count of settled card-not-present transactions in the same closed month. Two details in that sentence do most of the damage. The denominator is a transaction count rather than revenue, so a catalog of small orders and one of large orders are measured the same way despite carrying very different exposure per dispute. And because fraud reports and disputes arrive on different clocks, one bad traffic source can push the numerator twice, once when the issuer files the report and again if the cardholder disputes. Thresholds also sit above a minimum activity floor, so a low-volume MID is usually excluded right up until the month it is not. Visa has revised the merchant-level figures since the program went live, so confirm current numbers with your acquirer rather than any published summary, this one included.

Enrollment is a monthly snapshot, not a warning system

Networks evaluate on closed calendar months. There is no live counter, no dashboard the network shares with you, and no alert at eighty percent of threshold. You breach in month one, the data settles, and the identification typically reaches your acquirer partway through month two. Your acquirer then decides how to tell you, and some do not until they have already decided what to do about it.

This lag is why merchants describe enrollment as sudden when it was not. By the time you can act, you are managing the third month while being judged on the first. Any control you deploy on the day the notice arrives will not show up in a measured ratio for another full cycle.

Build your own monitor. Compute the ratio yourself, per network, per MID, on a rolling basis, and treat any month above roughly two thirds of the merchant threshold as an internal alarm. That is not conservatism, it is just accounting for the two-month blindfold.

What the program does to you once you are in it

Enrollment triggers a sequence that runs on the network's clock, not yours.

Fees attach per transaction, not per month. Under VAMP, identified merchants are assessed a per-item charge on each disputed or fraud-reported transaction, and under Mastercard's Excessive Chargeback Merchant program the monthly fine escalates with each consecutive month you remain enrolled. The escalation is the part merchants underestimate. Month one is an annoyance, month four is a line item that changes the economics of the offer.

Your acquirer owns the remediation plan. The network asks the acquirer, not you, for a documented plan. Those requirements are usually stricter than anything the network specified, because the acquirer is protecting its own portfolio ratio. Expect mandatory prevention alerts, a forced refund policy, descriptor changes, and often a volume cap. A cap is the one to negotiate hardest, because a shrinking denominator makes the ratio worse before it makes it better.

Reserves get revisited. An enrolled merchant is a merchant the acquirer now models as a loss risk. Rolling reserve percentages frequently go up at this point, or a reserve gets introduced where there was not one.

Termination is discretionary and early. Most high-risk merchants are not terminated by Visa or Mastercard. They are terminated by an acquirer who decided the portfolio math no longer worked, often well below any published merchant threshold. That decision logic is the subject of why stores in restricted categories get shut down, and monitoring enrollment is the single strongest trigger for it.

Termination for excessive chargebacks means a MATCH entry. The MATCH listing follows the business and its principals for five years and is visible to every acquirer that runs the check. Operating while listed is possible, but only through offshore acquiring on worse terms.

Exiting takes longer than entering

Entering takes one bad month. Exiting takes consecutive clean months, typically three under Mastercard's program structure, measured after your remediation actually lands in the data.

Stack that against the reporting lag and the real timeline is close to two quarters from the day you fix the underlying problem. Plan the cash accordingly, because fines, elevated reserves, and any volume cap all run for that whole period.

	Visa VAMP	Mastercard ECM / HECM
What it counts	Fraud reports and non-fraud disputes combined	Chargebacks only, with a separate fraud program
Test structure	Single ratio, above a minimum activity floor	Two-part test: chargeback count and ratio must both trip
Primary counterparty	The acquirer, with merchant-level identification	The merchant, via the acquirer
Cost shape	Per-item assessment on each counted transaction	Monthly fine that escalates with consecutive months
Exit	Sustained performance below threshold	Typically three consecutive clean months

Treat every specific above as a snapshot, since both networks revise these programs on their own schedule.

The controls that actually keep you out

Staying out is an architecture problem more than a customer service problem.

Prevention alerts, sized to the right program. Alerts stop a dispute before it is filed and are the fastest lever available, but they are not uniformly effective across both networks. Resolving a case through Verifi RDR keeps the dispute out of the count while leaving the underlying fraud report in place, so alerts protect a count-based program better than they protect a combined fraud-and-dispute ratio. The chargeback alerts guide covers the coverage gaps and the per-case economics.

Descriptor and marketing consistency. A meaningful share of disputes are recognition failures rather than dissatisfaction. The billing descriptor, the brand on the checkout page, the sender name on the receipt email, and the name on the support line should all be the same string. It is the cheapest ratio control that exists and still the one most commonly skipped.

Refund friction removed on purpose. Every refund is a unit that never enters a numerator, and the revenue you protect by making refunds hard is worth far less than the enrollment it buys. For rebill and reorder models this is structural, which is why a subscription setup needs cancellation flows that work and dunning that stops on the first hard decline.

Per-MID containment. Ratios are computed per MID, so a single processing relationship concentrates every traffic source, every affiliate, and every campaign into one number. Properly underwritten MIDs, each disclosed and each carrying accurate descriptors, keep one bad source from taking down the whole business. The routing rules and per-MID caps are covered in the payment orchestration guide. The line to respect: distributing volume across disclosed, honestly underwritten MIDs is risk management, and opening MIDs to hide history is transaction laundering.

Decline hygiene. Retrying hard declines and letting card testing run against your checkout inflates both fraud reports and enumeration signals. Handle response codes correctly rather than uniformly, as covered in the authorization rate guide.

Practical takeaway

The path that fails is treating monitoring programs as a compliance topic you read about after the notice arrives. By then the measurement window has closed, your acquirer has already priced you as a risk, and your leverage is gone.

The path that lasts is running the networks' math yourself, monthly, per MID, with an internal alarm well below the published line, and building the controls before you need them: consistent descriptors, alerts sized to the right program, refunds that are easy to get, and enough MID redundancy that one bad traffic source is a contained incident rather than an existential one. None of that is expensive relative to a single enrolled quarter.

If you want a read on where your current setup sits against these programs, and what the containment architecture should look like for your volume, apply for an architecture review.