Insights · Risk and fraud · November 2026

Visa VAMP thresholds in 2026: the ratio, the numbers and what to do before your acquirer acts.

Most merchants watch the wrong number. The published merchant threshold is not the one that gets you off-boarded. Your acquirer's portfolio threshold is, and it is three times tighter.

What VAMP measures

The Visa Acquirer Monitoring Program replaced the separate dispute and fraud monitoring programmes in 2025. It uses one count-based ratio on card-not-present Visa transactions, domestic and cross-border:

VAMP ratio = (fraud reports, TC40 + disputes, TC15) ÷ settled transactions, TC05

Three details change how the number behaves. Fraud reports and disputes are added together, so a transaction that is both reported as fraud and later disputed can count twice. Card-present volume is not in the denominator, so it does not dilute an online ratio. Disputes resolved through Visa's pre-dispute tools, and fraud that qualifies under Compelling Evidence 3.0, are excluded, which is why those tools matter more under VAMP than they did before.

A second metric, the enumeration ratio, tracks card testing: enumerated authorisation attempts (approved and declined) divided by all authorisation attempts.

The thresholds that apply in 2026

Merchant, Excessive
1.5% or more, with at least 1,500 combined fraud reports and disputes in the month. Europe, US, Canada, Asia Pacific and Latin America since 1 April 2026 (previously 2.2% outside Latin America).
Merchant, CEMEA
2.2% or more, with at least 150 events and USD 75,000 in fraud and dispute amount.
Acquirer, Above Standard
0.5% or more across the whole portfolio, enforced since 1 January 2026.
Acquirer, Excessive
0.7% or more.
Enumeration, Excessive
20% or more enumerated attempts, with at least 300,000 enumerated transactions in the month.
Fees
Reported by processors at USD 8 per fraud report or dispute for Excessive merchants and Excessive acquirers, USD 4 at acquirer Above Standard, with a three-month grace period on a first identification in a rolling year. Acquirers pass these through under the merchant agreement.

Figures from Visa's VAMP fact sheet and acquirer guidance current at the time of writing. Confirm your own status with your acquirer; programme parameters change.

Why the acquirer threshold is the one that matters

An acquirer whose portfolio sits at 0.45% cannot carry a merchant at 1.2%, even though that merchant is comfortably under the published 1.5%. The acquirer will apply reserves, raise pricing, demand a remediation plan or terminate, well before Visa identifies the merchant. If you have been told your ratio is a problem while you are "under the limit", this is why. The practical rule: know your acquirer's portfolio position, and manage to a number that keeps you useful to them, not merely compliant with Visa.

Five controls that move the ratio

  1. Separate fraud from non-fraud disputes and treat them differently. Fraud reports respond to authentication, device intelligence and velocity rules. Non-fraud disputes respond to descriptors, refund speed, delivery confirmation and customer-service reachability. One dashboard that mixes them hides which lever to pull.
  2. Use pre-dispute resolution where the economics work. Disputes resolved through Visa's pre-dispute tools are excluded from the ratio. For high-ticket or high-ratio descriptors the per-case cost is usually cheaper than the VAMP fee plus the chargeback.
  3. Measure at descriptor and MID level, monthly, before the acquirer does. The ratio is assessed per descriptor. A single campaign, market or product line can push one descriptor over while the blended number looks fine.
  4. Stop enumeration at the edge. Bot-driven card testing reaches 300,000 attempts quickly on an unprotected checkout. Rate limiting, bot management and BIN-level velocity rules belong in front of the gateway, not in the fraud engine behind it.
  5. Fix the acceptance side at the same time. Issuers decline more from merchants that send them fraud. A lower VAMP ratio tends to lift acceptance over the following months, which is the business case that gets the budget.

What Mastercard does differently

Mastercard still runs chargebacks and fraud as separate programmes. The Excessive Chargeback Program flags a merchant from 100 chargebacks and a 1.5% to 2.99% ratio, and High Excessive from 300 chargebacks and 3%, with the prior month's sales as the denominator. The Excessive Fraud Merchant programme applies its own criteria. Manage both schemes from one monthly view, but do not assume the same fixes carry equal weight.

If you have already been identified

The sequence that works: establish the real numbers by scheme, MID and descriptor in the first days; identify the three largest drivers; put the quick controls in within the week; write the remediation plan in the acquirer's format, with dates; then report against it every week until the ratio has been under threshold for two cycles. The evidence file is as important as the ratio. An acquirer that sees a credible plan and weekly progress will usually hold the relationship.

This is the work I take on as interim or fractional Head of Risk & Fraud. If you are on notice, bring last month's ratios to a call.