High-Risk Payments: The Merchant Lifecycle & How to Build for It

What makes a merchant “high-risk”

High-risk is not a legal category. It is how acquirers and schemes price five kinds of exposure. Most verticals score high on two or three of them, and the mix decides the controls you need.

Exposure by vertical

Hover or tap a cell to see why. Levels are an editorial assessment of typical exposure, not a scheme classification.

Gambling & betting · Chargebacks — High. Losing players dispute deposits as unauthorised or claim a family member played: first-party fraud.

The lifecycle: compliance and engineering, stage by stage

Eight stages from first contact to exit. The left column is what acquirers, schemes and regulators expect. The right column is what the PSP or merchant engineering team builds so that it happens every time, with evidence.

Reference architecture

The payment path (solid) is the same as for any merchant. A high-risk stack adds a control plane above it (dashed) that decides what each merchant is allowed to do, and an operations plane below it (dotted) that watches ratios and disputes in near real time. Select a component.

A dispute, end to end, and where you can stop it

Chargebacks are the number high-risk merchants live and die by. Press play to see the path a dispute takes, the two points where a pre-dispute alert can turn it into a refund, and how the outcome feeds the monitoring ratios.

Monitoring programmes: where do you land?

Enter one month of card-not-present volume. The bars show your position against the Visa VAMP merchant threshold and the Mastercard Excessive Chargeback Program. This is a simplified model; the VAMP calculator has the full Visa bands.

Vertical playbooks

Each vertical has its own codes, registrations, licences and failure modes. Pick one.

Development approach: compliance by design

In high-risk payments the rules change more often than the code: scheme bulletins, new thresholds, licence conditions, regulator guidance. The delivery loop has to treat those rules as inputs, ship them safely per vertical and market, and leave evidence behind.

Rules as code: one policy per vertical and market

A sketch of the idea, not a real product's schema: the policy is versioned, reviewed by two people, released per market behind a flag, and every decision records the policy version that made it.

# policy/gambling/GB.yaml — reviewed by 2, released behind flag hr.gambling.gb
vertical: gambling
market: GB
version: 2026.09.2
mcc: 7995
scheme_registration:
  visa: required          # high-integrity-risk category
  mastercard: required    # specialty merchant registration
onboarding:
  licence: { regulator: UKGC, verify: api, recheck_days: 30 }
  ubo_threshold_pct: 25
  sanctions_pep: continuous
payment:
  funding_types: [debit, prepaid]   # credit cards banned for UK gambling
  three_ds: always_on_cit
  geo: { allow: [GB], ip_and_bin_country_must_match: true }
payouts:
  method: original_credit            # OCT back to the card first
monitoring:
  alert_at_pct_of_scheme_limit: 70
  vamp_ratio_ceiling: 0.015
  ecm_ratio_ceiling: 0.015
reserve: { type: rolling, pct: 10, hold_days: 180 }

2025–2027 watchlist

Dated changes that shape high-risk programmes right now. Verify each against the scheme or regulator source before you rely on it.

1. 17 Jan 2025DORA applies. ICT risk management, incident reporting and a third-party register became mandatory for EU payment and e-money institutions.
2. 1 Oct 2025VAMP enforcement. Visa’s combined fraud-and-dispute programme moved from advisory to enforcement, with fees per item above threshold.
3. 11 Mar 2026FTC restarts negative-option rulemaking. The FTC published an advance notice after the Click-to-Cancel rule was vacated in July 2025; ROSCA enforcement continues.
4. 1 Apr 2026VAMP merchant limit cut to 1.5%. Down from 2.2% everywhere except CEMEA. CE 3.0 also became available inside Visa Order Insight.
5. 1 May 2026Mastercard high-risk fees rise. Specialty registration went to $1,000 per merchant per year with a new $50,000 acquirer licence fee; per-transaction fees followed on 3 Jun 2026.
6. 1 Jul 2026MiCA transition ends. Crypto-asset service providers without a MiCA licence had to stop serving EU clients.
7. 24 Jul 2026Mastercard Scam Merchant Monitoring Program. Full effect: acquirers must investigate flagged card-not-present merchants within 72 hours.
8. 11 Dec 2026US hemp THC redefinition. The total-THC test and 0.4 mg per-container cap take effect, delayed from 12 Nov 2026.
9. 18 Jan 2027GENIUS Act deadline. The US stablecoin law takes effect on this date at the latest, earlier if final rules land 120 days before.
10. 2027UK subscription regime. DMCC Act subscription-contract rules are expected in 2027; the exact start date is still moving.
11. 10 Jul 2027EU AML Regulation applies. A single EU AML rulebook replaces national transpositions; AMLA direct supervision follows in 2028.

Related tools

VAMP calculator · Chargeback reason codes · Dispute simulator · MCC lookup · 3DS message inspector · Response codes · Interchange calculator