Card Network Chargeback Monitoring Programs: VAMP, ECM, and MATCH

Card network chargeback monitoring programs are the systems Visa, Mastercard, and American Express use to flag merchants whose chargeback or fraud numbers climb past set ratios. Cross a threshold and you face escalating monthly fines, a required remediation plan, higher reserves from your acquiring bank, and, if the numbers don’t come down, termination of your processing account and placement on a five-year industry blacklist that blocks most new accounts.

How Your Ratio Is Calculated

Each network divides your monthly chargebacks (or fraud reports) by your total settled transactions for that month. Process 5,000 sales and take 50 chargebacks, and you sit at 1.0%. Both the percentage and the raw count matter: a low ratio with hundreds of disputes still draws scrutiny, and a high ratio on tiny volume does too.

One timing detail catches merchants off guard. The ratio uses the month a dispute is processed, not the month of the original sale. Chargebacks filed in March against December holiday transactions count against March. You can look clean for months and then get flagged all at once when disputes from a busy season finally land.

Fraud and general dispute metrics run on separate tracks. Visa pulls fraud data from TC40 reports (non-financial alerts a cardholder’s bank files when a transaction is reported as fraud), and Mastercard uses its Fraud and Loss Database. A TC40 doesn’t move money, but it still counts against your monitoring ratio.¹ You can have clean chargeback numbers and still get flagged for fraud, or the reverse, and the fix for each is different.

Visa Acquirer Monitoring Program (VAMP)

Visa consolidated its old dispute and fraud monitoring programs into a single Visa Acquirer Monitoring Program in 2025. The VAMP ratio combines fraud reports (TC40) and disputes (TC15) in the numerator over total settled transactions.¹

Visa measures both the acquiring bank’s entire portfolio and individual merchants inside it. At the portfolio level, an acquirer is flagged Above Standard at a 0.50% ratio and Excessive at 0.70%, in each case with at least 1,500 monthly fraud reports and disputes.¹ When that happens, the acquirer is required to apply risk controls across its merchants, and that pressure comes down on you.

At the individual merchant level in the United States, Canada, EU, and Asia-Pacific, you’re flagged as an Excessive Merchant at a 2.20% VAMP ratio with at least 1,500 monthly fraud reports and disputes. That threshold drops to 1.50% on April 1, 2026.¹ A merchant sitting at 1.8% in early 2026 could be clean one month and in violation the next.

Under VAMP, enforcement runs through the acquiring bank rather than through flat per-dispute fines paid to Visa. In practice that means your processor decides the consequence: higher fees, a rolling reserve, or termination of the account.

Mastercard: CMM, ECM, and HECM

Mastercard uses tiered designations that get worse the longer you stay above threshold.

The entry level is Chargeback Monitored Merchant status, triggered when you exceed a 1.0% chargeback-to-transaction ratio and take at least 100 chargebacks in a single calendar month.² CMM carries no direct fines, but it tells your acquirer the account is heading toward real trouble.

Above CMM sits the Excessive Chargeback Program, with two tiers:

Excessive Chargeback Merchant (ECM): a 1.5% ratio and at least 100 chargebacks in each of two consecutive months.²
High Excessive Chargeback Merchant (HECM): a 3.0% ratio and at least 300 chargebacks per month for two months, consecutive or not.³

Mastercard’s Fine Schedule

Mastercard assesses fines to your acquiring bank, which passes them to you. The schedule escalates by cumulative months above the ECM or HECM threshold:³

Month 1: no fine at either tier.
Month 2: $1,000 (ECM); $1,000 (HECM).
Month 3: $1,000 (ECM); $2,000 (HECM).
Months 4–6: $5,000 (ECM); $10,000 (HECM), plus issuer recovery.
Months 7–11: $25,000 (ECM); $50,000 (HECM), plus issuer recovery.
Months 12–18: $50,000 (ECM); $100,000 (HECM), plus issuer recovery.
Month 19 and beyond: $100,000 (ECM); $200,000 (HECM), plus issuer recovery.

Starting at month four, Mastercard also charges an issuer recovery assessment of $5 for every chargeback above 300 in the month. A merchant with 500 chargebacks owes $1,000 in recovery fees on top of the base fine.³ Few acquirers will absorb those numbers for long before cutting the merchant loose.

American Express Fraud Full Recourse

American Express focuses its formal monitoring program on fraud rather than general disputes. The Fraud Full Recourse Program has two tiers based on your fraud-to-gross transaction ratio:⁴

Low Tier: fraud-to-gross ratio of 0.9% or higher, with at least $25,000 in fraud in a single month.
High Tier: fraud-to-gross ratio of 1.8% or higher, with at least $50,000 in fraud in a single month.

On the dispute side, Amex watches inquiry and chargeback volume but doesn’t publish rigid thresholds. You can be flagged for consistently failing to provide supporting documentation, racking up “no reply” chargebacks, or generating disputes well above your own history or your industry peers.⁴ The absence of bright-line dispute thresholds gives Amex more discretion.

The MATCH List: The Five-Year Blacklist

The worst outcome isn’t the monthly fines. It’s the Mastercard Alert to Control High-risk Merchants system, known as the MATCH list (formerly the Terminated Merchant File). When a payment processor terminates a merchant for excessive chargebacks or fraud, the processor must add that business to the MATCH database within one business day.⁵ Despite the Mastercard branding, nearly every acquiring bank checks MATCH before approving a new merchant account across any network.

Entries stay on MATCH for five years. During that period, most processors will decline to open an account for the listed business. Some high-risk specialists will take MATCH-listed merchants, but at much higher rates and with restrictive terms.

A merchant can be added for either quantitative or qualitative reasons. Among them:

Reason Code 4, Excessive Chargebacks: Mastercard chargebacks exceeded 1% of sales transactions in any single month and totaled $5,000 or more.⁵
Reason Code 5, Excessive Fraud: a fraud-to-sales ratio of 8% or higher, with at least 10 fraudulent transactions totaling $5,000 or more in a calendar month.⁵
Reason Code 12, PCI DSS Non-Compliance.
Reason Code 3, Transaction Laundering.
Reason Code 7, Fraud Conviction of a business owner or partner.

Note that the MATCH threshold for excessive chargebacks (1%) sits below Mastercard’s ECM trigger (1.5%). An acquirer that decides to cut its losses can terminate a merchant at CMM level and report them to MATCH after a single bad month, without the merchant ever formally entering the Excessive Chargeback Program.

What Your Acquirer Does Before Termination

Network fines are billed to the acquiring bank, not directly to you. The acquirer then chooses how to handle the account. There are three practical options: pass the fines through, impose a rolling reserve, or terminate.

Most acquirers start with reserves. A rolling reserve withholds a percentage of each transaction’s revenue, typically 5% to 15%, for six months to a year. The processor uses that fund to cover chargebacks and fines if you can’t pay. High-dispute industries can see holding periods stretch to 180 days or longer.⁶ A 10% reserve on $200,000 a month locks up $20,000 in working capital at any given time.

If fines keep climbing, termination becomes the likely outcome, and termination often triggers a MATCH listing. The cascade runs from monitoring program to fines to termination to MATCH, which is why treating an initial program notification as an emergency is not an overreaction.

How to Exit a Monitoring Program

Both Visa and Mastercard require you to stay below program thresholds for three consecutive months to exit.⁷ American Express uses the same three-month window, requiring both a fraud-to-gross ratio below 0.9% and fraud volume below $25,000 per month.⁴ Any month above threshold resets the clock. Two good months plus a slip in the third puts you back at zero.

Visa requires identified merchants to submit a monthly remediation plan starting in the second month. The plan has to identify the root cause of the elevated disputes, outline corrective actions, and set milestones with target dates. Merchants who don’t show improvement may be required to hire a Visa-approved review firm to build the remediation strategy.⁸

Once the three-month requirement is met, the network notifies your acquiring bank that you’ve exited. The process is automated from monthly reporting data; no separate application is needed. Exiting once grants no immunity. Cross back over and you re-enter, usually with less patience from both the network and the acquirer.

Prevention Tools That Move the Ratio

The most effective time to deal with a chargeback is before it becomes one.

Alert services like Verifi (integrated with Visa) and Ethoca (integrated with Mastercard) notify you when a cardholder initiates a dispute, before it becomes a formal chargeback. Issue the refund immediately and the dispute never counts against your monitoring ratio. You lose the sale revenue, but you avoid the chargeback, the ratio hit, and the dispute fee. For a merchant near a threshold, a few dozen prevented chargebacks a month can be the difference between a normal quarter and a program notification.

Implementing 3-D Secure (Visa brands it “Visa Secure”) on online transactions does two things. It shifts liability for fraud-related chargebacks away from you on authenticated transactions, so those chargebacks don’t count against your ratio. And authenticated transactions show roughly 45% less fraud than non-authenticated e-commerce transactions.⁹ For a fraud-driven ratio problem, it’s one of the fastest levers available.

Most non-fraud chargebacks trace to a short list of operational issues: billing descriptors customers don’t recognize on their statements, refund processes that are slow or hard to find, and poor communication about shipping timelines or subscription renewals. Fixing the descriptor, publishing a visible customer service number, and sending proactive shipping updates can drop dispute rates meaningfully inside a billing cycle or two.

1
Visa. Visa Acquirer Monitoring Program Fact Sheet
2
Mastercard. Security Rules and Procedures – Merchant Edition
3
J.P. Morgan. Mastercard Excessive Chargeback Merchant Program Guide
4
American Express. Merchant Regulations – International
5
Stripe. High Risk Merchant Lists
6
Stripe. Rolling Reserves 101 – What They Are and Why They Matter
7
Stripe. Dispute and Fraud Card Monitoring Programs
8
J.P. Morgan. Visa Dispute and Fraud Monitoring Programs Guide
9
Visa. 3D Secure – Your Guide to Safer Transactions