Visa Acquirer Monitoring Program (VAMP): Ratios, Thresholds, and Fines

The Visa Acquirer Monitoring Program, known as VAMP, is Visa’s unified system for scoring fraud and disputes against every acquiring bank and every merchant in its portfolio each calendar month. It took effect on April 1, 2025, replacing five legacy monitoring programs with a single ratio, a single set of thresholds, and a single remediation path.¹ The advisory period ended on September 30, 2025, financial penalties have been enforced since October 2025, and a stricter round of merchant-level thresholds takes effect on April 1, 2026.²

Before VAMP, acquirers juggled separate programs for fraud (the Visa Fraud Monitoring Program) and chargebacks (the Visa Dispute Monitoring Program), each with its own thresholds and paperwork. The merchant-level versions of those legacy programs were eliminated in June 2025.² Everything now rolls up into one number.

How the VAMP Ratio Is Calculated

VAMP uses one combined ratio instead of separate fraud and dispute metrics:

VAMP Ratio = [Count of Fraud Reports (TC40) + Count of Disputes (TC15)] ÷ Count of Settled Transactions (TC05)²

The numerator pulls from two different data streams. A TC40 is a non-financial fraud alert filed by the cardholder’s issuing bank when it flags a transaction as fraudulent. It is not a chargeback and does not move money. A TC15 is an actual chargeback where the cardholder has opened a formal dispute. Both count equally against your ratio, which is why your VAMP number can rise even when your chargebacks alone look under control.

The denominator counts only settled sales (TC05). Reversals, credits, and authorization-only transactions do not pad the denominator in your favor.

What Gets Excluded From the Numerator

Two categories of events can be stripped from the numerator, but only when they are resolved inside the same calendar month they occurred:

Disputes resolved through Visa’s pre-dispute tools, such as Rapid Dispute Resolution (RDR) or the Cardholder Dispute Resolution Network (CDRN).
TC40 fraud reports that qualify under Visa’s Compelling Evidence 3.0 framework.²

The same-month rule is the catch. You cannot go back and clean up a bad month after the fact.

Merchant-Level Thresholds

Individual merchants are evaluated under a category called “Excessive Merchant,” but only when the acquirer’s own portfolio is not already flagged. If the acquirer is in trouble at the portfolio level, Visa deals with the acquirer directly instead of drilling into individual merchants.

When the acquirer’s portfolio is below threshold, these limits apply to merchants in the U.S., Canada, EU, and Asia-Pacific regions:²

Through March 31, 2026: VAMP ratio of 2.2% or higher (≥220 basis points), with at least 1,500 combined fraud and dispute events in the month.
Starting April 1, 2026: VAMP ratio of 1.5% or higher (≥150 basis points), same 1,500-event minimum.

The 1,500-event floor keeps low-volume merchants from being flagged over a handful of incidents. It offers no cushion to anyone processing meaningful volume; a mid-size merchant can reach 1,500 fraud and dispute events in a single month without noticing.

Acquirer Portfolio Thresholds

VAMP is fundamentally an acquirer program. Visa scores the acquirer’s entire merchant portfolio as one risk number each month, and the thresholds at this level are far tighter than the merchant-level cutoffs:²

Above Standard: portfolio VAMP ratio of 0.5% or higher (≥50 basis points), with at least 1,500 combined fraud and dispute events per month across the covered regions.
Excessive: portfolio VAMP ratio of 0.7% or higher (≥70 basis points), with the same 1,500-event minimum.

This is where the real pressure sits. Merchants sometimes assume they are safe because their own ratio is only mildly elevated. If your activity is pushing your acquirer’s portfolio ratio toward 0.5%, the acquirer has a direct financial incentive to cut you rather than absorb penalties on your behalf.

Enumeration Thresholds

VAMP includes a separate limit for enumeration attacks, Visa’s term for card testing — the practice of running large volumes of small authorizations against a payment page to find which stolen card numbers still work. A merchant is identified only when both of the following are true:²

Enumeration Ratio: 20% or more of total authorization transactions (approved and declined combined) are flagged as enumerated.
Enumeration Count: at least 300,000 enumerated transactions, approved and declined combined.

Declined transactions count. A merchant whose checkout page is being hammered by bots cannot argue that no money changed hands. Acquirers are expected to push merchants toward rate limiting, CAPTCHA, and velocity checks before the threshold is tripped.

What Happens When You Cross a Threshold

Every calendar month stands alone. If your ratio exceeds the applicable threshold and you meet the minimum event count, you are identified for that month. There is no rolling average and no cumulative scoring.² You also exit the program the first compliant month you post. There is no requirement to stay clean for a set run of consecutive months.

First-time offenders and merchants who have been out of VAMP for at least 12 consecutive months get a three-month grace period on re-entry. Warnings are issued during that window but fines are not assessed. Once it closes, penalties apply retroactively to any month the merchant was over threshold.

Remediation

An identified merchant or acquirer must implement risk mitigation controls and document them. In practice this means a root cause analysis — weak authentication, a compromised checkout, high-risk product mix, geographic exposure — followed by a corrective plan that names the tools being deployed and when. Vague plans without implementation dates get rejected and can draw further non-compliance assessments. Typical measures include enabling 3D Secure 2.x, deploying address verification and device fingerprinting, enrolling in pre-dispute resolution tools, and tightening refund and return policies.³

The Fines

Non-compliance assessments are levied against the acquiring bank, not the merchant directly. Processing agreements almost always include indemnification language that passes those costs through, so the merchant ultimately pays. The Visa Core Rules set an escalating monthly schedule:⁴

Level 1: $25,000 per month
Level 2: $50,000 per month
Level 4: $100,000 per month
Level 5: $125,000 per month
Level 6: $150,000 per month
Beyond Level 6: the assessment increases by $25,000 each additional month until the violation is corrected.

These are escalation levels, not merchant tiers. The longer non-compliance persists, the higher the monthly figure climbs. On top of the flat monthly assessment, per-incident fees apply to individual fraud and dispute events in any month the merchant exceeds thresholds. Those per-incident charges have been reported in the range of $4 to $8 per event, and for a merchant producing thousands of events a month they can exceed the flat assessment.

Termination and the MATCH List

Those fines assume the acquirer keeps your account open through remediation. Often they will not. Every month a problem merchant stays on the books, the acquirer absorbs penalties and risks its own portfolio ratio sliding toward 0.5%. Terminating the merchant is frequently the faster path.

When an acquirer terminates for excessive fraud or disputes, the merchant can be placed on the MATCH list (Member Alert to Control High-risk merchants), the industry-wide database other acquirers consult before approving new merchant applications. A MATCH listing can lock a merchant out of card processing across networks for up to five years. Visa’s program documentation does not set a fixed timeline for when MATCH placement occurs.

How To Keep Your VAMP Ratio Down

Because fraud reports and chargebacks share one ratio, cutting chargebacks alone will not save you if TC40 reports are still flowing in from issuing banks. The highest-leverage moves:

Turn on 3D Secure 2.x. Authenticated transactions shift fraud liability to the issuer, so a resulting chargeback does not count against your ratio. For most e-commerce merchants this is the single biggest lever.³
Enroll in Rapid Dispute Resolution and CDRN. If the dispute and the resolution land in the same calendar month, the event is excluded from your ratio entirely.²
Use Compelling Evidence 3.0 on TC40s. Qualifying evidence (for example, proof the same device and IP completed a prior undisputed transaction) can remove the event under the same same-month timing rule.
Block card testing at the checkout. Velocity checks, CAPTCHA, and bot detection stop enumeration attacks before they trigger the 20% / 300,000 threshold.
Clean up your billing descriptors. Many chargebacks come from cardholders who do not recognize a charge on their statement; a recognizable descriptor prevents friendly fraud before it starts.

Merchants most often get blindsided by VAMP because they tracked chargebacks but ignored TC40 data, or assumed their acquirer would absorb compliance pressure. Under the consolidated program, the acquirer’s incentive runs the other way.

1
Visa. Introducing the Visa Acquirer Monitoring Program
2
Visa. Visa Acquirer Monitoring Program Fact Sheet
3
Visa. 3D Secure
4
Visa. Visa Core Rules and Visa Product and Service Rules – Section: Non-Compliance Assessments