Card Scheme Monitoring Programs: VAMP, ECP and MATCH (2026)

Card scheme monitoring programs are the rules Visa and Mastercard use to measure fraud and disputes for every merchant and acquirer, compare them with thresholds, and apply remediation plans and fees when the numbers stay too high. The best known are Visa’s VAMP, Mastercard’s Excessive Chargeback Program and the MATCH database of terminated merchants.

For PSPs, PayFacs and acquirers, 2026 is a turning point. Visa lowered its merchant threshold in April, and the new Visa program measures the acquirer’s whole portfolio, not only individual merchants. An operator can now enter a program because of the sum of many average merchants. Monitoring ratios has become a daily operational task, not a quarterly review.

What are card scheme monitoring programs?

Card scheme monitoring programs are compliance programs run by the card networks. Each month they calculate ratios of fraud and disputes to sales, identify merchants and acquirers above set thresholds, and require corrective action.

Visa’s reference is the Visa Acquirer Monitoring Program (VAMP). Its current version took effect on April 1, 2025, with an advisory period until September 30, 2025. It consolidated Visa’s earlier fraud and dispute programs, including the Visa Dispute Monitoring Program (VDMP), the Visa Fraud Monitoring Program (VFMP) and the former VAMP.

Mastercard runs several programs under its Security Rules and Procedures: the Excessive Chargeback Program (ECP), with two levels called Excessive Chargeback Merchant (ECM) and High Excessive Chargeback Merchant (HECM), the Excessive Fraud Merchant (EFM) program, and MATCH Pro.

The logic is the same in both networks. The scheme does not deal with merchants directly. It holds the acquirer responsible for the merchants it brings into the system, and the acquirer holds its PSPs, payment facilitators and merchants responsible in turn. Fees and remediation plans travel down this chain, and so does the pressure to act.

Related notions:

• TC40: the fraud report a Visa issuer files when a cardholder reports a transaction as fraudulent.
• TC15: the Visa dispute record.
• SAFE: the name long used for Mastercard’s fraud reporting, now the Fraud and Loss Database, which Mastercard describes as the central repository for fraud transactions.
• Chargeback ratio: disputes divided by transactions over a month.
• Fraud rate: reported fraud divided by sales, in count or in value.
• Enumeration: automated testing of card numbers through many small authorization attempts.
• Basis point (bps): one hundredth of a percent. 150 bps equals 1.5%.

VAMP vs ECP vs MATCH: how do the programs compare?

The programs differ in what they count, who they target and what happens above the threshold. The list below gives the essentials.

• Visa VAMP: counts fraud reports and disputes together, on card-not-present transactions. It targets acquirers at portfolio level and merchants individually. Above the threshold, fees apply per fraudulent or disputed transaction.
• Mastercard ECM: counts chargebacks only. A merchant enters with 100 to 299 chargebacks and a ratio of 1.5% to 2.99% in a month.
• Mastercard HECM: same ratio logic at a higher level, with 300 or more chargebacks and a ratio of 3% or more.
• Mastercard EFM: counts fraud chargebacks for e-commerce merchants with low use of authentication.
• MATCH Pro: not a ratio program. It is Mastercard’s database of merchants whose accounts were terminated for specific reasons. Acquirers consult it before onboarding.
• Visa VMSS: Visa’s equivalent terminated-merchant file.

Consequences also differ. Under Mastercard’s program, the acquirer is notified, must report on the merchant’s corrective actions, and pays fines that start in the second month and grow with each month spent in the program, with higher amounts at the HECM level. Under VAMP, the cost is a fee per fraudulent or disputed transaction, charged while the merchant or the acquirer remains identified. In both cases the merchant’s contract usually makes it liable for what the acquirer is charged.

One difference matters in daily work. Visa divides by the same month’s settled transactions. Mastercard divides a month’s chargebacks by the previous month’s sales transactions, as the program description published by Braintree shows. A merchant whose volume falls sharply can therefore see its Mastercard ratio rise without any new dispute.

How do card scheme monitoring programs work?

All programs follow the same monthly cycle: data collection, calculation, identification, remediation and exit. The steps, from the cardholder’s complaint to the scheme’s decision, are:

1. Report. A cardholder tells the issuer a transaction is fraudulent or disputes it. The issuer files a fraud report (TC40 or its Mastercard equivalent), a chargeback, or both.
2. Collection. The scheme attaches each report to the merchant and to its acquirer, using the identifiers sent in the original transaction.
3. Calculation. At month end the scheme computes the ratio. Visa’s VAMP fact sheet defines it as fraud reports plus disputes, divided by settled transactions, for card-not-present payments.
4. Identification. The scheme compares the ratio and the absolute counts with the thresholds, and notifies the acquirer.
5. Notification. The acquirer informs the PSP or payment facilitator, which informs the merchant.
6. Remediation. The merchant submits and applies a plan: stronger authentication, clearer descriptors, faster refunds, fraud rules.
7. Fees. If the merchant or the acquirer stays above the threshold, the scheme charges the acquirer, which passes the cost down the chain.
8. Exit. After a set number of months below the threshold, three for Mastercard’s programs, the merchant leaves the program.
9. Termination. If nothing improves, the acquirer may close the account and, where the criteria are met, add the merchant to MATCH.

Card scheme monitoring programs in numbers (2026)

The thresholds are public and dated. Key figures:

• 1.5%: VAMP threshold for a merchant to be classed "Excessive" in Europe, the US, Canada and Asia-Pacific since April 1, 2026, down from 2.2%. The fact sheet also sets a minimum of 1,500 fraud reports and disputes per month.
• 0.5% and 0.7%: VAMP thresholds for an acquirer’s portfolio to be classed "Above Standard" and "Excessive".
• 20% and 300,000: VAMP enumeration criteria, meaning an enumeration ratio of 20% of authorizations and at least 300,000 enumerated transactions in a month.
• USD 4 to 8: fee per fraudulent or disputed transaction once an acquirer or merchant is identified, according to acquirer documentation on scheme monitoring.
• 0.5% and USD 50,000: Mastercard EFM criteria, a fraud chargeback ratio of 0.5% and 50,000 dollars of fraud chargebacks in a month, for merchants with at least 1,000 e-commerce transactions and low 3-D Secure use.
• 5 years: time a merchant stays listed in MATCH, according to Stripe’s documentation on MATCH, which counts 13 reason codes.

What are the risks and limits of monitoring programs?

The programs protect the card system, and they create cost and uncertainty for those measured. The main limits are:

• Double counting. In VAMP, a fraudulent transaction can generate both a fraud report and a dispute. Both count.
• Limited control. A TC40 is filed by the issuer. The merchant cannot contest it and often never sees it. Stripe’s monitoring program FAQ describes it as a report an issuer files when it suspects fraud.
• Pre-dispute tools help only in part. Adyen’s documentation on dispute and fraud monitoring states that chargebacks resolved through RDR and CDRN are excluded from the VAMP ratio, but that the fraud notifications linked to them are not. RDR and CDRN reduce the dispute count, not the fraud count.
• Portfolio effect. An acquirer above 0.5% pays for its whole portfolio. It may then tighten terms for merchants that are individually compliant.
• Regional differences. Thresholds are not the same everywhere. In Latin America, covered in our guide to payment methods in Mexico, the 1.5% merchant threshold applied from the start.
• Lasting consequences. A MATCH listing makes it hard to open a new merchant account for years, even after the business has changed.
• Lag. Disputes arrive weeks after the sale. A ratio published today reflects decisions taken two months ago.

Card scheme monitoring programs: what changes for PSPs, PayFacs and platforms

Operators sit between the scheme and the merchant. They receive the notifications, pay the fees first, and need tools to act before thresholds are reached.

Onboarding

Checking MATCH and Visa’s terminated-merchant file before approval is a scheme requirement for acquirers. Operators that onboard on behalf of an acquirer should record the check and its result. Business model, delivery times and refund policy collected at onboarding predict later ratios better than any score.

Monitoring

Ratios must be calculated per merchant, per acquirer connection and for the whole portfolio, with each scheme’s own formula. Alerts at 50% and 75% of a threshold leave time to act. Platform supervision tooling should show these numbers daily, not at month end. Fraud patterns such as card testing appear first in authorization data, which is why velocity limits belong in the same view.

Disputes and alerts

Every dispute avoided lowers the ratio. Fast refunds, recognizable descriptors and pre-chargeback alerts connected to the refund flow are the main levers. The blog article on matching pre-chargeback alerts to transactions explains why matching speed matters.

Fraud prevention

Fraud reports count as much as disputes in VAMP. Authentication, device data and behavioral rules reduce them at the source. The article AI vs fraud: the new invisible arms race in payments and the #TheShot episode AI agents that fix payment acceptance look at how detection is changing.

Reporting up the chain

When a merchant is identified, the acquirer expects a remediation plan with dates and measures, then monthly evidence that the plan works. An operator that can export dispute reasons, refund times, authentication rates and fraud rules per merchant answers in hours. One that has to assemble the data by hand loses a month, and the program counts months.

Pricing and contracts

Scheme fees per disputed transaction should be visible in merchant pricing, and contracts should state who pays them. Some operators also link reserve terms to ratios. The Payments Library lists the Weekly Fraudcast for teams that want to follow fraud topics regularly.

Are monitoring programs manageable in 2026?

Yes, for operators that measure early. The thresholds are known, the formulas are public, and most merchants are far below them. The difficulty is the combination: a lower merchant threshold, fraud reports that cannot be contested, and an acquirer-level ratio that adds up every merchant. An operator with a healthy portfolio can still be affected if its acquirer is not, because the acquirer will tighten terms for everyone it sponsors. Spreading volume across several acquirers, as described in multi-acquiring, does not remove the need to stay below the thresholds with each acquirer. It does give the operator a fallback if one relationship becomes constrained. What it means by player:

• PSPs: calculate each scheme’s ratio per merchant every day, and act at half the threshold.
• PayFacs: watch the portfolio ratio as closely as individual sub-merchants, because the sponsor acquirer does.
• ISOs: know which merchants approach a threshold before the acquirer’s letter arrives.
• ISVs and platforms: give merchants a simple view of disputes, refunds and alerts, since they are the ones who can fix the cause.

Card scheme monitoring programs count what goes wrong, and the operators who stay below the lines are the ones who count the same things first.