High-Risk Merchant Accounts: What Changes

Who decides what counts as high risk

Three layers decide. First, the networks. Visa's rules say it classifies a merchant required to use MCCs for a High-Integrity Risk Merchant as specified in the Visa Integrity Risk Program Guide; that guide, not the public rules, holds the list, so we do not reproduce one here. Second, the acquirer: Visa's merchant qualification standards require an acquirer or payment facilitator, before signing, to ensure a prospective merchant is financially responsible, not engaged in activity that could harm the Visa system or brand, operating within an allowed jurisdiction and not misrepresenting its locations. Third, the acquirer's own credit policy, which is not public and varies by provider.

What Visa requires acquirers to watch

For a High-Integrity Risk Merchant, Visa's rules require the acquirer to retain daily data on gross sales volume, average transaction amount, number of transaction receipts and number of disputes. The acquirer must collect that data for at least one month after the merchant's first deposit, use it to set the merchant's normal daily activity, begin daily monitoring on the 31st calendar day from the first deposit, compare current activity against normal at least daily, review it at least weekly and adjust it at least monthly. On Visa's request the acquirer must provide the original underwriting package and its monitoring records within 7 calendar days. Visa may also impose security or authentication requirements on these merchants, and may disqualify one from the Visa program for reaching a critical level of dispute activity, acting to circumvent Visa programs or causing harm to the Visa system.

Some categories lose a fraud dispute protection

In the US region, Visa's rules require acquirers to tell merchants in certain categories that their secure electronic commerce transactions are not eligible for dispute protection from Dispute Condition 10.4 (Other Fraud – Card-Absent Environment). The MCCs listed are 4829 (wire transfer money orders), 5967 (adult content and services), 6051 (non-financial institutions, including cryptocurrency and money orders), 6540 (stored value card purchase or load), 7801 (government-licensed online casinos), 7802 (government-licensed horse or dog racing) and 7995 (betting). If your business uses one of these codes, authentication alone will not shift that fraud dispute liability the way it can elsewhere. Our merchant category code guide explains how codes are assigned.

What changes for your account

Visa's rules say an acquirer must pay its merchant promptly after deposit, and that the payment equals transaction totals less credits, discounts, disputes, other agreed fees or merchant reserve funds, if applicable, accumulated to guarantee the merchant's obligations to the acquirer. The rules permit a reserve but do not set its size or release schedule; those come from your merchant agreement, so read that section before you sign. Termination also carries more weight: Visa requires an acquirer to add a terminated merchant to the Terminated Merchant File by close of business on the day after the merchant is notified, for reasons that include excessive disputes and identification in the Visa Acquirer Monitoring Program or Visa Integrity Risk Program reports. Stability is worth more than a small rate difference.

Expect ownership and identity questions

FinCEN's customer due diligence rule, 31 CFR 1010.230, requires covered financial institutions such as banks to have written procedures to identify and verify the beneficial owners of legal entity customers when a new account is opened. Whether a given provider applies that rule to your merchant account depends on how it is structured, but ownership documents, IDs and a clear description of what you sell are routine requests. Complete answers the first time avoid the back-and-forth that delays approval. This is general information, not legal advice (September 17, 2026).

Reducing the impact

Describe your business, products and fulfilment times accurately, because Visa's rules tie the MCC to what the merchant actually does and require two or more MCCs where a separate line of business is designated High-Integrity Risk. Keep order, delivery and customer contact records for every sale so disputes can be answered. Tell your provider before launching a new product line or a large promotion. Illustrative example only, with made-up round numbers: a merchant that normally deposits about 40 sales a day averaging $50 suddenly deposits 400 sales averaging $500. That is exactly the departure from normal daily activity Visa's monitoring rule asks acquirers to compare against, and a note to the provider beforehand is far easier than an explanation afterwards.