Velocity Limits and Transaction Caps

Three kinds of limit

Provider limits are set at underwriting: a maximum ticket, and daily or monthly volume caps, based on the figures in your application. Network rules add cardholder-level controls, such as Visa's rule for card-absent merchants described below. Device limits also exist: Visa's rules describe terminal risk management on chip-reading devices as including transaction velocity checking. Merchants rarely see any of these written on a statement, so the only reliable way to know your provider limits is to ask.

Visa's daily limit for card-absent merchants

Visa's rules say an acquirer must ensure its card-absent merchant sets daily limits after which the merchant must perform additional verification to confirm the cardholder approves continued spend. The limits must be appropriate for the merchant's business but must not exceed 25 transactions in one day. This is a per-cardholder control aimed at stolen card testing and runaway spend, not a cap on your total sales. If you run a subscription, top-up or gaming business where one customer legitimately buys often, design the extra verification step so it does not frustrate real customers.

How providers watch for spikes

For high-integrity risk merchants, Visa requires acquirers to collect daily gross sales volume, average transaction amount, number of transaction receipts and number of disputes, set a normal daily activity baseline, and compare current activity against it at least daily. Visa's rules also require an acquirer to compare that activity against the baseline at least daily and to investigate what falls outside it. Many providers apply similar comparisons to all accounts. Visa's own small business fraud page advises merchants to check out a huge order shipped far away to a customer they have never done business with. A sudden spike looks the same to a risk system whether it is a great promotion or a fraud run.

What the terminal itself is doing

Some velocity checking happens inside the device rather than in the provider's risk system. Visa defines terminal risk management as a process performed by a chip-reading device to protect a member from fraud by initiating online issuer authorization for above-floor-limit transactions, ensuring random online processing for below-floor-limit transactions, and performing transaction velocity checking. That is why a terminal can decide to go online for a small sale that usually approves in a moment, and why a run of similar taps at one device can start behaving differently part way through a busy day. It is not evidence that your account is in trouble; it is the configuration doing what the rules describe.

Dispute ratio is watched alongside volume

Volume caps are only half of what a risk system looks at. Dispute ratio is priced into the card system itself: Visa's published credit performance threshold criteria for retail and supermarket interchange categories, effective April 18, 2026 and based on 12 months of activity ending September 30, 2025, each require a minimum dispute financials ratio of 0.020%, calculated as a percentage of the merchant's gross transaction count, and PCI compliance. Those thresholds apply to merchants far larger than most small businesses, but they show that dispute ratio is a number the networks attach consequences to, not just a figure your provider frets about. A spike in disputes and a spike in volume arriving together is what turns a review into a hold.

A fraud dispute changes what the limits are for

Limits are not only about volume. Visa requires an acquirer to ensure its merchant attempts to revoke provision of the goods or services to the cardholder after a category 10 (fraud) dispute, and that the merchant has a process in place to prevent a recurrence by that cardholder. Where the fraud arose because a cardholder's account with the merchant was taken over, the merchant must re-authenticate the cardholder before any further authorization requests. So the practical response to a fraud dispute is not only to argue it: tighten the account controls the rules already expect you to have, write down what you changed, and tell your provider. A documented change is what supports the next request to raise a cap.

What happens when you exceed a limit

Depending on the provider, transactions above a cap may decline, be accepted but held for review, or be funded after documents are supplied. Illustrative example only, with made-up round numbers: an online store approved for $30,000 a month with a $500 maximum ticket runs a sale that brings in $12,000 in one weekend, including a few $1,500 orders. Even if every order is genuine, those larger tickets and the pace of sales can trigger a review. Sending the provider the promotion dates, expected volume and largest expected order a week earlier usually avoids that.

Raising your limits

Ask for an increase before you need it. Send recent processing statements, a forecast, the reason for the increase and evidence of fulfilment capacity, such as supplier orders or booked jobs. Ask the provider to confirm the new maximum ticket and daily and monthly caps in writing, and the date they take effect. Update the figures again when your business model changes, for example when you add online sales to a card-present business. This is general information, not legal advice (September 17, 2026).