Card Network Monitoring Programs: The Thresholds That Actually Apply

Search for chargeback thresholds and you will mostly find the same retired figures repeated across blog posts and vendor pages: a one percent ratio, a hundred disputes, a program acronym that no longer operates the way it is described. Those numbers were accurate once. They have since been consolidated and replaced, and the pages carrying them were never updated.

This matters more than a pedantic correction, because merchants plan against these numbers. A business that believes it has headroom to one percent, when the operative denominator and event set have both changed, can walk into an enforcement tier it did not know existed. This page is a plain reference to what the two major networks actually measure right now, and — more usefully — to why they frequently disagree about the same business.

Visa consolidated its older fraud and dispute programs into a single global framework, the Visa Acquirer Monitoring Program. The name is the first important detail, and it is routinely overlooked: this is an acquirer program. The party formally measured, notified and assessed is the acquiring bank, not the merchant. Merchants experience it indirectly, through an acquirer that is protecting its own standing.

The VAMP ratio combines two things older guidance treated separately. It adds the count of fraud reports to the count of disputes, then divides by the count of settled card-not-present transactions. Both halves of the numerator are counts, not dollar values, so a portfolio of small transactions gets no relief from a low average ticket — a hundred disputed ten-dollar orders weigh exactly as much as a hundred disputed thousand-dollar orders.

As of April 1, 2026, the excessive threshold is 1.5% in the United States, Canada, the European Union and the Asia-Pacific region, and 2.2% in the CEMEA region. Reaching excessive status brings per-incident fees in the region of eight dollars and, if the condition persists, exposure to termination.

VAMP only engages once a merchant produces enough monthly fraud and dispute events to clear a floor of roughly 1,500. Read quickly, that sounds like relief for a smaller business, and it is often reported that way. In practice it produces the single most common misunderstanding in this area.

A merchant below the floor is not virtuous under VAMP. It is invisible to VAMP. Those are different conditions, and only one of them survives growth. A business running a two percent dispute rate at modest volume is outside the program purely because of its size, and will cross into it on the strength of a good quarter — arriving at the threshold already breaching it, with the ratio built into how the business has been operating for a year.

This is why a serious underwriter looks at your ratio rather than your program status. Program status is a lagging function of volume. The ratio is the thing that will still be true after you scale.

Mastercard operates its own Excessive Chargeback Program, and it is not a variation on Visa’s. It counts chargebacks only — fraud reports are not folded into the same ratio — and it applies two tiers. The Excessive Chargeback Merchant tier covers merchants with 100 to 299 chargebacks in a month at a ratio between 1.5% and 2.99%. The High Excessive tier covers 300 or more chargebacks at a ratio of 3.0% or above.

The denominator is where the two networks part company most sharply. Mastercard divides the current month’s chargebacks by the preceding month’s captured transactions. Because disputes arrive weeks after the purchases that caused them, that lag is a deliberate attempt to compare like with like. But it has a consequence worth planning around: in any month where volume falls, the ratio rises on its own. A seasonal business coming off a peak can see its ratio climb while the absolute number of disputes is flat or improving.

Enforcement escalates on a schedule rather than immediately. Fines begin in the second month of breach, and from the fourth month an additional issuer recovery assessment applies to each chargeback beyond 300. Exiting requires falling below both the count and the ratio for three consecutive months — a single clean month does not release you. Mastercard has also signalled a transition to a successor framework, the Global Merchant Audit Program, effective April 1, 2027, which is expected to tighten the ratio tiers over time.

Put the two frameworks side by side and the practical conclusion is unavoidable: there is no such thing as your chargeback ratio. There are at least two, they are computed from different numerators over different denominators across different periods, and they can point in opposite directions in the same month.

The asymmetry runs in a specific direction. Mastercard’s ECM tier opens at 100 chargebacks with no volume floor at all, while VAMP does not engage below roughly 1,500 combined events. A mid-sized merchant can therefore be in active breach with one network while remaining entirely outside the other network’s program — and will usually hear about it from the acquirer rather than discovering it directly.

The inverse case is rarer but more dangerous. A high-volume, card-not-present business with substantial fraud reports and relatively few formal chargebacks can look healthy against Mastercard’s chargeback-only count while accumulating a VAMP ratio that includes every one of those fraud reports. Watching only the chargeback number, which is the number most merchants actually track, hides that exposure completely.

Card-not-present, subscription-friendly, frequently shipped to a billing address the cardholder does not recognise a month later: this category generates disputes structurally, not because the operator is careless. That makes the distinction between the two frameworks operationally relevant rather than academic.

Two habits do most of the work. The first is a billing descriptor a customer can recognise at a glance, which prevents the ordinary confusion disputes that inflate both ratios. The second is a support channel that is genuinely easier to reach than the issuer’s dispute button — most disputes are a customer service failure that has been escalated to a bank, and every one resolved directly is one that never enters either numerator.

Beyond that, the structural protection is not having a single point of failure. A merchant with one acquirer inherits that acquirer’s risk appetite entirely; when a ratio moves the wrong way, the account is the thing that absorbs it. Redundancy across banking relationships means a tightening in one place is a routing question rather than an outage.