Under Visa's VAMP rules, your riskiest sub-merchant sets the bar for everyone
Visa folded its fraud and dispute programs into one ratio, measured across the portfolio, and tightened the merchant line this April. If you run payments inside a software platform, the merchants you board now share one number. Here is the math and what we would do about it.
If you run payments inside a software platform, you probably watch your chargeback rate. Most platforms do, usually as one blended number someone checks at month end.
Visa doesn't look at it that way anymore. Its old fraud and dispute monitoring programs were folded into one, the Visa Acquirer Monitoring Program (VAMP), and the number that matters is now a single ratio measured across a portfolio. For a platform, that means every merchant you board shares the same fate.
One ratio, counted, not summed
Three things about that ratio catch people out.
It adds fraud and disputes together. A merchant with a low dispute rate can still be in trouble if fraud reports are piling up, and the reverse.
It counts transactions, not dollars. A $9 subscription dispute weighs exactly as much as a $9,000 one. Platforms with lots of small, recurring charges feel this first.
Some things don't count. Disputes resolved through Visa's pre-dispute tools, such as Rapid Dispute Resolution, and fraud that qualifies under Compelling Evidence 3.0 are left out of the ratio. In my experience that exclusion is the most underused lever a platform has.
The lines got tighter
For an acquirer's whole portfolio, Visa draws two lines: Above Standard at 50 basis points (0.50%) and Excessive at 70 (0.70%), once the portfolio has at least 1,500 fraud and dispute events in a month.
For a single merchant, the Excessive line dropped from 220 basis points to 150 on April 1, 2026 in the US, Canada, Europe and Asia Pacific.
Read those two together. A merchant can sit well under 150 while the portfolio it rolls into crosses 50. Visa holds the acquirer accountable, and acquirers pass that pressure down to the platforms and sponsor banks they work with, through contracts, reserves and tighter internal limits than Visa's own.
Five merchants is enough
Here's a simple example. A platform runs 400,000 card-not-present transactions a month.
Most of the book is healthy. 380,000 transactions at 0.30% produce 1,140 fraud and dispute events, a ratio of 30 basis points. Comfortable.
Now add five sub-merchants doing 20,000 transactions between them, about 5% of volume, at 4.5%. That's 900 more events. The book is now at 2,040 events on 400,000 transactions: 51 basis points.
Each of those five is far above 150 basis points. But at about 180 events a month apiece, none of them gets anywhere near the 1,500-event floor that puts a single merchant into Visa's monitoring, and a blended monthly report won't flag them either. On their own they're invisible. Together they pushed everyone else over the acquirer line.
What we'd do about it
Measure where Visa measures. Track the ratio for each sub-merchant, for the platform as a whole, and for what you contribute to your sponsor's portfolio. Weekly, not at month end. By the time a monthly report shows the problem, the month is already counted.
Count the way Visa counts. Counts, not dollars. Tag disputes resolved through RDR and fraud that qualifies for CE3.0 so you neither overstate the ratio nor miss the chance to bring it down.
Turn on the pre-dispute tools. RDR and CE3.0 exist for exactly this. A dispute settled before it becomes a dispute doesn't count against you.
Put 3-D Secure where the risk is. Authenticating the riskier card-not-present flows cuts fraud reports at the source.
Underwrite every sub-merchant like it's yours. Because under VAMP it is. Know which business types carry more risk, watch velocity in the first 90 days, and look for card-testing patterns. VAMP tracks those too, with its own enumeration thresholds.
Have an exit plan. Some merchants won't improve. Decide in advance what number triggers a reserve, a hold or an off-boarding conversation, so it isn't a negotiation when the ratio is already red.
The portfolio is the unit
At LPG, this is how we think about risk when we design payments programs for banks and the software platforms they serve. The merchant isn't the unit of risk anymore. The portfolio is.
Your ratio is only as good as the merchant you were least careful about boarding.
Thresholds and the ratio definition come from Visa's Acquirer Monitoring Program fact sheet. The platform example uses illustrative numbers.