Chapter 1. Why a sector becomes high risk: the mechanics of acquirer risk.
“High risk” is an economic and regulatory assessment of a merchant's business made by the acquirer, not a moral judgment. When a merchant accepts a card, the acquirer financially guarantees the transaction to the card network. If the merchant goes bankrupt before delivering, or is buried under disputed payments, the acquirer bears the cost of the refunds. High-risk classification measures that exposure.
The MCC: every merchant's risk label
Every merchant is assigned a Merchant Category Code (MCC, ISO 18245 standard). Card networks flag certain MCCs as “high risk” and subject them to specific registration, annual fees, and enhanced monitoring. Miscoding your business to avoid this is grounds for immediate termination and a listing on Mastercard's MATCH list.
| MCC | Activity | Why it's monitored |
|---|---|---|
| 7995 | Gambling and betting | Legality varies by country; addiction; money laundering |
| 6051 | Quasi-cash / crypto-asset purchases | Treated like a cash withdrawal; fraud and AML |
| 5967 | Teleservices and paid content | Hidden subscriptions, mass disputes |
| 5122 / 5912 | Online pharmacies and drugstores | Regulated products, counterfeits |
| 4511 / 4722 | Airlines, travel agencies | Deferred delivery, bankruptcy risk |
| 5966 / 5968 | Outbound telemarketing, subscriptions | Negative option billing, disputed renewals |
Chapter 2. Travel and ticketing: the risk of deferred delivery.
Travel is the “respectable” high-risk sector. It features global brands, huge volumes, and a structural gap between payment and delivery. A plane ticket bought in January for an August flight is a seven-month service liability. If the airline goes under in the meantime, every unflown ticket becomes a “services not rendered” chargeback.
Ticketing and live events: same causes, different symptoms
- Canceled or postponed events: whole venues' worth of simultaneous chargebacks, often months after payment.
- Resale fraud: tickets bought with stolen cards, then resold on secondary marketplaces.
- Bots and scalping: mass automated purchases that damage customer relationships and trigger disputes.
- Marketplace model: when the platform collects funds on behalf of third-party organizers, it carries their default risk (and falls under the payment services regime if it handles the funds without a license or an exemption).
Chapter 3. Crypto, CBD, nutraceuticals: three regulatory frontiers.
Three verticals illustrate “regulatory” high risk. The products are legal, but the rules governing them keep shifting, and the acquirer must continuously prove that every transaction complies with the rules in force. The risk is not just chargebacks but non-compliance, which both card networks and regulators penalize.
Crypto-assets: from the Wild West to MiCA
Buying crypto by card is coded MCC 6051 (quasi-cash). Card networks treat it like a cash withdrawal, with specific interchange and stricter requirements. In Europe, the MiCA regulation, fully applicable since December 30, 2024, requires providers to be licensed as CASPs. For an acquirer, an unlicensed exchange is now unbankable. Then there is the TFR, the “travel rule” for crypto-asset transfers, in force since late 2024. And there is volatility: a customer who bought at the top is a natural candidate for an “I didn't authorize this” chargeback.
CBD: legal, but with shifting boundaries
- In France, selling CBD is legal if the finished product contains less than 0.3% THC (order of December 30, 2021, adopted after the CJEU's 2020 Kanavape ruling).
- Card networks and acquirers require batch-level certificates of analysis, traceability of origin, and product pages free of therapeutic claims.
- The regulatory patchwork (novel food status still under review at EFSA, rules that differ between EU member states and between US states) requires strict geoblocking of sales.
Nutraceuticals: the home turf of negative option billing
“Miracle” dietary supplements, free trials that turn into €79-a-month subscriptions: nutra concentrates the worst billing practices. The US FTC imposes heavy penalties for negative option billing without proper consent. Since 2020–2022, card networks have imposed strict subscription rules: explicit consent, a reminder before renewal, and online cancellation as easy as signing up. Chargeback ratios in the vertical remain structurally among the highest in e-commerce.
| Vertical | Main risk | Key acquirer requirement |
|---|---|---|
| Crypto (MCC 6051) | AML, sanctions, volatility | CASP license (MiCA), robust KYC/KYT, wallet screening |
| CBD | Product and territorial compliance | Certificates of analysis showing THC < 0.3%, geoblocking, zero health claims |
| Nutraceuticals | Subscription chargebacks | Transparent sign-up flow, easy cancellation, clear descriptor |
Chapter 4. iGaming and online betting: licenses, MCC 7995, and controlled flows.
Online gambling is the archetypal high-risk vertical: an intangible product, impulsive customers, a legal framework fragmented country by country, and heavy exposure to money laundering. The market is large and growing. Specialist acquirers compete for it, provided they get compliance exactly right.
License first, payments second
No serious acquirer will sign an operator that lacks a valid license in every target market. That means the ANJ in France for sports betting, horse racing, and poker (online casinos remain banned there); the UKGC in the UK; the MGA in Malta; and state regulators in the US since the 2018 Murphy decision. Geoblocking must be demonstrable. Accepting a bet from a player in a country the license doesn't cover exposes the operator, the acquirer, and the card network.
On the dispute side, iGaming combines friendly fraud (“it wasn't me who played”), loser's remorse, and disputes over bonuses. French issuers' policies vary widely. A high authorization decline rate on MCC 7995 is normal, which pushes operators toward instant transfers and account-to-account payments for deposits.
Chapter 5. The consequences: reserves, higher MSCs, and monitoring programs.
A high-risk classification doesn't shut you out of payments. It means paying the price of risk. That price takes three forms: tied-up cash (reserves), higher fees (MSC), and a contractual sword of Damocles in the form of card network monitoring programs and short-notice termination.
VAMP and ECM: the card networks' radar in 2026
In April 2025, Visa replaced its old fraud and dispute programs with VAMP (Visa Acquirer Monitoring Program). It tracks a combined fraud-plus-disputes ratio against settled transactions. Enforcement has been in effect since October 2025. Mastercard keeps its ECM (Excessive Chargeback Merchant) program, based on the ratio of a month's chargebacks to the previous month's transactions.
| Program | Level | Threshold | Consequence |
|---|---|---|---|
| Visa VAMP (merchant) | Excessive | Fraud-plus-disputes ratio ≥ 2.2% in 2025, lowered to 1.5% in 2026 (min. 1,500 fraud reports + disputes/month) | Per-dispute fines charged to the acquirer, remediation plan, risk of termination |
| Visa VAMP (acquirer) | Above standard / Excessive | 0.5% / 0.7% across its portfolio | An acquirer under pressure passes it on to its riskiest merchants |
| Mastercard ECM | Excessive (ECM) | ≥ 1.5% and ≥ 100 chargebacks/month | Fines that escalate the longer the merchant stays in the program |
| Mastercard HECM | High excessive | ≥ 3% and ≥ 300 chargebacks/month | Heavy fines; the acquirer is eventually required to offboard the merchant |
The specialist acquirer ecosystem
With generalist acquirers turning these verticals away, a dedicated ecosystem has grown up around specialist acquirers and PSPs, often based in Malta, Cyprus, the UK, or North America. Merchant account brokers and orchestrators that split volume across several contracts round it out. Their value lies in three things: risk appetite, compliance tooling (enhanced KYC, website monitoring), and knowledge of the network rules specific to each vertical.
Chapter 6. Staying bankable over time: the high-risk merchant's strategy.
For a high-risk merchant, most of the work starts after landing an acquirer: the challenge is keeping it. Survival depends on constant work on ratios, full transparency with partners, and a payment architecture that never relies on a single contract.
Pillar 1: crush the dispute ratio
- A crystal-clear billing descriptor: the text on the statement must let customers recognize the purchase; an obscure descriptor breeds friendly fraud.
- Pre-dispute alerts: Ethoca (Mastercard) and Verifi/Order Insight (Visa) warn the merchant that a dispute is coming; refunding within 24 to 72 hours keeps it from counting as a chargeback. RDR (Rapid Dispute Resolution) even automates the refund based on predefined rules.
- Compelling Evidence 3.0: since 2023, Visa has allowed an alleged fraud to be requalified as a dispute the cardholder cannot win, if the merchant proves two earlier undisputed transactions by the same customer (device, IP, address).
- Hyper-responsive customer service: easy refunds and one-click cancellation always cost less than a chargeback (fixed fees plus a worse ratio).
Pillar 2: compliance as a commercial asset
A flawless onboarding file shifts the balance of power. With licenses, certificates of analysis, a compliant refund policy, and documented AML/CFT procedures, the merchant has acquirers competing for its business instead of begging them. Conversely, any concealment that comes to light means termination and a MATCH listing, whether it's a miscoded business, a mirror site, or undeclared traffic.
Pillar 3: diversify contracts and payment rails
| Area | Best practices | Red flags |
|---|---|---|
| Disputes | Ratio < 0.9%, Ethoca/Verifi alerts active, refunds in < 72 hours | Ratio > 1.5%, unanswered disputes |
| Compliance | Licenses up to date, geoblocking tested, clear descriptor | Miscoding, mirror sites, prohibited claims |
| Finance | Reserves funded, regular reporting to the acquirer | Cash flow dependent on undelivered sales |
| Architecture | At least two acquirers + A2A rails | 100% of volume on a single contract |
High risk is a regime of constant proof. Merchants that last treat their dispute ratios as a daily management metric and their acquirers as informed partners. Diversification is life insurance, never a way to hide what's going wrong.