Visa VAMP Explained: What Counts, What It Costs, and How to Stay Under the Line

Updated October 2026

Visa VAMP, the Visa Acquirer Monitoring Program, is the single scorecard Visa now uses to judge card-not-present fraud and dispute performance. Since April 1, 2026, merchants in the US, Canada, Europe, and Asia Pacific are flagged as "excessive" at a 1.5% VAMP ratio, down from 2.2% when the program launched.

What matters now is planning around it. VAMP counts more activity than older programs did, and the merchants who get surprised are usually measuring the wrong number. This guide covers what counts, what it costs, and how to build a 2027 plan that keeps you under the line.

What is Visa VAMP and how is the ratio calculated?

Visa VAMP is a monthly monitoring program that combines fraud reports and disputes into one ratio, measured against settled card-not-present transactions. Visa's VAMP fact sheet defines it this way:

A few details catch merchants off guard:

• Fraud reports count even without a chargeback. A TC40 is an issuer's fraud report, often surfaced to merchants as an early fraud warning.
• One bad transaction can count twice. If a payment gets a TC40 and then a fraud dispute, both are counted.
• Refunds don't erase anything. Monitoring programs ignore dispute outcomes and refunds issued after the fact.
• Volume is grouped by descriptor and acquirer. Visa identifies an account by the static part of its statement descriptor plus its acquiring bank, so one business can look like several accounts.

Visa folded six older compliance programs into VAMP, a consolidation it discussed in its program update interview.

What are the current VAMP thresholds?

Merchants are flagged as "excessive" when they cross both a ratio and a minimum monthly count, per Visa's fact sheet:

Acquirers are measured across their whole portfolio. Above standard starts at a 0.5% ratio and excessive at 0.7%, with the same minimum counts. Visa said programs for Brazil, Chile, and India would be announced separately, so confirm rules there with your acquirer.

Visa also runs a separate enumeration (card-testing) track: 300,000 or more enumerated transactions in a month, at a ratio of 20% or higher.

For a quick walkthrough of the drop from 2.2% to 1.5% and how fraud reports and disputes combine in the ratio, Daniel Lev breaks it down in under three minutes.

What does VAMP enrollment cost?

Enrolled merchants pay $8 per dispute or fraud-reported transaction, according to Checkout.com's VAMP fee schedule. Acquirers that hit above standard pay $4 per item, effective January 1, 2026, and $8 at excessive.

Two details shape the real exposure:

• A first identification gets a grace window. A first breach within a rolling 12 months triggers a three-month remediation period before fees apply.
• Smaller merchants aren't automatically safe. When an acquirer's portfolio is flagged as excessive, merchants with a ratio of 0.5% or higher can be assessed the $8 fee.

Fees are the visible cost. Acquirers under pressure also tighten limits or exit merchants, and in our experience that's how a VAMP problem turns into a processing problem, the pattern behind many travel merchant account terminations.

How do RDR, Compelling Evidence 3.0, and Order Insight affect your count?

Pre-dispute tools can remove items from the ratio, but each removes something different. Stripe's monitoring program documentation confirms Visa excludes disputes resolved through pre-dispute products and TC40s that qualify for Compelling Evidence 3.0.

• Rapid Dispute Resolution (RDR): Auto-refunds qualifying disputes before they become chargebacks. That removes the TC15, but any TC40 the issuer already filed still counts.
• Compelling Evidence 3.0 (CE 3.0): Uses prior undisputed history with the same cardholder to rebut fraud claims. When it qualifies, it keeps both the dispute and the related fraud report out of the ratio.
• Order Insight: Shares order details with the issuer during a cardholder inquiry, which can stop "I don't recognize this" disputes before they're filed. Issuers can still file a TC40 at their discretion.

Because RDR doesn't touch fraud reports, merchants with heavy true fraud need upstream controls, such as real-time transaction monitoring, velocity rules, and tokenized card storage, alongside dispute tooling.

What does a VAMP breach look like in practice?

Take a merchant settling 120,000 Visa card-not-present transactions in a month with 1,100 disputes and 900 TC40 fraud reports.

1. VAMP count: 1,100 + 900 = 2,000, which clears the 1,500 minimum.
2. VAMP ratio: 2,000 ÷ 120,000 = 1.67%, above the 1.5% line.
3. Under the original 2.2% threshold, this merchant had room for 2,640 items. Today the ceiling is 1,800.
4. Once fees apply: 2,000 × $8 = $16,000 for the month.

Now suppose RDR resolves 300 of those disputes. The count drops to 1,700 and the ratio to 1.42%, back under the line. If those 300 had come from fraud reports instead, RDR wouldn't have helped, which is why the TC40 side deserves its own plan.

How does Mastercard's program compare?

Mastercard runs parallel programs with different math: it divides this month's chargebacks by the previous month's transactions and counts chargebacks regardless of outcome.

ECM fines start at $1,000 in month two and escalate with each month in the program. A merchant can sit comfortably under VAMP and still trip ECM, so track both.

How should merchants think about VAMP in 2027?

Plan for 2027 around today's rules, since Visa hasn't published new 2027 merchant thresholds for the US, Canada, Europe, or Asia Pacific as of October 2026. Here's where we'd focus:

• Seasonality. Disputes lag sales by weeks, so a holiday or event peak shows up in January and February counts against a smaller transaction base. Model your ratio on post-peak months, a pattern familiar to anyone managing ticket resale chargebacks.
• New markets. New issuers bring new fraud patterns and sometimes new regional rules. Ramp gradually and watch early fraud warnings by country.
• Refund policy. A fast, clearly stated refund path converts would-be disputes into refunds. Refunds don't count toward VAMP; disputes do.
• Descriptor clarity. Unrecognized charges drive friendly fraud at live events and everywhere else. Use a descriptor customers recognize and a consistent static prefix across products.
• Pre-dispute coverage. Enroll in RDR, CE 3.0, and Order Insight where your acquirer supports them, and review RDR rules quarterly so you aren't auto-refunding winnable cases.
• Multi-acquirer redundancy. If one acquiring bank tightens or exits, a second keeps you processing while you remediate.

Match the plan to your vertical: chargebacks in gaming cluster around account takeovers, while travel and live events skew toward cancellations.

How did Courtyard.io bring its chargeback rate down?

Courtyard.io, a collectibles marketplace, partnered with Coinflow in Q2 2024 to give sellers standard, same-day, and instant payout options. Between Q2 and Q3 2024, Courtyard.io's chargeback rate fell from 1.42% to 0.28%, while active sellers grew 463%.

That's the outcome VAMP rewards: more volume with less dispute exposure. Read the full Courtyard.io marketplace case study.

How does Coinflow help merchants stay under VAMP thresholds?

Coinflow is payments infrastructure that connects you to every payment network through one integration. We offer fraud and chargeback indemnification on approved card-not-present transactions, with real-time fraud decisions that keep good customers out of a manual review queue, and Know Your Customer (KYC), Know Your Business (KYB), anti-money laundering (AML), and sanctions screening built in.

Multi-acquirer redundancy means one bank exiting doesn't stop processing, and merchants typically see a 3–7% approvals lift versus legacy processors. We underwrite up front, including for categories other processors turn away, with volume and seasonality underwritten well before launch, so peak windows don't trip freezes. Most teams are live in weeks, not quarters.

If VAMP has your acquirer asking hard questions, we'll help you see where your ratio comes from and what a more resilient setup looks like.

Frequently asked questions