Visa Acquirer Monitoring Program (VAMP)

Visa's consolidated CNP fraud and dispute monitoring programme, effective 1 April 2025, holding acquirers liable for the fraud and dispute performance of their merchant portfolios. VAMP replaced VDMP (Visa Dispute Monitoring Program), VFMP (Visa Fraud Monitoring Program), and the legacy VAMP by consolidating five existing programmes and 38 separate remediation processes into one globally aligned standard. (Visa Corporate, 2025)

What VAMP Is

VAMP measures a combined fraud-and-dispute ratio at acquirer-portfolio level, but also exposes individual merchant ratios. Visa holds the acquiring bank (or PSP acting as acquirer) directly liable — not the merchant — making VAMP fundamentally an acquirer-compliance instrument that cascades down to merchants through commercial pressure. (Equifax, 2025; ACI Worldwide, 2025)

Visa stated VAMP's aim as: "create clarity and consistency for acquirers and their merchants by creating globally aligned fraud thresholds for both domestic and cross-border card-not-present transactions." (Checkout.com, 2025, citing Visa)

Visa claims VAMP has the potential to address four times the amount of fraud globally, accounting for more than $2.5 billion in losses compared to previous programmes. (Visa Corporate, 2025) (as-of 2025)

VAMP Ratio Formula

VAMP ratio = (TC40 fraud alerts + TC15 disputes) ÷ settled CNP transactions in the same calendar month

Key properties (Stripe Docs, retrieved July 2026; Sift, 2025):

Count-based, not value-based — a high volume of low-value disputed CNP transactions inflates the ratio more than fewer high-value disputes. (Basis Theory, 2026)
CNP only — card-present transactions are excluded from both numerator and denominator.
Both fraud-coded and non-fraud-coded TC15 disputes contribute to the numerator — "item not received," "not as described," and other non-fraud codes count alongside fraud chargebacks. (Sift, 2025)
TC40 fraud alerts (Early Fraud Warnings filed by issuing banks) are included even when not formal disputes: "Although they aren't disputes, Early fraud warnings (EFWs) are considered fraudulent (regardless of their outcome), and Visa's VAMP program includes them in its calculations." (Stripe Docs, retrieved July 2026)

The TC40 / TC15 Double-Count Problem

A single disputed transaction can be counted twice in the VAMP ratio: once as a TC40 fraud alert and again as a TC15 formal chargeback if it escalates. ChargebackStop (2025) describes this: "If a fraud alert is issued and you don't refund it fast enough to prevent a chargeback, both of those can count towards your ratio separately" — inflating the apparent risk of merchants experiencing Friendly Fraud.

Issuing a refund before a TC15 chargeback is filed prevents the TC15 from appearing in the VAMP ratio, but the TC40 fraud alert still counts — a refund does not remove TC40s. (ChargebackStop, 2025)

Exclusions from the VAMP Ratio

Disputes resolved through specific tools are excluded from the VAMP count (Stripe Docs, retrieved July 2026; Checkout.com Docs, retrieved July 2026):

Compelling Evidence 3.0 (CE3.0) — removes both the TC40 fraud alert and the TC15 dispute from the ratio. This is the only resolution mechanism that achieves a double exclusion. (Chargebacks911, 2026)
Visa Rapid Dispute Resolution (RDR) — removes the TC15 dispute from the VAMP count; TC40 fraud alert still counts.
Verifi CDRN — removes the TC15; TC40 status subject to contradiction below.

TC40 exclusion via RDR/CDRN: Stripe's live documentation (retrieved July 2026) states that disputes resolved via CE3.0, Verifi CDRN, RDR, and pre-dispute products are excluded from the VAMP count without distinguishing TC40 from TC15. Solidgate (2025) published a follow-up article stating "all TC40 fraud alerts resolved with RDR and CDRN will now count towards your VAMP ratio," implying Visa issued a mid-programme rule change that closed a prior TC40 exclusion loophole. The prevailing 2026 practitioner position is that TC40s always count regardless of RDR/CDRN resolution, and only TC15s can be excluded via those tools. Sources: Stripe Docs vs Solidgate

Thresholds (as-of 2026-04-01)

Merchant monitoring is only triggered once the combined TC40 + TC15 count exceeds 1,500 CNP transactions per month (outside MENA; MENA floor is 100 events plus $75,000 USD value). (Checkout.com Support, retrieved July 2026)

Minimum event floor 1,000 vs 1,500: Stripe's documentation references 1,000 as the original minimum count; Checkout.com's updated 2026 support articles cite 1,500. Likely reflects a threshold revision Visa made between the April 2025 VAMP launch and mid-2026. The 1,500 figure is treated as current. Sources: Stripe Docs vs Checkout.com Support

Merchant-Level Tiers (as-of 2026-04-01)

Tier	VAMP Ratio	Fee
Early Warning	0.4%–0.5%	None — notification only
Above Standard	0.5%–0.7%	—
Excessive	≥1.5% (AP/CA/EU/US); ≥2.2% (CEMEA)	$8 per event

(Chargebacks911, 2026; Justt.ai, 2026)

LAC (Latin America/Caribbean) was already at 1.5% from VAMP launch in April 2025, ahead of other regions. (Justt.ai, 2026)

Fee amount $8 vs $10: All major independent sources (Chargebacks911, Justt.ai, Forter, NMI, Ravelin, Basis Theory) consistently cite $8 per event for the Excessive merchant tier. A Merchant Risk Council search excerpt cited "$10 per fraudulent or disputed transaction" — this appears to be a summarization error as it appears only in a snippet and not in MRC article text. $8 is treated as prevailing; verify against current Visa VERC notices. Sources: Justt.ai vs MRC snippet.

Acquirer-Level Tiers (as-of 2026-01-01)

Tier	Portfolio VAMP Ratio	Fee
Above Standard	≥0.5% (≥50bps)	$4 per event
Excessive	≥0.7% (≥70bps)	$8 per event

(Visa Corporate, 2025/2026; NMI, 2025) — acquirer $4 fee figure from 2025 vendor source (NMI); not independently confirmed in a 2026 primary source. (as-of 2026-01-01)

Enforcement Timeline

Date	Milestone
1 Apr 2025	VAMP launches; six-month advisory period begins; notifications sent, no fines
1 Oct 2025	Excessive-level enforcement begins for merchants
1 Jan 2026	Stricter Above Standard thresholds for acquirers take effect
1 Apr 2026	Excessive merchant threshold tightens to 1.5% (AP/CA/EU/US), down from 2.2% — a 32% reduction overnight

(Chargebacks911, 2026; Visa Corporate, 2025/2026)

Enumeration Monitoring

VAMP includes a second ratio metric — the VAMP Enumeration Ratio — separate from the fraud/dispute ratio (Stripe Docs; Adyen Docs, retrieved July 2026):

Enumeration ratio = enumerated authorisation transactions (approved + declined) ÷ all authorisation transactions (approved + declined)

Threshold: ≥20% (2,000 basis points) (as-of 2026)
Minimum count to trigger monitoring: ≥300,000 enumerated transactions per month
Enumerated transactions identified via Visa Account Attack Intelligence (VAAI) Score — Visa's AI system detecting brute-force PAN/CVV/expiry testing in CNP authorisation streams (as-of 2026)

The high minimum (300,000 events/month) limits enumeration monitoring to high-volume merchants with weakly rate-limited checkout flows — fraudsters automate authorisation attempts using large sets of stolen PANs to validate card details for later use. (Sardine.ai, 2025; Authsignal, 2025)

Acquirer vs. Merchant Liability Structure

VAMP targets acquirers: Visa holds the acquiring bank or PSP directly liable for its entire merchant portfolio's fraud and dispute performance. (Equifax, 2025)

In practice, acquirers experiencing elevated portfolio VAMP ratios respond by increasing merchant reserves, raising processing fees, or terminating merchant relationships — passing compliance pressure down to merchants without those merchants being directly fined by Visa. (NMI, 2025)

ACI Worldwide (2025) notes that acquirers "may off-board legitimate merchants simply to reduce risk," meaning compliant merchants in structurally high-dispute categories (travel, subscriptions, fashion CNP) may lose payment processing access even if individually within threshold.

Remediation on a VAMP notice requires acquirers to submit a plan to Visa's VERC platform within 15 calendar days of notification. Visa provides a 90-day grace period for every 12-month period in which the client has not previously been in the programme. (Solidgate, 2025)

Impact on CNP and Fashion Merchants

VAMP covers CNP transactions only, making ecommerce the primary affected population. (ACI Worldwide, 2025)

High-volume CNP merchants with thin average order values — mass-market fashion — face disproportionate exposure because the ratio is count-based: a large number of low-value disputed transactions inflates it more than fewer high-value disputes. (Basis Theory, 2026)

Forter (2026) noted that merchants operating at 1.8%–2.1% under April 2025 thresholds became non-compliant overnight on April 1, 2026 without changing any operational behaviour — illustrating structural exposure for merchants near thresholds.

Chargebacks911's 2026 Chargeback Field Report (250+ merchants surveyed, published 2026-06-30) found: 1 in 5 merchants say VAMP changes directly affected their business; ~1/3 do not know if they are affected; only 26.8% actively monitor TC40 fraud records to track their VAMP ratio. (as-of 2026-06-30)

Comparison: VAMP vs. Mastercard ECP

Dimension	Visa VAMP	Mastercard ECP
Numerator	TC40 fraud alerts + TC15 disputes	Chargebacks only
Threshold type	Single ratio	Dual (rate + volume count)
Excessive threshold	≥1.5% (AP/CA/EU/US, as-of Apr 2026)	≥1.5% + ≥100 chargebacks/month
High Excessive tier	—	≥3% + ≥300 chargebacks/month
Calculation basis	Count-based	Count-based

(GivePayments, 2026; Mastercard Security Rules, 2026-02-03)

Because VAMP counts both TC40 fraud alerts and TC15 disputes, merchants experiencing Friendly Fraud carry structurally higher VAMP ratios than they would under Mastercard's ECP, which counts chargebacks only. (GivePayments, 2026)

Mastercard First-Party Trust (FPT) is the functional equivalent of Compelling Evidence 3.0 (CE3.0) on the Mastercard network: device fingerprinting, delivery data, and purchase history to deflect disputes before they become chargebacks, with issuer liability shift on matched transactions. (Justt.ai, 2025)

Mastercard's Mastercard Scam Merchant Monitoring Program (SMMP) takes full effect 2026-07-24, adding a third monitoring dimension (scam-linked disputes) alongside ECP and EFM on the Mastercard network. (Chargeflow, 2026) (as-of 2026-07-24)

Programme Outcomes (Visa Reported, as-of early 2026)

Visa's VAMP Momentum page reports (as-of early 2026):

Overall VAMP ratio declined >10% quarter-over-quarter
Nearly half of acquirers identified in the programme improved within a single quarter (ratio declining ~45% QoQ)
Remediating acquirers saw approximately $1.5 billion in incremental payment volume
Non-remediating acquirers experienced essentially flat approval rates and payment volume growth at roughly half the rate of the broader ecosystem
$30 million+ in issuer operational savings in a single quarter

(Visa Corporate — VAMP Momentum, retrieved 2026)

Key Terms

Term	Meaning
TC40	Visa fraud alert filed by issuing bank; counts in VAMP numerator regardless of outcome
TC15	Formal Visa dispute (chargeback); counts in VAMP numerator
VAMP ratio	(TC40 + TC15) ÷ settled CNP transactions; the single metric VAMP monitors
Excessive	Merchant ≥1.5% (AP/CA/EU/US) or acquirer ≥0.7% — triggers $8/event fee
VAAI	Visa Account Attack Intelligence — AI scoring for enumeration detection
VERC	Visa's enforcement and remediation portal
CE 3.0	Compelling Evidence 3.0 — the only tool removing both TC40 and TC15 from VAMP ratio
Advisory period	April–September 2025; notifications sent but no fines assessed
VDMP	Visa Dispute Monitoring Program — legacy programme replaced by VAMP
VFMP	Visa Fraud Monitoring Program — legacy programme replaced by VAMP