Problems › VAMP thresholds
VAMP thresholds: the 1.5% line, how Visa counts, and what your acquirer's standing does to it.
TL;DR. Since April 2025 Visa measures fraud and disputes together: TC40 fraud reports plus TC15 disputes, divided by settled card-not-present transactions, per month. From April 2026 a merchant is Excessive at 1.5% with at least 1,500 counted events. The number most merchants miss is the second one: if your acquirer is itself flagged, your bar drops to 0.5% and 5 events. Your exposure depends on your traffic and on the portfolio you sit in.
Who this is for. Merchants processing $100K+ a month in card-not-present who have had a VAMP warning, who run ratios above 1% in a normal month, or who are choosing an acquirer and want to know what to ask.
Your ratio, and how far you are from the line.
VAMP ratio = (TC40 fraud reports + TC15 disputes) ÷ settled CNP transactions, all counted in the month Visa receives them. A transaction that appears in both reports counts twice. Refunds and dispute wins do not remove an event.
- Resolving the 300 double-counted transactions through a pre-dispute tool in the same month would bring the ratio to about 1.08% (pre-dispute resolutions and CE3.0-qualified fraud are excluded, subject to Visa's data-extract timing).
- The denominator is settled transactions, not attempts. Lifting approval on good traffic lowers the ratio; blocking suspicious authorizations before capture prevents the TC40 altogether.
- Visa identifies you per statement descriptor per acquirer. Splitting volume across acquirers changes which MIDs cross the count minimum, not whether the underlying traffic is a problem.
Simplified: one acquirer, one region (AP, Canada, Europe, US, LAC thresholds), no exclusions applied beyond what you enter. CEMEA uses 2.2%, 150 events and USD 75K. Enumeration is monitored separately.
Three numbers, and the one that depends on someone else.
1.5% and 1,500
Excessive, for merchants in AP, Canada, Europe, the US and LAC: ratio at or above 1.5% and at least 1,500 counted events in the month. Both conditions. Under 1,500 events you are not identified, whatever the ratio.
0.5% and 5
The bar for merchants whose acquirer is Above Standard (portfolio ratio from 0.5%) or Excessive (from 0.7%). Visa rates the acquirer on its whole portfolio; once it is flagged, nearly every merchant with a bad month is visible. Ask the acquirer where it stands before you sign.
2.2%, 150, $75K
CEMEA: a higher ratio, a far lower count and a dollar floor. Enumeration is a separate track: 300,000 enumerated authorizations and 20% of authorization attempts, with no fees assessed at present.
Five rules that decide the number before you see it.
01
Month received, not month sold.
A TC40 or TC15 is counted in the month Visa receives it. December sales disputed in February sit in February's ratio, against February's settled transactions. A volume dip after a strong month inflates the ratio on its own.
02
Fraud and disputes both count, sometimes twice.
TC40 is the issuer's fraud report; TC15 is the dispute. The same transaction often produces both, and then it counts as two events. Refunding it or winning the dispute does not remove either.
03
Settled transactions, not attempts.
The denominator is settled card-not-present transactions. Low approval shrinks the denominator and raises the ratio; an authorization you void before capture never produces a TC40. Approval rate and VAMP are the same problem seen from two sides.
04
Per descriptor, per acquirer.
Visa identifies a merchant by the static part of its statement descriptor and its acquirer, so one business can be several VAMP accounts. Spreading volume changes which accounts cross 1,500 events; it does not change the traffic.
05
Exclusions have a clock.
Pre-dispute resolutions and CE3.0-qualified fraud are excluded, subject to the timing of Visa's data extract. In practice: resolve in the month the event is raised, or it counts.
Four patterns we see in higher-scrutiny categories.
01
Clean ratio, flagged acquirer.
The merchant runs 0.7% and thinks it is safe. The acquirer is Above Standard on its portfolio, so the merchant's bar is 0.5% and it is identified. Nobody asked the acquirer about its own standing at onboarding.
02
Managing chargebacks, ignoring TC40.
The dispute programme is tight: alerts, refunds, representments. The fraud reports keep arriving, because a refunded fraud transaction still generates a TC40. The ratio stays above the line while the chargeback rate looks fine.
03
The acquirer moves first.
Visa's fee is not what ends the relationship. The acquirer's risk team sees the same monthly number, raises the reserve, caps the volume, and if the trend holds, terminates. By the time the Visa fee shows up, the account is already on a watch list.
04
One acquirer, no fallback.
If the single acquirer caps or closes the account over VAMP, there is nowhere to route the good traffic while the fix takes effect. A second acquirer that underwrites your vertical knowingly is the difference between a bad quarter and weeks of zero.
Fix the ratio where it is made, and sit in the right portfolio.
We pull six months of TC40 and TC15 counts per descriptor per acquirer, separate the fraud from the non-fraud disputes, and look at approval rate alongside them, because the denominator is half the ratio. Then we look at where you sit: which acquirer, what its standing is, and whether a second one that underwrites your vertical knowingly would carry part of the volume on better terms.
Visa's rules are the same for everyone. Which acquirer you sit with, and what it does with the number, is not. That is the part we work on.
What is VAMP?
The Visa Acquirer Monitoring Program. From April 2025 it replaced Visa's separate dispute (VDMP) and fraud (VFMP) programs with one ratio that combines both: fraud reports (TC40) plus disputes (TC15), divided by settled card-not-present transactions, per calendar month. Visa measures acquirers and the merchants in their portfolios. Enforcement with fees started October 2025; lower thresholds apply from April 2026.
How is the VAMP ratio calculated?
(TC40 fraud reports + TC15 disputes) ÷ settled Visa card-not-present transactions, in the month Visa receives the reports, not the month of the sale. A transaction that shows up in both reports counts twice. Refunding a transaction or winning the dispute does not remove it. Visa also tracks the count and, in CEMEA, the dollar amount of these events.
What are the VAMP thresholds for merchants in 2026?
Excessive: a ratio of 1.5% or above and at least 1,500 counted events in the month (AP, Canada, Europe, US and LAC). CEMEA: 2.2%, 150 events and USD 75,000. If your acquirer is itself Above Standard or Excessive, a much lower bar applies to its merchants: 0.5% and 5 events. Enumeration (card testing) is monitored separately at 300,000 enumerated authorizations and 20% of authorizations; Visa does not currently assess fees for enumeration.
What does an acquirer's standing have to do with my account?
Everything, as of 2026. Visa rates acquirers on their whole portfolio: Above Standard from 0.5%, Excessive from 0.7%. When an acquirer is flagged, the merchant threshold inside that portfolio drops from 1.5% / 1,500 events to 0.5% / 5 events, so a merchant with clean-looking numbers can be identified because of who else the acquirer boards. Before you sign, ask where the acquirer stands in VAMP; a provider that will not answer is telling you something.
What is excluded from the VAMP count?
Disputes resolved through pre-dispute tools (Rapid Dispute Resolution, CDRN-type alerts) and TC40 fraud that qualifies under Compelling Evidence 3.0, both subject to the timing of Visa's data extract, which in practice means resolve it in the same month it is raised. Authorizations you void before capture never generate a TC40. Refunds after the fact and dispute wins do not help.
What are the fees if we are Excessive?
Visa does not publish the amounts in its public fact sheet; they are assessed to the acquirer per counted event and passed through under your agreement. Several processors publish the per-event figures they pass on. The fee is rarely the real cost: the acquirer's own risk team acts on the same number, with reserves, caps and, if it persists, termination.
How do VAMP and Mastercard's ECM compare?
Mastercard's Excessive Chargeback Merchant program counts chargebacks only (not fraud reports) against the previous month's transactions, starting at 100 chargebacks and 1.5%, with fines that escalate by month. VAMP uses the same month, adds fraud reports, and has the 1,500-event minimum. A merchant can be fine on one and identified on the other, and the two need separate monitoring.
How is Milestone paid for this?
By the acquirer or PSP you end up using, as a commission on volume. No fee to you for a review of your VAMP exposure. We place with whichever of ~30 providers underwrites your vertical knowingly and has the standing to carry it, so we have no reason to push one.
Account terminated
The first 72 hours, and what to put in front of a new acquirer.
Rolling reserve
What the reserve the acquirer raises after a VAMP month actually locks.
True-cost calculator
Approval rate vs fee rate: the denominator side of the ratio.
Send us last month's numbers.
Settled Visa CNP transactions, TC40 and TC15 counts per descriptor, and who your acquirer is. We tell you within one business day where you stand, what moves the ratio, and whether the portfolio you sit in is the problem. No fee for the review.