The Visa Acquirer Monitoring Program (VAMP) is Visa's monthly check on fraud reports, disputes, and enumeration (card testing) at the acquirer and at the merchant. You do not enroll. The published metric is a count-based VAMP ratio: fraud reports (TC40) plus disputes (TC15), divided by settled transactions (TC05), on card-not-present VisaNet volume, domestic and cross-border (Visa Acquirer Monitoring Program Overview fact sheet, linked 9 October 2025). An acquirer book is Above Standard at 50 basis points or higher and Excessive at 70 basis points or higher. If that acquirer is not already in those buckets, Visa still identifies an Excessive Merchant. In Asia Pacific, Canada, the EU, and the U.S., that merchant line is 150 basis points or higher as of 1 April 2026, with at least 1,500 fraud-plus-dispute events in the month. One hundred basis points equal 1 percent, so 150 bps is 1.50 percent. You feel it as tighter underwriting, extra reserves or holds, and a faster shutdown of the merchant ID.
What VAMP replaced, and when it started counting
Visa introduced the evolved program on 30 August 2024, effective 1 April 2025. That page said VAMP consolidates five existing fraud and dispute programs and streamlines 38 remediation processes into one (Visa Perspectives, 30 August 2024). A 24 March 2025 update extended the advisory period through 30 September 2025. The 2025 public fact sheet, linked from a 9 October 2025 interview, names the Visa Fraud Monitoring Program and the Visa Dispute Monitoring Program as programs folded with VAMP into one global program, and dates the ratio formula 1 June 2025. The same interview confirmed the advisory window had ended, and that only the Excessive level would begin then. By this article's date, 22 September 2026, that enforcement window has been open for almost a year, and the 1 April 2026 merchant-threshold cut has been in force for nearly six months.
VAMP is an outlier program. Ami Patel, Visa's head of ecosystem engagement and advocacy, said on 9 October 2025 that an identified acquirer is performing five, seven, or ten times the global average, and that most clients are not in the program at all. Visa added an early-warning notice as books approach Above Standard. That notice goes to acquirers. You hear it from the processor or ISO, not from a Visa merchant portal.
The ratio, in one line
Visa's public formula:
VAMP ratio = (count of fraud (TC40) + count of disputes (TC15)) ÷ count of settled transactions (TC05)
It is a count ratio, not a dollar ratio. A $12 fraud report and a $400 dispute each add one to the numerator. The fact sheet limits the core metric to card-not-present VisaNet transactions, domestic and cross-border. A restaurant with an online ordering page is measured on the CNP slice.
Two published exclusions, both "contingent on the timing of the data extract":
- Disputes resolved through pre-dispute solutions
- TC40 fraud that qualified for Compelling Evidence 3.0
A chargeback you already lost still sits in the dispute count unless it was pulled out through one of those exclusions. A TC40 is an issuer fraud report. It can post without a chargeback. Watching only the chargeback fee line on the statement undercounts VAMP.
Count of TC40 fraud reports plus TC15 disputes, divided by TC05 settled card-not-present transactions.
Above Standard at 50 bps or higher. Excessive at 70 bps or higher. Minimum 1,500 fraud-plus-dispute events per month in AP, Canada, the EU, and the U.S.
If the acquirer is not already identified: 150 bps or higher in AP, Canada, the EU, and the U.S. as of 1 April 2026, and at least 1,500 events in the month.
Separate test: enumerated auths at 2,000 bps or higher of all auths, and at least 300,000 enumerated auths (approved plus declined).
The three identification paths
Visa's 9 October 2025 interview listed three ways an acquirer can be identified.
1. The acquirer portfolio. Above Standard at 50 bps or higher. Excessive at 70 bps or higher. Both levels use the same minimum monthly count of fraud plus disputes: 1,500 in AP, Canada, the EU, and the U.S. (Visa fact sheet, linked 9 October 2025). Above Standard requires remediation. Excessive is the more drastic stage.
2. Individual merchants in that portfolio. If the acquirer is not already Above Standard or Excessive, Visa applies Excessive Merchant thresholds. For AP, Canada, the EU, and the U.S. the 2025 fact sheet listed 220 bps or higher, with footnote 5: that line reduced to 150 bps or higher on 1 April 2026. The monthly count floor is 1,500. Other regions use different floors (Latin America and the Caribbean already at 150 bps; CEMEA at 220 bps with a 150-event and USD 75,000 amount floor). Brazil, Chile, and India were listed as later announcements.
3. Enumeration at the merchant. Separate from the VAMP ratio. Visa's 30 August 2024 introduction defined enumeration as a rapid, brute-force card-testing attack at scale, and put annual losses at $1.1 billion (Visa, 30 August 2024, citing VAAI FY23). The fact sheet requires both: an enumeration ratio of 2,000 bps or higher (20 percent of auths, approved plus declined) and 300,000 or more enumerated auths. Most small MIDs never print 300,000 enumerated auths. They can still eat TC40s from the cards that get through. Declines count.
Michael Jabbara, Visa's head of payment ecosystem and risk control, said on 9 October 2025 that acquirers in the program versus acquirers not in it show a 10 percent difference in approved transactions. A dirty book does not only cost dispute fees. It costs sales that never authorize.
Worked example (illustrative)
Numbers below are illustrative. They use Visa's published U.S. merchant line (150 bps and 1,500 events as of 1 April 2026). They are not a quote and not your ratio.
A U.S. e-commerce MID settles 100,000 card-not-present Visa transactions in a month.
| Mix | TC40 + TC15 | Ratio | Count vs 1,500 | Excessive Merchant line? |
|---|---|---|---|---|
| Quiet month | 1,200 events | 1.20% (120 bps) | Below the floor | No. Ratio and count both miss. |
| At both lines | 1,500 events | 1.50% (150 bps) | At the floor | At the published line on both tests. |
| High ratio, low count | 900 events on 40,000 settled | 2.25% (225 bps) | Count 900 | Ratio is high. Count is under 1,500, so Visa's floor does not trip. |
Patel (9 October 2025) said the 1,500 minimum exists so the program focuses on significant issues, not normal fluctuations. That does not bind your acquirer. An acquirer managing its own 50 bps and 70 bps book can still re-underwrite, reserve, or close a MID that is loud relative to the rest of the portfolio.
What you actually feel
VAMP is written to acquirers, registered agents, and merchants (Visa fact sheet, linked 9 October 2025). The acquirer is the bank-side network member that sponsors the MID and is liable to Visa. Identified entities "are required to implement risk mitigation control measures." Visa does not publish a public fee table for those measures. Treat any dollar-per-event "VAMP fine" on a processor blog as that acquirer's program until Visa publishes the number.
The merchant-visible tools are the ones your contract already named:
- Slower or tighter boarding. More documents, a delay, or a "we cannot take this MCC or this delivery model."
- Reserves and settlement holds. Collateral against future disputes and fraud. Ask the trigger in writing.
- Forced controls on the MID. Velocity limits, 3-D Secure on more tickets, blocking high-risk BINs, cutting keyed entry. Those are acquirer controls, not a Visa product you buy.
- MID shutdown. The account the networks know you by goes dark. A new MID is a new underwrite, not a rinse.
- MATCH. If the acquirer terminates you for fraud or excessive disputes, other acquirers can find that termination. Read MATCH before you assume a new application is a clean start.
Ask, in writing, what your VAMP ratio is, how many events are TC40 versus TC15, whether the acquirer portfolio (not only your MID) is in early warning, Above Standard, or Excessive, and what the contract lets them do when a ratio moves. Patel's 9 October 2025 advice to merchants was that conversation: only the acquirer can tell you what its book implies for your program.
What actually moves the number
You cannot negotiate Visa's thresholds. You can change the inputs.
Stop the fraud that becomes TC40. Address-verification and CVV mismatches, velocity, and a gateway that lets bots enumerate will print TC40s even when you refund the sale.
Stop disputes that become TC15. Clear descriptors, delivery proof, a refund that actually batches, and a response to the chargeback notice on the acquirer's calendar. A sale you already refunded and then also lose as a dispute is one more hit on the ratio.
Use the exclusions Visa published. Pre-dispute tools and Compelling Evidence 3.0 can drop events from the extract, contingent on timing. Ask whether those are on and whether your file qualifies. They are a data-extract rule, not a coupon.
Do not ignore declines. Enumeration counts approved and declined auths. A week of 10,000 one-dollar auths that all decline is still enumeration traffic.
None of this is a promise that your ratio will clear 150 bps. It is the work the program is designed to force.
FAQ
What is the Visa Acquirer Monitoring Program (VAMP)? VAMP is Visa's monthly program that identifies acquirers and merchants whose card-not-present fraud reports, disputes, and enumeration exceed published thresholds. You do not enroll. The acquirer has to remediate, and you feel that as tighter underwriting, reserves, or a MID shutdown.
How is the VAMP ratio calculated? Visa's 2025 fact sheet defines it as the count of TC40 fraud reports plus TC15 disputes, divided by the count of TC05 settled transactions, on card-not-present VisaNet volume. It is a count ratio, not a dollar ratio. Pre-dispute resolutions and Compelling Evidence 3.0 TC40s can be excluded, depending on extract timing.
What is the VAMP merchant threshold in 2026? For Asia Pacific, Canada, the EU, and the U.S., the Excessive Merchant VAMP ratio is 150 basis points or higher as of 1 April 2026, with at least 1,500 fraud-plus-dispute events in the month. That line was 220 basis points on the 2025 fact sheet. Acquirer Above Standard is 50 bps. Excessive is 70 bps.
Does VAMP apply to card-present transactions? The published VAMP ratio is built on card-not-present VisaNet transactions, domestic and cross-border. Card-present sales are not what that formula describes. A mixed MID is still measured on its CNP slice, and the acquirer can still act on the whole account.
What is a TC40 fraud report? A TC40 is the issuer's fraud report to Visa. It can post without a chargeback. VAMP's numerator counts TC40s and TC15 disputes together. If you only watch chargeback fees on the statement, you undercount the ratio.
Can VAMP close my merchant account? Visa identifies the acquirer and the merchant and requires risk-mitigation controls. The acquirer is the party that can reserve, restrict, or terminate the MID. A termination for fraud or excessive disputes is how other acquirers later find you on MATCH.
Sources
Questions about how this applies to your business?
Talk it through