Visa VAMP & Mastercard BRAM: the 2026 card-brand monitoring rules

Why these thresholds decide whether you stay live

For a high-risk merchant, the card-brand monitoring programs are the rules that matter most, because crossing their thresholds is the single most common way a working account gets terminated. Visa and Mastercard each run programs that track how many of your transactions turn into fraud reports or disputes, and in 2026 those programs are stricter than they were a year ago. Understanding exactly where the lines sit, and how the ratios are calculated, is the difference between managing your dispute rate deliberately and finding out the hard way.

The numbers below are drawn from Visa's published VAMP program overview and from acquirer-published Mastercard program guidance. Where a figure rests on a primary Visa document we say so; where it rests on acquirer or industry sources because the underlying network bulletin isn't public, we flag that, and the caveat at the end of this page applies throughout.

Visa VAMP: the 2026 thresholds

VAMP, the Visa Acquirer Monitoring Program, consolidated Visa's older fraud and dispute monitoring programs into one framework. The piece that matters to you as a merchant is the VAMP ratio and the single merchant-level tier built on it. The ratio is count-based, not dollar-based:

VAMP ratio = (count of fraud reports [TC40] + count of disputes [TC15]) ÷ count of settled Visa card-not-present transactions [TC05]

A detail worth holding onto: because a single fraud chargeback generates both a TC40 fraud report and a TC15 dispute record, it can contribute to both counts in the numerator. Visa's published formula lists the two counts separately and includes no deduplication clause, so the conservative and best-supported reading is that a fraud dispute affects both. The calculator below uses that conservative reading.

There is only one merchant-level tier, Excessive Merchant. For a US merchant, both of these conditions must be met:

Both conditions are required. Below the 1,500-item monthly floor, a merchant is not identified under VAMP regardless of how high the ratio runs, though your acquirer's own internal limits are typically stricter than Visa's, so the floor is not a safe place to operate. On enforcement, industry and acquirer sources put the Excessive Merchant fee at $8 per fraudulent or disputed transaction; that figure is not in Visa's public fact sheet, so treat it as strong industry consensus rather than a primary fact and check your acquirer's schedule.

Estimate your VAMP ratio

The calculator takes one calendar month of your Visa card-not-present activity, your fraud reports, your disputes (including fraud-reason chargebacks), and your settled transaction count, and returns your ratio plus where it sits relative to the 1.50% Excessive line and the 1,500-item floor. It's a planning tool, not a compliance verdict; your acquirer's reporting is what governs.

Mastercard: ECM and BRAM in 2026

Mastercard runs two things high-risk merchants need to watch: the Excessive Chargeback Program, which tracks your chargeback ratio, and BRAM, which monitors content and brand risk. The Excessive Chargeback Program (ECM) uses a chargeback-to-transaction ratio (CTR) with a wrinkle competitors often get wrong, the denominator is the preceding month's sales, not the current month's. The thresholds:

Assessments don't start the first month over threshold, they begin in the second month and escalate the longer you stay above the line, alongside an issuer-recovery assessment per chargeback above 300 from month four. The exit is mechanical: fall below the ECM thresholds for three consecutive months and your status resets.

BRAM, Mastercard's brand risk and abuse monitoring program, is the content-and-conduct side. Effective January 1, 2026, merchants onboarded on or after that date require a mandatory content scan before their first transaction, and the monitoring must cover the full website, including password-protected, gated, or member-only areas where products or services are offered. The program spans brand-damaging or illegal content, transaction laundering, and MCC-miscoding monitoring. If you operate a gated or members-only model, “behind the login” is no longer out of scope.

How to stay under the lines

The thresholds make the strategy obvious: manage disputes before they accumulate, because both networks are counting, and exceeding their lines is what ends accounts. In practice that means stopping fraud before it settles, velocity checks, device and behavioral signals, and risk scoring tuned to your vertical, and defending the disputes that do come through with timely representment. It also means keeping your MCC honest and your site clean of anything that draws a BRAM flag, gated areas included.

This is exactly why fraud prevention and dispute defense sit at the center of good high-risk processing rather than off to the side. At GivePayments, every transaction runs through AI risk scoring, and dispute tooling handles alerts and representment to keep merchants under the VAMP and ECM thresholds. The mechanics are covered in the high-risk merchant accounts overview and the complete processing guide.

Sources and caveat

The Visa thresholds and formula above are taken from Visa's published VAMP program overview. The Mastercard ECM and BRAM figures come from acquirer-published program guidance and Mastercard-approved monitoring providers, corroborated across multiple 2026 sources, because the underlying Mastercard bulletins are not public.

Threshold and formula figures are taken from Visa's published VAMP program overview (read June 2026). Per-item fee amounts ($8) and Mastercard ECM/HECM figures are based on acquirer and industry program guides, as the underlying network bulletins are not public; your acquirer's schedule governs. Visa's published formula counts fraud reports (TC40) and disputes (TC15) separately, so a fraud chargeback can affect both counts, some industry sources describe this differently; we use the conservative reading. This tool is informational, not compliance advice. Last reviewed: 2026-06-10.