High-risk merchant category codes (MCCs): what Visa’s current manual and rules say

What a merchant category code is

Visa’s Merchant Data Standards Manual describes the merchant category code, or MCC, as a four-digit number assigned to describe a merchant’s primary business based on annual sales volume. Some codes identify a specific merchant, such as an airline or a hotel group, or a type of transaction rather than a type of shop.

The manual says Visa and its member banks use the code for activity tracking, reporting and risk management. The card-issuing bank uses it too: Visa’s rules (section 4.1.19.1) cover issuers that let cardholders limit their card by transaction type or merchant category code, and require a specific decline response when a payment is declined because of such a block.

Who assigns the code, and how

The acquirer, the bank that holds the merchant’s card-acceptance account, assigns the code. Visa’s rules (section 1.5.1.11) say an acquirer must assign the code that most accurately describes the merchant outlet’s business, unless the law requires otherwise. The manual adds that acquirers and their agents must assign the correct code and that Visa retains the right to require corrections. A payment facilitator must evaluate the business of every merchant it signs up and assign the most appropriate code itself.

• Choose the code that most accurately describes the business; where a merchant has more than one line of business, either use the code for the line with the highest sales volume for all sales, or use a different code for each line.
• Use a miscellaneous code, usually ending in 99, only when no specific code applies.
• Each e-commerce website is a merchant location in itself; where one merchant runs several websites selling distinct goods or services, each website gets the code that fits what it sells.
• Where one of several lines of business at the same location is high integrity risk, it must carry its own high integrity risk code, separate from the other lines (manual, mandatory multiple codes; rules section 1.5.1.11).

Card networks other than Visa publish their own code lists, and the titles can differ. This guide quotes Visa’s documents only; ask your provider which network documents it applies.

The codes Visa treats as high integrity risk

Visa does not use the phrase high-risk MCC in its manual. It names high integrity risk codes, and its rules call a merchant that must use one of them a High-Integrity Risk Merchant (section 10.4.5.1). The manual’s current list is below.

Scroll the table to see all columns.

The codes people search for most

Which code applies to a particular business is the acquirer’s decision under these rules, based on what the business actually sells and how. This guide does not suggest a code for any business.

What Visa’s rules require once a high integrity risk code applies

Most of the duties fall on the acquirer, which is why they show up in a merchant’s application, pricing and payout terms.

• Registration: before submitting transactions from a High-Integrity Risk Merchant, the acquirer must apply to Visa and be approved, pass a financial review, and register each such merchant with Visa (section 1.9.5.1). The rules exempt merchants on 5122 or 5912 that are accredited by the National Association of Boards of Pharmacy or another regulatory body Visa recognises.
• Daily monitoring: the acquirer must keep daily data on sales volume, average transaction amount, number of receipts and number of disputes, build a normal daily profile from at least the first month, and compare activity against it at least daily from the 31st day after the first deposit (section 10.4.5.2).
• Extra controls: Visa may impose security or authentication requirements on a High-Integrity Risk Merchant (section 10.4.5.3).
• Disqualification: Visa may disqualify such a merchant that meets a critical level of disputes, acts with intent to circumvent Visa programmes, or causes harm to the Visa system (section 10.4.5.4).
• Charges to the acquirer: USD 2,000 per unregistered High-Integrity Risk Merchant per month of non-compliance (section 12.5.5.1), and USD 25,000 per merchant per month where merchant data was altered to get around Visa’s integrity risk programme or its acquirer monitoring programme (section 12.5.3.2).
• Terminated Merchant File: an acquirer that terminates a merchant identified by Visa Integrity Risk Program reports must add it to the file, as with other listed reasons (section 10.10.1.1).

Because a wrong code is a data problem the rules treat seriously, an accurate description of the business in the application protects the merchant as well as the acquirer.

What to ask a provider about category codes

• Which category code it expects to assign, and on what description of your business.
• Whether any line of business or website will need its own code.
• Whether the acquirer behind the offer is set up to accept merchants in that category, since registration with Visa comes first.
• Which monitoring, reserve or authentication terms come with that category, and where they appear in the written offer.

Zolution is a free marketplace (Zolution Standard membership costs nothing) where a merchant publishes one request and compares offers from payment providers whose declared coverage includes the merchant’s industry. The terms in an offer are provider-declared, and the provider decides on approval and on the category code it assigns.

Questions, answered