Visa’s acquirer monitoring programme (VAMP): the ratio, the thresholds and the dates

What VAMP is

The Visa Acquirer Monitoring Program, VAMP, is how Visa checks each month whether an acquirer, the bank that holds a merchant’s card-acceptance account, or one of its merchants has too much fraud or too many disputes. Visa’s fact sheet says that each month Visa monitors fraud, dispute and enumeration levels, identifies acquirers or merchants that exceed the monthly thresholds, and requires those identified to put risk-mitigation controls in place.

Visa announced the current programme on 30 August 2024. It says the new VAMP consolidates five earlier fraud and dispute programmes into one acquirer programme and replaces 38 separate remediation processes with a single process. The fact sheet describes the same change as bringing the earlier VAMP, the Visa Fraud Monitoring Program and the Visa Dispute Monitoring Program together into one global programme.

VAMP is aimed at the acquirer first. Visa’s rules (section 10.4.3.1, edition of 18 April 2026) say Visa identifies an acquirer under VAMP as specified in the Visa Acquirer Monitoring Program Guide, may require the acquirer or its merchant to deploy remediation tools, and may evaluate the acquirer’s payment facilitators and merchants individually. For a merchant, that usually means the programme reaches you through your acquirer or payment provider.

The VAMP ratio

The fact sheet sets one count-based ratio, effective 1 June 2025, covering card-not-present Visa transactions, both domestic and cross-border:

The fact sheet lists two exclusions, each depending on the timing of Visa’s data extract: disputes resolved through pre-dispute solutions, and fraud reports that qualify for Compelling Evidence 3.0. Because it is a count of events, a small sale and a large one weigh the same.

The thresholds

Thresholds apply first to the acquirer’s whole portfolio. According to the fact sheet, a portfolio is Above Standard at a VAMP ratio of 50 basis points or more and Excessive at 70 basis points or more, and both levels need a minimum monthly count of fraud and disputes: 1,500 in the US, Canada, Europe and Asia Pacific, or 150 with an amount of USD 75,000 in Central and Eastern Europe, Middle East and Africa. If the acquirer is neither, the Excessive Merchant thresholds below apply.

Scroll the table to see all columns.

The fact sheet says programmes for Brazil, Chile and India will be announced later. It also sets two enumeration measures that acquirers must take steps to keep merchants from exceeding: an enumeration ratio, enumerated authorisations divided by all authorisations (approved and declined), of 2,000 basis points (20%), and a count of 300,000 enumerated transactions. Enumeration is Visa’s term for rapid, automated card-testing attacks.

A worked example

Two hypothetical US merchants in the same month, both with acquirers that are not themselves Above Standard or Excessive. The arithmetic follows the fact sheet’s formula; the figures are invented for illustration.

Scroll the table to see all columns.

The count minimum decides only whether a merchant meets these published merchant thresholds. Merchant B’s fraud reports and disputes still count in its acquirer’s portfolio ratio, and its merchant agreement may set limits of its own.

The dates

• 30 August 2024: Visa announces the new VAMP.
• 24 March 2025: Visa says VAMP becomes effective on 1 April 2025 and extends the advisory period to six months, from 1 April to 30 September 2025.
• 1 June 2025: the fact sheet’s updated thresholds and VAMP ratio take effect.
• 30 September 2025: the advisory period ends, according to both Visa documents.
• 12 March 2026: Visa reports early results, saying nearly half of the acquirers identified improved their performance within a single quarter.
• 1 April 2026: the Excessive Merchant threshold for the US, Canada, Europe and Asia Pacific falls from 220 to 150 basis points.
• 18 April 2026: the current public edition of Visa’s rules, which this guide quotes.

What Visa’s rules say can follow

Visa’s public rules (edition of 18 April 2026) connect VAMP to several other obligations. They describe what Visa’s rules permit; they do not predict what any acquirer will do with a particular merchant.

• Controls: Visa may require the acquirer or its merchant to deploy remediation tools or technologies to address activity VAMP identifies (section 10.4.3.1).
• Termination file: an acquirer that terminates a merchant must add it to the Terminated Merchant File where, among other listed reasons, the merchant was identified by VAMP reports, and must keep all VAMP reports relating to the merchant in its file (section 10.10.1.1).
• Altered merchant records: if Visa finds that a merchant’s name, data or performance was changed to get around VAMP, it may impose a non-compliance assessment of USD 25,000 per merchant per month on the acquirer, or permanently disqualify the merchant and its principals (section 12.5.3.2).
• Disqualification: Visa may disqualify a high-integrity-risk payment facilitator or sponsored merchant in accordance with VAMP (section 10.4.6.2), and lists non-compliance with VAMP requirements among the reasons it may permanently prohibit a merchant from the Visa system (section 1.9.1.4).
• Cross-border sponsored merchants: a payment facilitator may contract with a sponsored merchant outside its own country only if, among other conditions, the acquirer, the payment facilitator and the sponsored merchant are not identified in any Visa risk programme, VAMP among them, and have had no excessive risk programme violations in the three years before the agreement (section 1.5.1.1).

The fees Visa charges acquirers under the programme are not stated in the fact sheet or in section 10.4.3.1 of the public rules; they sit in Visa’s programme guide. If your provider passes VAMP costs on, the amounts should be in your merchant agreement: ask for them in writing.

What to ask a provider about VAMP

• Which Visa region your account sits in, and so which thresholds apply.
• Whether the provider reports your monthly VAMP ratio to you, and how often.
• What the agreement says happens if you, or the provider’s portfolio, are identified: controls, reserves, fees or termination.
• Which dispute and fraud-alert tools the provider supports, and what each costs.
• The chargeback fee and alert fee per event, which Zolution’s full proposal terms show as separate rows so offers can be compared side by side.

Questions, answered