High-Risk Merchant Category Codes (MCCs) and Their Risks

What are Merchant Category Codes?

A Merchant Category Code (MCC) is a four-digit number used to categorize merchants based on the merchant’s business activities and products or services being sold. 

Subject to credit card association guidelines, MCCs are assigned to each merchant account by the bank when the merchant account is established. A single merchant may have multiple MCCs assigned that vary depending on the different products, services, or departments the company sells. Likewise, some companies may have their own dedicated MCC, like airlines, rental cars, and hotels.

MCCs are fairly standard across the Visa and MasterCard card networks.

These assigned MCCs are then used to classify the nature of the business and may be used:

• By payment processors to determine the processing and interchange fees for transactions
• By issuers to determine credit card rewards categories for consumers to receive cash back or points
• For tax purposes 

As well as several other more use-case-based reasons. 

High-Risk Merchant Category Codes

The credit card associations have also established rules and regulations defining the use of particular MCC categories for risk monitoring purposes. In some instances, merchants are required to pre-register their business if it operates in specific high-risk MCC categories.

These high-risk merchant category codes are assigned to industries that predominantly:

• generate the highest levels of cardholder disputes, 
• represent higher levels of financial risk to the banks, or
• create additional brand risk for regulatory reasons.

Additionally, card association registration may also be required for certain MCCs when the merchant is operating in a card-not-present (CNP) environment within that MCC, for example, with online tobacco sales as compared to retail tobacco sales.

Regulation for High-Risk Merchant Category Codes

Through April 30, 2023, the Visa Global Brand Protection Program (GBPP) was Visa’s compliance program addressing the reputational risk and potential brand damage for acquiring merchants in high-risk verticals. Beginning on May 1, 2023, the Visa Integrity Risk Program (VIRP) replaced this program.

According to the Visa Integrity Risk Program Guide, “VIRP ensures that Acquirers, and their designated agents, maintain proper controls and oversight processes to deter illegal transactions from entering the Visa Payment System.”

Three major changes distinguish VIRP from GBPP:

1. High-risk merchants now fall under three tier levels
2. Updated, modernized language for high-risk merchants
3. Categories for Visa control assessments
   
   

The Three Tiers of High-Risk Merchant Category Codes

Prior to May 1, 2023, MCCs were either designated as high risk, and requiring additional risk protection, or not high risk. With the VIRP update, high-risk MCC codes now fall into three tiers: tiers 1, 2, or 3.

Tier 1 industries include, but may not be limited to:

According to the Visa Integrity Risk Program guide, “Tier 1” high integrity risk merchants have a higher risk of illegal activity occurring if the proper controls aren’t in place, and any potential illegal activity that occurs could cause significant harm to the health and safety of individuals. Tier 1 is the most regulated tier for these reasons.

Tier 2 industries include, but may not be limited to:

According to the Visa Integrity Risk Program guide, “Tier 2” high integrity risk merchants operate businesses where there is a higher risk of illegal activity occurring without the proper controls and that activity could cause financial or economic harm to individuals.

Tier 3 industries include, but may not be limited to:

According to the Visa Integrity Risk Program guide, “Tier 3” high integrity risk merchants operate businesses outside of Tiers 1 and 2, but have a higher risk for non-compliance with applicable regulations without appropriate controls.

New Language for High-Risk Merchants through the VIRP

Before the VIRP rolled out, “High-Brand Risk Merchants” (colloquially known as high-risk merchants) were classified as merchants that posed a high level of brand risk when processing card-not-present transactions.

Now, Visa has changed the designation to mean that the merchants operate in business types that are legal, but that, without the proper controls, could process transactions for activities that may be illegal. The classification into tiers now better breaks out business types and the levels of risk they pose to the payments ecosystem.

High Integrity Risk Merchant Acquirers Are Subject to Visa Control Assessments

New Tier 1 and Tier 2 merchant acquirers must undergo a Visa control assessment by a Visa designee who evaluates the business type and the types of merchants they intend to acquire.

According to Visa’s new guidelines, if an acquirer was previously registered under the GBPP and processed payments for merchants within VIRP merchant categories as far back as one year prior, they can continue to acquire for those types of merchants. However, these acquirers will also be subjected to a periodic control assessment based on merchant category type.

The Old Standard for High-Risk MCCs

Through April 30 2023, Visa classified high-risk merchants into two categories: high-risk for all card-absent transactions and high-risk for certain card-absent transactions.

MCC codes considered high risk for all Card-Absent Transactions were:

MCC codes considered high risk for certain Card-Absent Transactions:

On May 1, 2023, Visa introduced the Visa Integrity Risk Program (VIRP), which included updated requirements for acquirers and their designated agents to support High-Integrity Risk merchants, replacing Visa's Global Brand Protection Program. Therefore, these standards are no longer in effect and should no longer be followed.

How Can a High-Risk Merchant Comply with these New Standards?

There are a number of things merchants designated with MCCs that fall under these new VIRP tiers can do to comply and reduce their risks, including:

• Ensure processes, including refund and cancellation rules, are clearly communicated and executed to reduce chargebacks
• Protect cardholder information by employing a tokenization strategy that keeps all cardholder data safely stored in a secure third party vault
• Create and maintain a multi-PSP strategy, gaining more control over costs, customer information, and solution innovation

While a PSP that specializes in servicing high-risk merchants is a must early on, their elevated cost structure is unlikely to make them the ideal long-term partner. For this reason, it is important for the merchant to also partner with a tokenization service provider like Basis Theory, so that they can switch between PSPs while maintaining access to their existing customers’ cardholder data.