High-Risk Payment Processors

A business will be classified as “high-risk” based on a combination of industry factors, financial health, transaction history, and exposure to fraud or chargebacks. In some instances, a merchant is required to pre-register if it operates in specific, high-risk MCC categories. 

Specific MCC codes are assigned to high-risk industries that predominantly generate higher levels of cardholder disputes or represent higher financial or regulatory risk to banks. Other regulations may apply when a merchant operates in a card-not-present (CNP) environment—for example, with online sales compared to retail sales. 

For those who are considered a high-risk merchant, despite the payment process remaining mechanically consistent, the rules and regulations that govern high-risk payment processing are complex. As a result, the service providers specializing in serving these businesses have higher operating costs and, therefore, generally charge higher fees for high-risk payment processing. 

What are the guidelines for designating a business as high-risk?

Several factors influence decisions when regulatory bodies review data to determine if a business represents higher risk. 

Risk Type

Merchant acquirers and payment service providers (PSPs) use a combination of automated tools and manual reviews to assess various risk types that impact merchants.

PSPs may also request additional documentation or conduct on-site visits to verify information and assess the merchant's operations. Through thorough risk assessments, PSPs can protect themselves and their customers from financial losses, legal liabilities, and reputational damage.

Merchant acquirers and PSPs will assess risk a bit differently by bucketing the risk into types, including:

• Content / Business Risks: PSPs assess the nature of the merchant's products or services to identify potential legal, regulatory, or ethical concerns. They review the merchant's website, marketing materials, and customer reviews to ensure compliance with industry standards and identify potential red flags, such as misleading claims, false advertising, or inappropriate content.
• Financial Risks: PSPs evaluate merchants' financial stability and creditworthiness to assess their ability to fulfill financial obligations and manage chargebacks. They review the merchants' financial statements, credit history, and business model to determine their financial strength and risk of insolvency.
• Reputational Risks: PSPs assess the merchant's reputation and public perception to identify any potential negative associations that could damage the PSP's reputation. They analyze online reviews, social media sentiment, and industry news to identify any negative publicity, customer complaints, or regulatory actions against the merchant.
• Money Laundering Risks: PSPs implement anti-money laundering (AML) procedures to prevent criminals from using their platform to launder illicit funds. They verify the merchant's identity, beneficial ownership, and business activities to ensure compliance with AML regulations. They also monitor transaction patterns for suspicious activity, such as large cash transactions, unusual transaction volumes, or transactions from high-risk jurisdictions.
• Transaction Laundering Risks: PSPs assess the merchant's risk of transaction laundering, where criminals use legitimate merchant accounts to process payments for illegal activities. They review the merchant's website, products, and transaction history to identify any discrepancies or inconsistencies that could indicate transaction laundering. They also monitor for unusual transaction patterns, such as spikes in transaction volume or transactions from unrelated industries.

Return to Top

Business and Sales Model

The merchants’ business and sales model can also designate whether a business operates at high or low risk. When operating in a high-risk industry with higher risks for chargebacks, customer disputes, or fraud, PSPs and acquiring banks may be apprehensive about doing business.

Recurring billing, subscriptions, and free trials are risk factors found in business models that may elevate a company’s risk.

A breakdown of the risk factors into which issues may arise include:

Visa and Mastercard Standards

The card networks (Visa, Mastercard) also determine which companies are of higher risk. Each brand has its own set of rules for high-risk industries. 

Visa Integrity Risk Program (VIRP)

Through April 30, 2023, the Visa Global Brand Protection Program (GBPP) was Visa’s compliance program addressing the reputational risk and potential brand damage for acquiring merchants in high-risk industries and verticals. 

Three major changes distinguish VIRP from GBPP:

1. High-risk merchants fall under three tier levels.
2. Updated, modernized language for high- risk merchants.  
3. Categories for Visa control assessments. 

The Mastercard Business Risk Assessment and Mitigation (BRAM)

BRAM differs from VIRP in that it focuses more on finding and addressing non-compliance with the Mastercard rules. When a merchant is found to be out of compliance with the standards, acquirers are required to add the merchant to the Mastercard Alert to Control High Risk Merchants (MATCH) database. 

Should a merchant be found on the MATCH list, any acquirer must decide if it would like to do business with the merchant—but is not discouraged from doing so. 

A merchant can be removed from the MATCH list if the merchant was added in error or has since become compliant. After 5 years, regardless of reason, a merchant is automatically removed from the MATCH program, but could be re-added if found in non-compliance again.

Who are some reliable high-risk payment processors?

While payment service providers (PSPs) come and go, there are a number that specialize in high-risk services whose reputations have been built and sustained over time. These include:

• PaymentCloud is broadly considered a leader in the space, with a reputation for excellent customer service and very few publicly aired complaints. While they do not advertise their pricing (preferring to tailor it to their customers), the price has not prevented them from establishing their leadership position.
• Soar Payments is an option for US-based companies in medium-risk businesses. They provide automated pricing quotes on their site and don’t support merchants in the highest-risk businesses, relieving potential customers of concerns about reputational association.
• Durango offers services to businesses in the highest-risk categories and is well-regarded for the processes that allow it and its customers to thrive in segments that the overall payment ecosystem is not hugely welcoming to.

Of course, many others specialize in the various subsets of the high-risk marketplace. As previously noted, merchants setting up a business relationship with high-risk payment processors need to carefully examine the services offered and the fees charged, as these can be higher than those of lower-risk providers.

Return to Top

What are high-risk merchant accounts?

A high-risk merchant account is a specialized bank account for businesses that have received a higher-risk designation due to elevated chargeback rates, regulatory scrutiny, or the nature of their business activities. 

Without high-risk merchant accounts, many high-risk businesses would struggle to accept credit card payments and would be unable to operate effectively. 

Key characteristics of a high-risk merchant account are:

1. Higher processing fees due to the increased risk compared to standard merchant accounts.
2. Rolling reserves to mitigate potential losses. This is a portion of the business’s income held in reserve for a set period of time to cover any potential disputes or chargebacks that occur.
3. Extensive scrutiny when assessing documentation and the business’s financial stability and risk profile.

High-risk payment processors are specialized to handle these unique needs, such as recurring billing for subscription services or enhanced fraud protection. 

Return to Top

Is High-Risk a blanket designation? 

The answer used to be yes. Until the end of April 2023, there was effectively only one high-risk designation that covered a broad swath of businesses. After May 1, 2023, however, Visa introduced a new program called the Visa Integrity Risk Program (VIRP), which splits risks into three categories:

• “Tier 1” high integrity risk merchants have a higher risk of illegal activity occurring if the proper controls aren’t in place, and any potential illegal activity that occurs could cause significant harm to the health and safety of individuals. For these reasons, Tier 1 is the most regulated tier.
• “Tier 2” high integrity risk merchants operate businesses where there is a higher risk of illegal activity occurring without the proper controls, and that activity could cause financial or economic harm to individuals.
• “Tier 3” high integrity risk merchants operate businesses outside of Tiers 1 and 2, but are at a higher risk of non-compliance with applicable regulations without appropriate controls.

Sadly, plenty of merchants are forced into using high-risk online payment processors owing to challenges in their business, including excessive chargebacks, data breaches, and even lower credit ratings. The MATCH program is of particular note, as being included on this list can limit a merchant’s ability to sign up with new processors. 

Stripe, for instance, notes that “Due to banking partner restrictions, Stripe generally cannot process for businesses listed on MATCH.” 

There are other quantitative reasons for being placed on MATCH:

There are also a small number of qualitative MATCH listing reasons: 

Obviously, any organization actively pursuing business that is listed as high-risk is likely going to have to work with a high-risk payment provider. Others, though, can avoid being caught up in the MATCH process—or otherwise attracting the ire of the payments ecosystem writ large—by jealously guarding access to any and all consumer data. This will ensure that only legitimate transactions are completed (keeping chargeback numbers down) and protect all consumer data in motion and at rest (eliminating penalties for data leaks).

A great way to start is to engage a third-party tokenization provider such as Basis Theory, which can protect consumer data and reduce data leak risks by removing the need for the merchant ever to process or store PII in plain text. In addition, working with a tokenization provider allows the merchant to automate their payment system and use intelligent decisions to choose which PSP to direct transactions to, providing a system to control and limit chargebacks.

In the end, while high-risk payment processors provide a crucial set of services, avoiding being forced to use them is a merchant's strongest move. Consider a multi-gateway approach to reduce the risk. 

Return to Top