How Products and Billing Models Affect Risk
The product and its legality affect underwriting alongside billing, delivery time, and marketing claims. A legal product can still fall within a card scheme’s higher-risk category; subscriptions or advance payments can add further risk.
Subscription billing produces disputes because customers forget, cannot find the cancellation route, or do not recognise the descriptor. Advance payment produces disputes because the customer is exposed for the whole period between paying and receiving, which is why travel operators are high-risk despite low fraud. Health and income claims produce disputes and regulatory attention together, which is the combination acquirers like least.
Each Vertical Is Priced for Its Own Trigger
| Vertical | Primary trigger | Typical rate | Reserve |
|---|---|---|---|
| Nutraceuticals and supplements | Subscription billing plus health claims | 4–8% | 10% for 180 days |
| CBD and hemp-derived | Legal-status conflict across markets | 3.95–8% | 10% for 180 days |
| Travel and ticketing | Delivery lag of weeks to months | 3–6% | 5–10% for 180 days |
| Coaching, courses, and info-products | Income claims plus digital delivery | 3.5–7% | 5–10% for 180 days |
| Subscription boxes | Automatic renewal | 2.9–5% | 5% for 90–180 days |
Ranges are indicative across the partner network as of , and move with processing history and market mix.
The consumer-protection layer over subscription billing moves independently of the card schemes, so a merchant can satisfy one and still be exposed under the other. In the United States the Eighth Circuit vacated the Federal Trade Commission’s 2024 “click-to-cancel” amendments to its Negative Option Rule on , and the FTC restored the earlier rule text in February 2026, but the Restore Online Shoppers’ Confidence Act still requires anyone selling online through a negative option feature to disclose the material terms before taking billing details, obtain express informed consent, and provide a simple way to stop recurring charges. The FTC opened a new rulemaking on negative option marketing in March 2026.[6]
The Controls That Actually Move the Ratio
Dispute ratios in these verticals respond to unglamorous operational changes far more than to fraud tooling.
The descriptor. A billing descriptor naming the recognisable brand plus a working support number prevents the disputes that begin with a customer not recognising a line on a statement. It costs nothing and is the highest-return change available.
Cancellation that works. A cancellation route as easy as the signup route removes the disputes that are really cancellation attempts. Merchants who make cancellation hard convert a refund into a chargeback, which costs more and counts against the ratio.
Pre-billing notice. An email before each renewal converts surprise into an expected charge.
Authentication. Where strong customer authentication is required, a payee or its payment service provider that does not accept it must compensate the payer’s payment service provider under PSD2 Article 74(2) and UK Payment Services Regulations 2017 regulation 77(6).[5] Over-applying exemptions to protect conversion moves liability back precisely on the transactions most likely to be disputed.
Scheme thresholds leave little room: Visa’s merchant Excessive line is 1.5% from in the AP, Canada, EU, and US regions (already 1.5% in LAC; 2.2% in CEMEA),[2] and Mastercard’s Excessive Chargeback Programme flags a merchant once a month’s chargebacks reach both 100 and 1.5% of the previous month’s sales.[3][7] These Visa merchant thresholds apply where the acquirer is neither Above Standard nor Excessive; Visa’s public fact sheet excludes Brazil, Chile, and India; their programmes are announced separately. Monthly floors are 1,500 fraud-and-dispute events, or in CEMEA at least 150 events and USD 75,000.
Two Structural Choices Decide More Than the Rate
Two structural choices decide more than any negotiation. The first is the merchant category code, which the acquirer assigns and which drives pricing, programme membership, and issuer behaviour.[1] For physical products sold on a direct-marketing subscription, such as supplements, the code is 5968, which Visa lists as high integrity risk for certain card-absent transactions and under which Mastercard requires the acquirer to register a negative-option billing merchant before processing its transactions.[1][3] The second is whether product lines with different risk profiles share a single merchant account, because a promotion on one line can pull the whole portfolio toward a threshold. Separate accounts isolate the ratio.
A terminated merchant may be listed in the MATCH system, which acquirers query at onboarding and which retains listings for five years.[4] That converts a solvable pricing problem into a structural one, which is the argument for pre-qualification rather than sequential applications.
How Jagelski & Partners Helps
The assessment starts with the billing model rather than the product, because that is what the acquirer prices. It covers merchant category classification and whether it survives review, descriptor and cancellation design, renewal notice, authentication and exemption strategy, account separation across product lines, and the reserve structure.
Where a merchant is already in a monitoring programme or carries a MATCH listing, the assessment establishes which of three routes is realistic before any application is made: a corrected merchant category code, a restructured entity with clean processing history, or an acquirer that underwrites listed merchants on its own criteria. Acquiring mechanics in general are covered on the high-risk merchant accounts page.
Frequently Asked Questions
The product and its legality, billing model, delivery lag, and marketing claims can all affect classification. Subscriptions with automatic renewal, advance payments, and health or income claims can increase expected disputes. The factors also compound: a supplement sold on subscription with a health claim combines product, billing, and marketing risks.
Because the risk is duration, not dishonesty. A business that charges today and delivers in nine months leaves the acquirer carrying the liability for the whole period, since the cardholder can dispute if the service is never delivered.
The acquirer is pricing the exposure if the merchant stops trading, which is why financial strength and reserve structure matter more here than fraud tooling.
The billing descriptor. Naming the recognisable brand plus a working support number prevents the disputes that begin with a customer not recognising a line on a statement. It costs nothing and has the highest return of any change available.
Second is a cancellation route as easy as the signup route, which converts would-be chargebacks into refunds that do not count against the ratio.
No. The Eighth Circuit vacated the US Federal Trade Commission’s 2024 click-to-cancel amendments to its Negative Option Rule in July 2025, but the Restore Online Shoppers’ Confidence Act still requires clear disclosure, express informed consent, and a simple way to stop recurring charges for online sales with a negative option feature, and the FTC opened a new rulemaking on negative option marketing in March 2026.
Acquirers also apply their own standards regardless of the rule’s status, so a hard-to-cancel subscription remains an underwriting problem as well as a regulatory one.
Plan well under 1.5%. That is Visa’s merchant Excessive threshold from 1 April 2026 in the AP, Canada, EU, and US regions (already 1.5% in LAC; 2.2% in CEMEA); Mastercard’s Excessive Chargeback Programme flags a merchant once a month’s chargebacks reach both 100 and 1.5% of the previous month’s sales. These Visa merchant thresholds apply where the acquirer is neither Above Standard nor Excessive; Visa’s public fact sheet excludes Brazil, Chile, and India; their programmes are announced separately. Monthly floors are 1,500 fraud-and-dispute events, or in CEMEA at least 150 events and USD 75,000.
The acquirer’s own portfolio ratio matters too: an acquirer near its own threshold will decline merchants it would have accepted a quarter earlier.
No, where their risk profiles differ. Separate accounts isolate the dispute ratio, so a promotion on one line cannot pull the whole portfolio toward a monitoring threshold. This is one of the two structural choices that decide more than any rate negotiation, the other being the merchant category code.
Nutraceuticals run 4–8% with a 10% reserve held 180 days; CBD 3.95–8% on similar reserve terms; travel 3–6% with 5–10%; coaching and info-products 3.5–7% with 5–10%; subscription boxes 2.9–5% with 5% held 90 to 180 days.
Ranges are indicative across the partner network as of June 2026 and move with processing history and market mix.
A termination can produce a MATCH listing, which acquirers query at onboarding and which retains listings for five years. That narrows the acquirer set sharply.
The realistic routes are a corrected merchant category code, a restructured entity with clean processing history, or acquirers that underwrite listed merchants on their own criteria. Re-applying to the same panel under a different name is what the schemes are built to detect.
Both, and the balance is a commercial decision. Where strong customer authentication is required, a payee or its payment service provider that does not accept it must compensate the payer’s payment service provider under PSD2 Article 74(2) and UK Payment Services Regulations 2017 regulation 77(6).
Over-applying exemptions to protect conversion moves liability back onto the merchant precisely on the transactions most likely to be disputed, so exemption strategy should follow the dispute data rather than the conversion dashboard alone.
No. Jagelski & Partners is paid by the institution that takes the business, through a referral or revenue-share arrangement, not by a fee billed to the client. The pricing on the merchant agreement is the institutional rate, with no markup and no onboarding fee.
Ready to Fix the Billing Model Before the Acquirer Prices It?
Book an assessment. We check the merchant category classification, descriptor and cancellation design, renewal notice, authentication strategy, account separation across product lines, and the reserve structure, then pre-qualify across the acquiring partners whose criteria fit. No markup on acquiring pricing. No onboarding fee.
References
Show all references
- Visa Inc., Visa Merchant Data Standards Manual (April 2026), section 2 (high-integrity-risk merchant category codes, including 5968 for subscription “negative option” merchants on certain card-absent transactions), usa.visa.com; Visa Core Rules and Visa Product and Service Rules (), section 1.5.1.11 (the acquirer assigns the code that most accurately describes the business), usa.visa.com, accessed .
- Visa Inc., Visa Acquirer Monitoring Programme (VAMP) Fact Sheet (2025): merchant Excessive threshold reduced from 220 to 150 basis points in the AP, Canada, EU and US regions on , LAC at 150 and CEMEA at 220 basis points, for merchants with at least 1,500 fraud and dispute counts a month (CEMEA 150 and USD 75,000); acquirer Above Standard 0.50% and Excessive 0.70%, corporate.visa.com, accessed .
- Mastercard, Security Rules and Procedures—Merchant Edition (), sections 8.3 (Excessive Chargeback Program; thresholds set in Mastercard’s Data Integrity Monitoring Program manual) and 9.1, 9.2.1 and 9.4.10 (acquirer registration of negative-option billing merchants selling physical products under MCC 5968, with an annual fee per merchant), mastercard.com, accessed (archived copy of ).
- Mastercard, Security Rules and Procedures—Merchant Edition (), sections 11.5 and 11.6 (an acquirer lists a merchant it terminates for a listed reason and checks MATCH Pro before boarding a merchant), 11.10 (MATCH Pro keeps merchant records for five years before automatic purge) and 11.14 (reason codes), mastercard.com, accessed (archived copy of ).
- European Union, Commission Delegated Regulation (EU) 2018/389 (regulatory technical standards on strong customer authentication under PSD2), including the exemption regime (the loss allocation where strong customer authentication is not required or not accepted sits in PSD2 itself, Directive (EU) 2015/2366 Article 74(2)), SCA RTS; PSD2 Article 74(2); United Kingdom, Payment Services Regulations 2017, regulation 77(6), legislation.gov.uk, accessed .
- United States Federal Trade Commission, Negative Option Rule: the 2024 amendments (the “click-to-cancel” rule) vacated in Custom Communications, Inc. v. FTC, 142 F.4th 1060 (8th Cir. 2025) on ; the earlier text recodified by 91 FR 6507 (), federalregister.gov; advance notice of proposed rulemaking, 91 FR 12318 (), which also summarises the Restore Online Shoppers’ Confidence Act, 15 U.S.C. 8401–8405, federalregister.gov, accessed .
- PayPal Braintree, Excessive Chargeback Program, an acquirer’s published guidance (Mastercard’s Data Integrity Monitoring Program manual is not public): Excessive Chargeback Merchant at 100–299 chargebacks and 1.50–2.99%, High Excessive at 300 or more and 3.00% or more, both conditions met, on a month’s chargebacks over the prior month’s sales, developer.paypal.com, accessed .