A Merchant Account Is Not a Bank Account
A merchant account is a card-acquiring facility: an arrangement with a licensed acquirer that lets a business accept Visa, Mastercard, and other scheme payments and receive the settled proceeds. A business bank or EMI account holds and moves money. The two are separate products, bought from different institutions, underwritten against different criteria, and lost independently of each other.
The distinction matters commercially because the failure modes are asymmetric. Losing a bank account freezes treasury but leaves revenue collection intact for a few days. Losing an acquirer stops revenue on the same afternoon, and the reserve balance stays with the acquirer for the length of the chargeback tail, typically 180 days. Operators who plan redundancy at the bank layer and single-source their acquiring have protected the wrong side of the stack.
Three terms are sold as synonyms and are not. “High-risk merchant account”, “high-risk payment gateway”, and “high-risk payment processing” name the acquiring relationship, the technical interface that routes an authorisation, and the operational service that sits between them. A gateway cannot underwrite you. Only an acquirer can, and only an acquirer carries the scheme liability if you fail.
Who Actually Decides: The Four Parties
Four parties sit behind every card payment, and knowing which one declined an application determines whether the decline is appealable. An intermediary that says “the bank said no” is usually reporting a decision taken two layers away.
| Party | What it is | What it decides | Can it be appealed? |
|---|---|---|---|
| Card scheme | Visa, Mastercard, and the domestic schemes | Whether the merchant category is permitted at all, and on what registration terms | No. Scheme rules are not negotiated per merchant |
| Acquirer | The licensed institution that holds scheme membership and carries the settlement liability | Whether to underwrite this merchant, at what pricing, with what reserve | Yes, with better documentation or a changed structure |
| PSP or ISO | The commercial layer that packages acquiring, gateway, and support | Which acquirers it will present the file to | Yes, but usually by changing PSP rather than by argument |
| Gateway | The technical interface that routes authorisation messages | Nothing about risk; it executes routing | Not applicable |
The practical consequence is that a decline needs a source before it needs a response. A scheme-level exclusion, for example an unlicensed gambling operator in a regulated market, cannot be documented around at any price. An acquirer-level decline on chargeback history is a documentation and structure problem, and it is frequently solvable. A PSP-level decline often means only that this PSP’s acquiring panel does not cover the vertical, which is the cheapest problem of the three to fix.
Pre-qualification exists because that diagnosis is expensive to run yourself. Every formal application that is declined leaves a record in the acquirer’s file and, for terminated merchants, potentially in the Mastercard MATCH system, which acquirers query at onboarding and which retains listings for five years.[4] A MATCH listing is not a blacklist in the legal sense, but in practice it converts a documentation problem into a structural one.
Merchant Category Codes: The Field That Governs Everything
The MCC is a four-digit classification the acquirer assigns at boarding. It determines interchange, whether the merchant falls into a scheme high-risk programme, whether issuers will authorise the transaction at all, and in several markets whether the payment is legal. It is the single field with the most leverage over the economics of the account, and it is assigned by the acquirer rather than chosen by the merchant.
The codes that carry high-integrity-risk treatment cluster in a short list, and every one of them changes the acquiring panel a business can reach:
- MCC 7995. Betting and gambling, including lottery and casino gaming.
- MCC 6211. Security brokers and dealers, which Visa limits to merchants licensed in every jurisdiction they sell into and which includes licensed foreign exchange trading.
- MCC 6051. Quasi-cash, including crypto on-ramps and foreign-currency purchase.
- MCC 7273. Dating and escort services.
- MCC 5912 and 5122. Pharmacies, and drugs and druggist sundries.
- MCC 5967. Adult content and services in Visa’s listing; Mastercard titles it inbound telemarketing and requires it, or MCC 7841, for card-absent adult content.
- MCC 5966. Outbound telemarketing.
Two reassignment patterns cause real damage. Visa’s code listing places unlicensed foreign exchange trading and binary options under the gambling code 7995 rather than 6211, which changes both the pricing and the set of issuers willing to authorise. A nutraceutical business selling subscriptions by direct marketing belongs under 5968, the continuity and subscription code, which Visa lists as high integrity risk for certain card-absent transactions. Neither reassignment is arbitrary; both follow scheme rules on how the underlying activity must be described. Both are also predictable before boarding, which is the point of assessing the code first.
Miscoding is not a workaround. Presenting a gambling business under a general e-commerce code breaches the scheme rule that the acquirer assign the code that most accurately describes the business,[8] and the consequences run from immediate termination through MATCH listing to scheme fines assessed against the acquirer, who will pass them on. A scheme review that finds the miscoding can trigger remediation, assessments or termination by the acquirer.
Scheme Registration Is Permission, Not a Penalty
Both major schemes run registration programmes for merchant categories they treat as integrity risks. Registration is not a penalty; it is the mechanism by which the category is permitted to operate at all, and an acquirer that boards a registrable merchant without registering it is the party in breach.
Visa operates the Integrity Risk Programme, and its Merchant Data Standards Manual (April 2026) lists 13 high-integrity-risk merchant category codes for all or certain card-absent transactions, across gambling and skill-game wagering, pharmaceuticals, tobacco, crypto, financial trading platforms including forex, dating, adult content, outbound telemarketing, negative-option subscriptions, and cyberlockers.[1] Before submitting such a merchant’s transactions, the acquirer must itself be approved by Visa for high-integrity-risk acquiring and must register the merchant, and Visa may impose its own security or authentication requirements on it.[8]
Mastercard operates the Specialty Merchant Registration Programme. Its subsections are worth knowing by number because they set different obligations: §9.4.1 governs adult content and requires age and identity verification and written consent for everyone depicted, review before publication, and takedown procedures; §9.4.2 governs gambling and requires a copy of the licence for each jurisdiction, with independent certification of age and location verification for US merchants; further subsections cover pharmaceuticals and tobacco, government lotteries, skill games, cyberlockers, high-risk securities, cryptocurrency, and negative-option billing of physical products. Mastercard bills the acquirer an annual registration fee for each registered merchant.[3] An acquirer notice gives the 2026 schedule as USD 1,000 a year per merchant plus new fees of USD 0.02 and 0.10% per transaction, applying in the EU from except to the gambling, government-lottery, and pharmacy codes.[9] The adult-content requirements were extended by Mastercard in April 2021 and remain among the most detailed in the programme.[3]
Registration has a scheduling consequence operators consistently underestimate. The acquirer cannot complete registration before it has the licence, the domain, the content controls, and the compliance documentation in final form, and the scheme review adds its own time on top of the acquirer’s underwriting. A launch plan that treats acquiring as a two-week task at the end will discover the registration queue after the marketing spend is committed.
What Acquirers Actually Test
Acquirer underwriting is not a compliance review with a different letterhead. It is a credit decision. The acquirer settles funds to the merchant before the dispute window closes, so it carries the exposure if the merchant fails to deliver and the cardholders claim their money back. Everything it tests follows from that single fact.
Processing history is the most weighted input. Six to twelve months of statements showing volume, average ticket, approval rate, refund rate, chargeback count and ratio, and fraud ratio will move an application further than any policy document. A business with no history is not unbankable, but it is underwritten on projections, which means a lower initial volume cap and a higher reserve.
Delivery lag is the exposure multiplier. A business that charges today and delivers in nine months, which describes travel and event ticketing, carries a liability the acquirer holds for the whole period. This is why travel operators face high-risk treatment despite low fraud: the risk is not dishonesty, it is duration.
Refund and cancellation policy is tested for whether it is findable, followed, and consistent with the billing descriptor. The most common avoidable chargeback in subscription businesses is a cardholder who cannot identify the descriptor and disputes rather than cancels. A descriptor that names the recognisable brand plus a working support number reduces disputes measurably and costs nothing.
Financial strength and ownership are tested as recovery capacity: audited or management accounts, the licence, ultimate beneficial ownership traced to individuals, and personal guarantees in some structures. Chargeback management is tested as capability: representment workflow, alert coverage through the scheme resolution networks, and 3-D Secure implementation.
Strong Customer Authentication matters commercially in the EEA and the UK: under PSD2 and the UK Payment Services Regulations, a payee or its payment service provider that does not accept it where it is required must compensate the issuer for the resulting losses,[5] and under Visa’s dispute rules a card-absent fraud dispute is invalid once the issuer has confirmed the cardholder’s authentication through Visa Secure.[8] Exemption strategy matters commercially: over-applying exemptions to protect conversion moves liability back onto the merchant precisely on the transactions most likely to be disputed.
Reserve Terms and VAMP Identification Conditions
A reserve is the acquirer holding back a share of settlement against future disputes. It is the standard mechanism for pricing an unproven or elevated-risk merchant, and for most high-risk operators it is a larger cash-flow item than the processing rate.
| Structure | How it works | Typical terms | Cash-flow effect |
|---|---|---|---|
| Rolling reserve | A percentage of each settlement is withheld and released after a fixed period | 5–10% held 90–180 days; 10–20% held 180 days or more at the highest tiers | Permanent working-capital drag proportional to volume |
| Upfront reserve | A fixed deposit paid at boarding | Sized to projected monthly volume | One-off, then static |
| Capped reserve | Rolling accrual that stops at a ceiling | Ceiling set at one to two months of volume | Drag stops once the cap is reached |
| Zero reserve | No withholding, offset by pricing or volume caps | Established history and low dispute ratios only | None, but rarely offered at boarding |
The negotiable term is usually the structure rather than the percentage. Moving from an uncapped rolling reserve to a capped one changes the arithmetic of scaling: under an uncapped structure, growing volume permanently increases the amount of the operator’s own money sitting with the acquirer.
Reserves are set against scheme monitoring thresholds, and those thresholds moved recently. Visa’s Acquirer Monitoring Programme replaced the separate dispute and fraud programmes in 2025 and combines fraud and dispute counts into a single ratio. From the merchant Excessive threshold is 1.5% in the US, Canada, EU, and AP regions, as it already was in LAC (CEMEA remains at 2.2%), for a merchant with at least 1,500 fraud and dispute counts in a month (in CEMEA, 150 and USD 75,000), with acquirer thresholds at 0.50% Above Standard and 0.70% Excessive. Visa’s public fact sheet excludes Brazil, Chile, and India; their programmes are announced separately.[2] These Visa merchant thresholds apply where the acquirer is neither Above Standard nor Excessive.
Mastercard’s Excessive Chargeback Programme identifies a merchant as Excessive once a month’s chargebacks reach both 100 and 1.5% of the previous month’s sales, and as High Excessive at 300 and 3%, and can assess its acquirer.[3][9]
Visa’s current merchant Excessive threshold is 1.5% in AP, Canada, the EU, the US, and LAC (2.2% in CEMEA).[2] These Visa merchant thresholds apply where the acquirer is neither Above Standard nor Excessive; Visa’s public fact sheet excludes Brazil, Chile, and India; their programmes are announced separately. Monthly floors are 1,500 fraud-and-dispute events, or in CEMEA at least 150 events and USD 75,000. Two figures still circulate that are simply out of date: the legacy 0.9% and 1.0% dispute lines. Planning to those numbers in 2026 means planning to a threshold that no longer exists, in either direction. VAMP identification depends on regional and monthly-count conditions, and the acquirer’s own portfolio ratio matters as much as the merchant’s, which is why an acquirer near its own threshold will decline a merchant it would have taken a quarter earlier.
The Headline Rate Is the Smallest Part of the Cost
The headline discount rate is the most quoted and least useful number in this market. The total cost of an acquiring relationship is the rate plus the per-transaction fee plus the reserve drag plus the chargeback and retrieval fees plus the gateway and scheme pass-throughs plus, for registrable categories, the annual registration fee.
| Vertical | Discount rate | Rolling reserve | Chargeback fee |
|---|---|---|---|
| Standard e-commerce (for comparison) | 1.5–2.9% | 0% | €15–€25 |
| Medium-risk fintech | 2.5–3.5% | 0–5% for 90 days | €20–€35 |
| Licensed iGaming | 3.5–8% | 5–10% for 90–180 days | €25–€40 |
| Forex and CFD (licensed) | 4–8% | 5–10% for 180 days | €25–€50 |
| CBD and hemp-derived | 3.95–8% | 10% for 180 days | €25–€50 |
| Adult | 5–10% (outliers to 16%) | 10–20% for 180 days or more | €30–€50 |
Ranges are indicative across the partner network as of and vary by processing history, ticket size, and market mix. Reserve terms affect working capital; their financing cost must be compared with processing fees over the same period. An operator processing €500,000 a month at 6% with a 10% reserve held for an illustrative six months is paying €30,000 a month in fees and has €300,000 of its own money parked with the acquirer at steady state.
Negotiating the rate down to 5.5% saves €2,500 a month, or €30,000 a year. A reserve cap releases cash only if it is below the €300,000 steady-state balance: an illustrative €200,000 cap releases €100,000. At an assumed annual financing cost of 10%, that release saves €10,000 a year. A cap of one to two months of volume (€500,000–€1 million here) would release nothing; actual cap terms require agreement.
Through the placement model the pricing the client sees is the institutional rate. Jagelski & Partners is paid by the institution, not by the client, and does not mark up acquiring pricing or charge an onboarding fee.
One Acquirer Is a Single Point of Failure, and Cards Are Not the Only Rail
Single-acquirer dependency is the most common structural failure in high-risk payments. Termination is not a remote scenario in these categories; it is an operating condition, triggered by a scheme audit, a portfolio-level ratio breach at the acquirer, or a policy change with thirty days’ notice.
Separate MIDs also isolate ratios. A promotion that spikes disputes on one product line degrades only the MID carrying it, rather than pulling an entire portfolio toward a monitoring threshold. Routing across MIDs by product, geography, or issuer is standard practice for operators above roughly €250,000 a month, and the routing logic is where a competent gateway earns its fee.
Card rails are also not the only rails, and in several markets they are no longer the primary ones. Account-to-account payments under open banking settle without scheme fees, carry no chargeback right in most implementations, and are widely adopted in exactly the markets where card acceptance for high-risk categories is weakest.
Local methods matter more than global ones in practice. In 2024, account-to-account payments led by iDEAL took 67% of Dutch e-commerce value and those led by Blik and Przelewy24 took 70% in Poland; Pix made account-to-account Brazil’s leading e-commerce method at 41%, and digital wallets driven by UPI took 64% in India.[7]
The trade-off is real: removing the chargeback right removes the consumer protection that drives card conversion. Account-to-account works best for repeat customers and funded-account models, and poorly for first-purchase conversion. Stablecoin settlement adds a further option for business-to-business flows, and under MiCA the distinction between an authorised e-money token and a non-compliant issuer is now a supervisory question rather than a commercial preference.[6]
How Jagelski & Partners Helps
Acquiring placement runs on the same model as banking placement. The network is pre-qualified against the merchant profile before any formal application is submitted, because a declined application leaves a record and, for a terminated merchant, potentially a MATCH listing that follows the business for five years.
The assessment covers the parts of the file that decide the outcome: MCC classification and whether the intended code survives scheme review, licensing sufficiency for every market served, registration requirements under the Visa and Mastercard programmes, processing history presentation, reserve structure, and the redundancy architecture. Where the profile will not place as presented, we say so at the assessment stage rather than after a rejection cycle.
What we do not do. Our written scope never presents a business under a merchant category code that misdescribes its activity, and we do not scope or introduce unlicensed operators for regulated markets. Both are terminable at the scheme level, and both convert a solvable pricing problem into a permanent structural one.
Frequently Asked Questions
A high-risk merchant account is a card-acquiring facility for a business whose merchant category, dispute profile, or delivery model exceeds an acquirer’s standard risk tolerance. It is not a bank account: it lets the business accept Visa and Mastercard payments and receive settled proceeds, while a bank or EMI account holds and moves money. The two are separate products from different institutions.
Categories treated as high-risk include licensed gambling, forex and CFD broking, adult content, CBD and hemp-derived products, nutraceuticals with subscription billing, travel, and regulated crypto businesses. The classification attaches to the activity, not to the operator’s conduct.
Because one of four parties said no, and which one matters. A card scheme exclusion, for example an unlicensed gambling operator in a regulated market, cannot be documented around at any price. An acquirer decline on chargeback history or thin processing records is a documentation and structure problem and is frequently solvable. A PSP decline often means only that this PSP’s acquiring panel does not cover the vertical.
Repeated formal applications make the position worse. Terminated merchants can be listed in Mastercard’s MATCH system, which acquirers query at onboarding and which retains listings for five years.
Discount rates run 2.5–3.5% for medium-risk fintech, 3.5–8% for licensed iGaming, 4–8% for licensed forex and CFD brokers, 3.95–8% for CBD, and 5–10% for adult, with outliers to 16%. Chargeback fees run €20–€50 per case, and registrable categories carry an annual scheme registration fee.
Compare annual processing-fee savings with the annual financing cost of the reserve, not with the cash balance itself. At €500,000 monthly volume, a 10% reserve held for an illustrative six months ties up €300,000. A half-percentage-point rate reduction saves €30,000 a year. A negotiated cap below €300,000 can release cash; a €200,000 cap would release €100,000, worth €10,000 a year at an assumed 10% financing cost.
A rolling reserve is a percentage of each settlement withheld by the acquirer and released after a fixed period, typically 5–10% held 90–180 days, rising to 10–20% held 180 days or more at the highest risk tiers. It exists because the acquirer settles funds before the dispute window closes and carries the exposure if the merchant fails to deliver.
The structure is usually more negotiable than the percentage. A negotiated cap can limit cash tied up as volume grows; its value depends on the cap, financing cost and liquidity needs.
VAMP identification depends on region, monthly counts and the acquirer’s status. Visa’s Acquirer Monitoring Programme, which replaced the separate dispute and fraud programmes in 2025, sets the merchant Excessive threshold at 1.5% from 1 April 2026 in the US, Canada, EU, and AP regions (already 1.5% in LAC; 2.2% in CEMEA), with acquirer thresholds at 0.50% Above Standard and 0.70% Excessive. Mastercard’s Excessive Chargeback Programme flags a merchant once a month’s chargebacks reach both 100 and 1.5% of the previous month’s sales, with a High Excessive tier at 300 and 3%. These Visa merchant thresholds apply where the acquirer is neither Above Standard nor Excessive; Visa’s public fact sheet excludes Brazil, Chile, and India; their programmes are announced separately. Monthly floors are 1,500 fraud-and-dispute events, or in CEMEA at least 150 events and USD 75,000. Identification requires risk mitigation; it is not an automatic termination rule.
The legacy 0.9% and 1.0% figures still circulating online are out of date. The acquirer’s own portfolio ratio also matters: an acquirer near its own threshold will decline merchants it would have accepted a quarter earlier.
It is the single field with the most leverage over the account. The MCC determines interchange, whether the business falls into a scheme high-risk registration programme, whether issuers will authorise the transaction, and in some markets whether the payment is lawful. It is assigned by the acquirer, not chosen by the merchant.
Presenting a business under a code that misdescribes its activity breaches the scheme coding rules. The consequences run from immediate termination through MATCH listing to scheme fines assessed against the acquirer and passed on. A scheme review that finds the miscoding can trigger remediation, assessments or termination by the acquirer.
At least two, live, on separate MIDs, both processing real volume. Termination in these categories is an operating condition rather than a remote scenario, triggered by a scheme audit, a portfolio ratio breach at the acquirer, or a policy change on thirty days’ notice.
A dormant backup is an application rather than a fallback: the acquirer will re-underwrite before accepting redirected volume, at the exact moment the operator has no leverage. Separate MIDs also isolate dispute ratios so one product line cannot pull the whole portfolio toward a monitoring threshold.
Yes, and in several markets they carry more volume than cards. Account-to-account payments under open banking settle without scheme fees and carry no chargeback right in most implementations. Local methods lead e-commerce in their home markets: iDEAL in the Netherlands, Blik in Poland, Pix in Brazil, and UPI in India.
The trade-off is real. Removing the chargeback right removes the consumer protection that drives card conversion, so account-to-account works well for repeat and funded-account models and poorly for first-purchase conversion. Stablecoin settlement adds a business-to-business option, where MiCA now makes issuer compliance a supervisory question rather than a preference.
No. Jagelski & Partners is paid by the institution that takes the business, through a referral or revenue-share arrangement, not by a fee billed to the client. The pricing on the merchant agreement is the institutional rate. There is no markup on acquiring pricing and no onboarding fee.
Often, but the assessment is different. A termination that produced a MATCH listing narrows the acquirer set sharply for five years, and the workable routes usually involve a corrected merchant category code, a restructured entity with clean processing history, or acquirers that underwrite listed merchants on their own criteria.
What does not work is re-applying to the same acquiring panel under a different name, which the schemes are specifically built to detect. The assessment establishes which of the three routes is realistic before any application is made.
Ready to Place Acquiring That Survives a Scheme Audit?
Book an assessment. We check the merchant category code, licensing sufficiency, scheme registration requirements, processing-history presentation, and reserve structure before any formal application is made, then pre-qualify the profile across the acquiring partners whose criteria actually fit it. No markup on acquiring pricing. No onboarding fee.
References
Show all references
- Visa Inc., Visa Merchant Data Standards Manual (integrity-risk MCC provisions) (April 2026 edition), pp. 21–22 (the 13 high-integrity-risk merchant category codes) and the MCC listing (5967, 5968, 6211 and 7995), usa.visa.com, accessed .
- Visa Inc., Visa Acquirer Monitoring Programme (VAMP) Fact Sheet (2025), replacing VDMP and VFMP: merchant Excessive threshold reduced from 220 to 150 basis points in the AP, Canada, EU and US regions on , LAC at 150 and CEMEA at 220 basis points, for merchants with at least 1,500 fraud and dispute counts a month (CEMEA 150 and USD 75,000); acquirer Above Standard 0.50% and Excessive 0.70%; the public fact sheet excludes Brazil, Chile, and India; their programmes are announced separately, corporate.visa.com, accessed .
- Mastercard, Security Rules and Procedures—Merchant Edition (), sections 9.1 (registrable categories), 9.2.1 (an annual registration fee for each registered merchant, assessed to the acquirer), 9.4.1 (adult content), 9.4.2 (gambling) and 8.3 (Excessive Chargeback Program; thresholds set in Mastercard’s Data Integrity Monitoring Program manual), mastercard.com, accessed (archived copy of ); the adult-content requirements were extended in April 2021: Mastercard, Protecting our network, protecting you: Preventing illegal adult content on our network (), mastercard.com.
- Mastercard, Security Rules and Procedures—Merchant Edition (), sections 11.5 and 11.6 (an acquirer lists a merchant it terminates for a listed reason and checks MATCH Pro before boarding a merchant), 11.10 (MATCH Pro keeps merchant records for five years before automatic purge) and 11.14 (reason codes), mastercard.com, accessed (archived copy of ).
- European Union, Commission Delegated Regulation (EU) 2018/389 (regulatory technical standards on strong customer authentication and common and secure open standards of communication under PSD2), including the exemption regime (the loss allocation where strong customer authentication is not required or not accepted sits in PSD2 itself, Directive (EU) 2015/2366 Article 74(2)), SCA RTS; PSD2 Article 74(2); United Kingdom, Payment Services Regulations 2017, regulation 77(6), legislation.gov.uk, accessed .
- European Union, Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA), Titles III and IV on asset-referenced tokens and e-money tokens; Title V (crypto-asset service providers) applicable from , eur-lex.europa.eu, accessed .
- Worldpay, Global Payments Report 2025, country pages for the Netherlands, Poland, Brazil and India (share of 2024 e-commerce transaction value by payment method), worldpay.com, accessed .
- Visa Inc., Visa Core Rules and Visa Product and Service Rules (), sections 1.5.1.11 (the acquirer assigns the MCC that most accurately describes the business), 1.9.5.1 (approval for high-integrity-risk acquiring and merchant registration), 10.4.5.3 (security or authentication requirements on high-integrity-risk merchants) and 11.7.5 (Dispute Condition 10.4: a card-absent fraud dispute is invalid where the issuer confirmed authentication through Visa Secure with EMV 3-D Secure), usa.visa.com, accessed .
- PayPal Braintree, an acquirer’s published guidance (Mastercard’s Data Integrity Monitoring Program manual and fee notices are not public): Excessive Chargeback Program (Excessive Chargeback Merchant at 100–299 chargebacks and 1.50–2.99%, High Excessive at 300 or more and 3.00% or more, both conditions met, on a month’s chargebacks over the prior month’s sales), developer.paypal.com; Network Updates: Spring 2026 (Mastercard Specialty Merchant Registration fee USD 1,000 a year per merchant, and new specialty-merchant fees of USD 0.02 and 10 basis points per transaction, in the EU from except MCCs 7995, 5122, 5912 and 9406), developer.paypal.com, accessed .