A Merchant Account Is Not a Bank Account
A merchant account is a card-acquiring facility: an arrangement with a licensed acquirer that lets a business accept Visa, Mastercard, and other scheme payments and receive the settled proceeds. A business bank or EMI account holds and moves money. The two are separate products, bought from different institutions, underwritten against different criteria, and lost independently of each other.
The distinction matters commercially because the failure modes are asymmetric. Losing a bank account freezes treasury but leaves revenue collection intact for a few days. Losing an acquirer stops revenue on the same afternoon, and the reserve balance stays with the acquirer for the length of the chargeback tail, typically 180 days. Operators who plan redundancy at the bank layer and single-source their acquiring have protected the wrong side of the stack.
Three terms are sold as synonyms and are not. “High-risk merchant account”, “high-risk payment gateway”, and “high-risk payment processing” name the acquiring relationship, the technical interface that routes an authorisation, and the operational service that sits between them. A gateway cannot underwrite you. Only an acquirer can, and only an acquirer carries the scheme liability if you fail.
Who Actually Decides: The Four Parties
Four parties sit behind every card payment, and knowing which one declined an application determines whether the decline is appealable. An intermediary that says “the bank said no” is usually reporting a decision taken two layers away.
| Party | What it is | What it decides | Can it be appealed? |
|---|---|---|---|
| Card scheme | Visa, Mastercard, and the domestic schemes | Whether the merchant category is permitted at all, and on what registration terms | No. Scheme rules are not negotiated per merchant |
| Acquirer | The licensed institution that holds scheme membership and carries the settlement liability | Whether to underwrite this merchant, at what pricing, with what reserve | Yes, with better documentation or a changed structure |
| PSP or ISO | The commercial layer that packages acquiring, gateway, and support | Which acquirers it will present the file to | Yes, but usually by changing PSP rather than by argument |
| Gateway | The technical interface that routes authorisation messages | Nothing about risk; it executes routing | Not applicable |
The practical consequence is that a decline needs a source before it needs a response. A scheme-level exclusion, for example an unlicensed gambling operator in a regulated market, cannot be documented around at any price. An acquirer-level decline on chargeback history is a documentation and structure problem, and it is frequently solvable. A PSP-level decline often means only that this PSP’s acquiring panel does not cover the vertical, which is the cheapest problem of the three to fix.
Pre-qualification exists because that diagnosis is expensive to run yourself. Every formal application that is declined leaves a record in the acquirer’s file and, for terminated merchants, potentially in the Mastercard MATCH system, which acquirers query at onboarding and which retains listings for five years.[4] A MATCH listing is not a blacklist in the legal sense, but in practice it converts a documentation problem into a structural one.
Merchant Category Codes: The Field That Governs Everything
The MCC is a four-digit classification the acquirer assigns at boarding. It determines interchange, whether the merchant falls into a scheme high-risk programme, whether issuers will authorise the transaction at all, and in several markets whether the payment is legal. It is the single field with the most leverage over the economics of the account, and it is assigned by the acquirer rather than chosen by the merchant.
The codes that carry high-integrity-risk treatment cluster in a short list, and every one of them changes the acquiring panel a business can reach:
- MCC 7995. Betting and gambling, including lottery and casino gaming.
- MCC 6211. Securities and financial trading, which is where forex and CFD brokers sit.
- MCC 6051. Quasi-cash, including crypto on-ramps and foreign-currency purchase.
- MCC 7273. Dating and escort services.
- MCC 5912 and 5122. Pharmacies, and drugs and druggist sundries.
- MCC 5967. Inbound telemarketing, the code most often applied to adult content billing.
- MCC 5966. Outbound telemarketing.
Two reassignment patterns cause real damage. An unlicensed forex operation is routinely moved off 6211 onto the gambling code, which changes both the pricing and the set of issuers willing to authorise. A nutraceutical business using subscription billing is moved from a general retail code onto 5122, which pulls it into pharmaceutical monitoring. Neither reassignment is arbitrary; both follow scheme rules on how the underlying activity must be described. Both are also predictable before boarding, which is the point of assessing the code first.
Miscoding is not a workaround. Presenting a gambling business under a general e-commerce code is transaction laundering under scheme rules, and the consequences run from immediate termination through MATCH listing to scheme fines assessed against the acquirer, who will pass them on. It is also the single most common reason a portfolio that ran cleanly for a year terminates in a week when a scheme audit reaches it.
Scheme Registration Is Permission, Not a Penalty
Both major schemes run registration programmes for merchant categories they treat as integrity risks. Registration is not a penalty; it is the mechanism by which the category is permitted to operate at all, and an acquirer that boards a registrable merchant without registering it is the party in breach.
Visa operates the Integrity Risk Programme, which in its 2026 edition covers roughly twelve to fourteen merchant category codes across gambling, pharmaceuticals, crypto, forex, dating, and outbound telemarketing.[1] Registration carries an annual fee per merchant per region and requires the acquirer to hold evidence of licensing, age and location controls, and content policies appropriate to the category.
Mastercard operates the Specialty Merchant Registration Programme. Its subsections are worth knowing by number because they set different obligations: §9.4.1 governs adult content and requires age verification, consent documentation, and takedown procedures; §9.4.2 governs gambling and requires evidence of licensing in every market served plus geolocation controls; further subsections cover pharmaceutical, tobacco, and skill-gaming categories.[3] The adult-content requirements were tightened materially by Mastercard AN 5196 in 2021 and remain the strictest documentation set in the programme.
Registration has a scheduling consequence operators consistently underestimate. The acquirer cannot complete registration before it has the licence, the domain, the content controls, and the compliance documentation in final form, and the scheme review adds its own time on top of the acquirer’s underwriting. A launch plan that treats acquiring as a two-week task at the end will discover the registration queue after the marketing spend is committed.
What Acquirers Actually Test
Acquirer underwriting is not a compliance review with a different letterhead. It is a credit decision. The acquirer settles funds to the merchant before the dispute window closes, so it carries the exposure if the merchant fails to deliver and the cardholders claim their money back. Everything it tests follows from that single fact.
Processing history is the most weighted input. Six to twelve months of statements showing volume, average ticket, approval rate, refund rate, chargeback count and ratio, and fraud ratio will move an application further than any policy document. A business with no history is not unbankable, but it is underwritten on projections, which means a lower initial volume cap and a higher reserve.
Delivery lag is the exposure multiplier. A business that charges today and delivers in nine months, which describes travel and event ticketing, carries a liability the acquirer holds for the whole period. This is why travel operators face high-risk treatment despite low fraud: the risk is not dishonesty, it is duration.
Refund and cancellation policy is tested for whether it is findable, followed, and consistent with the billing descriptor. The most common avoidable chargeback in subscription businesses is a cardholder who cannot identify the descriptor and disputes rather than cancels. A descriptor that names the recognisable brand plus a working support number reduces disputes measurably and costs nothing.
Financial strength and ownership are tested as recovery capacity: audited or management accounts, the licence, ultimate beneficial ownership traced to individuals, and personal guarantees in some structures. Chargeback management is tested as capability: representment workflow, alert coverage through the scheme resolution networks, and 3-D Secure implementation.
Strong Customer Authentication under PSD2 shifts fraud liability to the issuer for authenticated transactions in the EEA and the UK, which is the cheapest fraud-loss reduction available to a European merchant.[5] Exemption strategy matters commercially: over-applying exemptions to protect conversion moves liability back onto the merchant precisely on the transactions most likely to be disputed.
Reserve Structure Is Negotiable; the 1.5% Threshold Is Not
A reserve is the acquirer holding back a share of settlement against future disputes. It is the standard mechanism for pricing an unproven or elevated-risk merchant, and for most high-risk operators it is a larger cash-flow item than the processing rate.
| Structure | How it works | Typical terms | Cash-flow effect |
|---|---|---|---|
| Rolling reserve | A percentage of each settlement is withheld and released after a fixed period | 5–10% held 90–180 days; 10–20% held 180 days or more at the highest tiers | Permanent working-capital drag proportional to volume |
| Upfront reserve | A fixed deposit paid at boarding | Sized to projected monthly volume | One-off, then static |
| Capped reserve | Rolling accrual that stops at a ceiling | Ceiling set at one to two months of volume | Drag stops once the cap is reached |
| Zero reserve | No withholding, offset by pricing or volume caps | Established history and low dispute ratios only | None, but rarely offered at boarding |
The negotiable term is usually the structure rather than the percentage. Moving from an uncapped rolling reserve to a capped one changes the arithmetic of scaling: under an uncapped structure, growing volume permanently increases the amount of the operator’s own money sitting with the acquirer.
Reserves are set against scheme monitoring thresholds, and those thresholds moved recently. Visa’s Acquirer Monitoring Programme replaced the separate dispute and fraud programmes in 2025 and combines fraud and dispute counts into a single ratio. From the merchant Excessive threshold is 1.5% in the US, Canada, EU, AP, and LatAm regions (CEMEA remains at 2.2%), with acquirer thresholds at 0.50% Above Standard and 0.70% Excessive.[2]
Mastercard’s Excessive Chargeback Programme uses a 1.5% ratio with a 100-chargeback floor, and the High Excessive tier a 3.0% ratio, with escalating monthly assessments for continued breach.[3]
Two figures still circulate that are simply out of date: the legacy 0.9% and 1.0% dispute lines. Planning to those numbers in 2026 means planning to a threshold that no longer exists, in either direction. The operative line is 1.5%, and the acquirer’s own portfolio ratio matters as much as the merchant’s, which is why an acquirer near its own threshold will decline a merchant it would have taken a quarter earlier.
The Headline Rate Is the Smallest Part of the Cost
The headline discount rate is the most quoted and least useful number in this market. The total cost of an acquiring relationship is the rate plus the per-transaction fee plus the reserve drag plus the chargeback and retrieval fees plus the gateway and scheme pass-throughs plus, for registrable categories, the annual registration fee.
| Vertical | Discount rate | Rolling reserve | Chargeback fee |
|---|---|---|---|
| Standard e-commerce (for comparison) | 1.5–2.9% | 0% | €15–€25 |
| Medium-risk fintech | 2.5–3.5% | 0–5% for 90 days | €20–€35 |
| Licensed iGaming | 3.5–8% | 5–10% for 90–180 days | €25–€40 |
| Forex and CFD (licensed) | 4–8% | 5–10% for 180 days | €25–€50 |
| CBD and hemp-derived | 3.95–8% | 10% for 180 days | €25–€50 |
| Adult | 5–10% (outliers to 16%) | 10–20% for 180 days or more | €30–€50 |
Ranges are indicative across the partner network as of and vary by processing history, ticket size, and market mix. The pattern that holds across all of them is that the reserve dominates. An operator processing €500,000 a month at 6% with a 10% reserve held 180 days is paying €30,000 in fees and has €300,000 of its own money parked with the acquirer at steady state.
Negotiating the rate down to 5.5% saves €2,500 a month; capping the reserve frees an amount an order of magnitude larger.
Through the placement model the pricing the client sees is the institutional rate. Jagelski & Partners is paid by the institution, not by the client, and does not mark up acquiring pricing or charge an onboarding fee.
One Acquirer Is a Single Point of Failure, and Cards Are Not the Only Rail
Single-acquirer dependency is the most common structural failure in high-risk payments. Termination is not a remote scenario in these categories; it is an operating condition, triggered by a scheme audit, a portfolio-level ratio breach at the acquirer, or a policy change with thirty days’ notice.
Separate MIDs also isolate ratios. A promotion that spikes disputes on one product line degrades only the MID carrying it, rather than pulling an entire portfolio toward a monitoring threshold. Routing across MIDs by product, geography, or issuer is standard practice for operators above roughly €250,000 a month, and the routing logic is where a competent gateway earns its fee.
Card rails are also not the only rails, and in several markets they are no longer the primary ones. Account-to-account payments under open banking settle without scheme fees, carry no chargeback right in most implementations, and are widely adopted in exactly the markets where card acceptance for high-risk categories is weakest.
Local methods matter more than global ones in practice: iDEAL in the Netherlands, Blik in Poland, Pix in Brazil, and UPI in India each carry a majority or near-majority of domestic e-commerce volume.
The trade-off is real: removing the chargeback right removes the consumer protection that drives card conversion. Account-to-account works best for repeat customers and funded-account models, and poorly for first-purchase conversion. Stablecoin settlement adds a further option for business-to-business flows, and under MiCA the distinction between an authorised e-money token and a non-compliant issuer is now a supervisory question rather than a commercial preference.[6]
How Jagelski & Partners Helps
Acquiring placement runs on the same model as banking placement. The network is pre-qualified against the merchant profile before any formal application is submitted, because a declined application leaves a record and, for a terminated merchant, potentially a MATCH listing that follows the business for five years.
The assessment covers the parts of the file that decide the outcome: MCC classification and whether the intended code survives scheme review, licensing sufficiency for every market served, registration requirements under the Visa and Mastercard programmes, processing history presentation, reserve structure, and the redundancy architecture. Where the profile will not place as presented, we say so at the assessment stage rather than after a rejection cycle.
What we do not do. We do not present a business under a merchant category code that misdescribes its activity, and we do not place unlicensed operators into regulated markets. Both are terminable at the scheme level, and both convert a solvable pricing problem into a permanent structural one.
Frequently Asked Questions
A high-risk merchant account is a card-acquiring facility for a business whose merchant category, dispute profile, or delivery model exceeds an acquirer’s standard risk tolerance. It is not a bank account: it lets the business accept Visa and Mastercard payments and receive settled proceeds, while a bank or EMI account holds and moves money. The two are separate products from different institutions.
Categories treated as high-risk include licensed gambling, forex and CFD broking, adult content, CBD and hemp-derived products, nutraceuticals with subscription billing, travel, and regulated crypto businesses. The classification attaches to the activity, not to the operator’s conduct.
Because one of four parties said no, and which one matters. A card scheme exclusion, for example an unlicensed gambling operator in a regulated market, cannot be documented around at any price. An acquirer decline on chargeback history or thin processing records is a documentation and structure problem and is frequently solvable. A PSP decline often means only that this PSP’s acquiring panel does not cover the vertical.
Repeated formal applications make the position worse. Terminated merchants can be listed in Mastercard’s MATCH system, which acquirers query at onboarding and which retains listings for five years.
Discount rates run 2.5–3.5% for medium-risk fintech, 3.5–8% for licensed iGaming, 4–8% for licensed forex and CFD brokers, 3.95–8% for CBD, and 5–10% for adult, with outliers to 16%. Chargeback fees run €20–€50 per case, and registrable categories carry an annual scheme registration fee.
The reserve usually costs more than the rate. At €500,000 monthly volume, a 10% rolling reserve held 180 days leaves €300,000 of the merchant’s own money with the acquirer at steady state, which is an order of magnitude more than a half-point of rate.
A rolling reserve is a percentage of each settlement withheld by the acquirer and released after a fixed period, typically 5–10% held 90–180 days, rising to 10–20% held 180 days or more at the highest risk tiers. It exists because the acquirer settles funds before the dispute window closes and carries the exposure if the merchant fails to deliver.
The structure is usually more negotiable than the percentage. Moving from an uncapped rolling reserve to a capped one stops the drag growing with volume, which matters more to a scaling business than a rate concession.
The operative line in 2026 is 1.5%. Visa’s Acquirer Monitoring Programme, which replaced the separate dispute and fraud programmes in 2025, sets the merchant Excessive threshold at 1.5% from 1 April 2026, with acquirer thresholds at 0.50% Above Standard and 0.70% Excessive. Mastercard’s Excessive Chargeback Programme uses a 1.5% ratio with a 100-chargeback floor and a 3.0% High Excessive tier.
The legacy 0.9% and 1.0% figures still circulating online are out of date. The acquirer’s own portfolio ratio also matters: an acquirer near its own threshold will decline merchants it would have accepted a quarter earlier.
It is the single field with the most leverage over the account. The MCC determines interchange, whether the business falls into a scheme high-risk registration programme, whether issuers will authorise the transaction, and in some markets whether the payment is lawful. It is assigned by the acquirer, not chosen by the merchant.
Presenting a business under a code that misdescribes its activity is transaction laundering under scheme rules. The consequences run from immediate termination through MATCH listing to scheme fines assessed against the acquirer and passed on. It is the most common reason a portfolio that ran cleanly for a year terminates in a week.
At least two, live, on separate MIDs, both processing real volume. Termination in these categories is an operating condition rather than a remote scenario, triggered by a scheme audit, a portfolio ratio breach at the acquirer, or a policy change on thirty days’ notice.
A dormant backup is an application rather than a fallback: the acquirer will re-underwrite before accepting redirected volume, at the exact moment the operator has no leverage. Separate MIDs also isolate dispute ratios so one product line cannot pull the whole portfolio toward a monitoring threshold.
Yes, and in several markets they carry more volume than cards. Account-to-account payments under open banking settle without scheme fees and carry no chargeback right in most implementations. Local methods dominate their home markets: iDEAL in the Netherlands, Blik in Poland, Pix in Brazil, and UPI in India.
The trade-off is real. Removing the chargeback right removes the consumer protection that drives card conversion, so account-to-account works well for repeat and funded-account models and poorly for first-purchase conversion. Stablecoin settlement adds a business-to-business option, where MiCA now makes issuer compliance a supervisory question rather than a preference.
No. Jagelski & Partners is paid by the institution that takes the business, through a referral or revenue-share arrangement, not by a fee billed to the client. The pricing on the merchant agreement is the institutional rate. There is no markup on acquiring pricing and no onboarding fee.
Often, but the assessment is different. A termination that produced a MATCH listing narrows the acquirer set sharply for five years, and the workable routes usually involve a corrected merchant category code, a restructured entity with clean processing history, or acquirers that underwrite listed merchants on their own criteria.
What does not work is re-applying to the same acquiring panel under a different name, which the schemes are specifically built to detect. The assessment establishes which of the three routes is realistic before any application is made.
Ready to Place Acquiring That Survives a Scheme Audit?
Book an assessment. We check the merchant category code, licensing sufficiency, scheme registration requirements, processing-history presentation, and reserve structure before any formal application is made, then pre-qualify the profile across the acquiring partners whose criteria actually fit it. No markup on acquiring pricing. No onboarding fee.
References
Show all references
- Visa Inc., Visa Merchant Data Standards Manual (integrity-risk MCC provisions) (April 2026 edition), covering the high-integrity-risk merchant category codes and per-merchant registration requirements, corporate.visa.com, accessed .
- Visa Inc., Visa Acquirer Monitoring Programme (VAMP) Fact Sheet (2025), replacing VDMP and VFMP; acquirer Above Standard 0.50% and Excessive 0.70%; merchant Excessive 150 basis points from , corporate.visa.com, accessed .
- Mastercard Inc., Mastercard Security Rules and Procedures (Edition 2025), Specialty Merchant Registration Programme §9.4.1 (adult content, as tightened by AN 5196, 2021) and §9.4.2 (gambling); Excessive Chargeback Programme (ECM 1.5% with a 100-chargeback floor) and High Excessive tier (HECM 3.0%), accessed .
- Mastercard Inc., Member Alert to Control High-risk Merchants (MATCH) System, Security Rules and Procedures: listing reason codes and the five-year retention period, accessed .
- European Union, Commission Delegated Regulation (EU) 2018/389 (regulatory technical standards on strong customer authentication and common and secure open standards of communication under PSD2), including the exemption regime (the authentication liability shift sits in PSD2 itself, Directive (EU) 2015/2366 Article 74(2)), eur-lex.europa.eu, accessed .
- European Union, Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA), Titles III and IV on asset-referenced tokens and e-money tokens; Title V (crypto-asset service providers) applicable from , eur-lex.europa.eu, accessed .