High-risk merchant accounts: what they are and why subscriptions get flagged
What makes a merchant high risk for Visa, Mastercard and processors, why trials and recurring billing draw scrutiny, what reserves are, and how to stay low risk.
By Florian
A high-risk merchant account is a card-acceptance account that an acquirer opens with extra controls, because the business’s category or its history suggests more chargebacks, fraud or legal exposure than usual. The label comes from two places: the card networks, which name certain categories and set registration rules for acquirers, and your processor, which applies its own risk policy and can add reserves, limits or closer monitoring.
Subscription businesses are not high risk by default. They get flagged when their billing model looks like one the networks regulate closely (free trials that roll into paid plans, negative option offers) or when their dispute and fraud numbers rise toward the network thresholds. Both are largely under your control.
This guide uses the Visa Core Rules and Visa Product and Service Rules (edition of 24 October 2026), Visa’s subscription merchant notice (Visa Business News, 20 June 2019, effective 18 April 2020), Stripe’s monitoring programs and reserves documentation, and the network sources listed in our guide to chargeback ratio thresholds, all accessed in November 2026. Your acquirer’s contract can be stricter than any of them.
What makes a merchant “high risk”?
There is no single list. In practice, three things put a business in the high-risk bucket:
| Source of the label | What it looks at | Who decides |
|---|---|---|
| Network category | The merchant category code (MCC) and the type of business | Visa and Mastercard rules, applied by the acquirer |
| Dispute and fraud history | Chargeback and fraud ratios, monitoring program identification | Card network programs, then the acquirer |
| Processor policy | The processor’s restricted and prohibited business lists, its own underwriting | Your processor (Stripe, Adyen, Braintree…) |
A business can be high risk on one line and not the others. A software subscription in an ordinary category can still be treated as high risk after a month of heavy disputes.
How do Visa and Mastercard define high-risk merchants?
Visa: High-Integrity Risk merchants
Visa’s current term is High-Integrity Risk. Its rules say Visa classifies a merchant as a High-Integrity Risk Merchant when it must use one of the MCCs listed in the Visa Integrity Risk Program Guide. The public rules point to that guide rather than listing every code.
What the classification changes is mostly on the acquirer’s side. Before submitting transactions for these merchants, Visa’s rules (section 1.9.5.1) require the acquirer to:
- submit a High-Integrity Risk Acquiring Registration Application and be approved by Visa;
- undergo a financial review and meet capital requirements, or commit to compensating controls such as collateral;
- register each High-Integrity Risk merchant with Visa.
Section 10.4.5.2 also requires acquirers to keep daily data on these merchants, such as gross sales volume and average transaction amount. Those obligations are why acquirers price, monitor and limit these accounts differently.
Mastercard: registration and MATCH
Mastercard’s Security Rules and Procedures, Merchant Edition contain its Business Risk Assessment and Mitigation (BRAM) program, its registration requirements for certain merchant types, and MATCH Pro, a database in which merchants are listed with a reason code. Check the current edition with your acquirer: the rules for listing are there, not in processor summaries.
Why do subscription businesses get flagged?
Trials and negative option billing
Visa has specific rules for recurring billing, and stricter ones for negative option merchants: in Visa’s definition, a merchant that requires the cardholder to expressly reject an offer or expressly decline to take part in future transactions. Visa’s 2019 notice applies its subscription rules to any merchant, physical or digital, that offers free trials or introductory offers that roll into an ongoing subscription.
The October 2026 rules require, for every recurring transaction:
- a simple cancellation procedure, and at least an online cancellation procedure if the order was taken online;
- the fixed dates or intervals of the charges in the terms;
- a notice at least 7 days before a recurring charge when a trial, introductory offer or promotional period is ending, with the amount, the date and a simple way to cancel online or by SMS;
- in the Europe Region, the same notice in further cases, such as when more than 6 months have passed since the previous recurring charge.
For negative option merchants, Visa adds a clear disclosure on the checkout screen, express consent through a “click-to-accept” button, a confirmation immediately after the first transaction, and a written notice at least 7 days before a later transaction if the terms change or a trial ends. Visa’s 2019 notice sums up the cancellation standard: it “should be similar to ‘unsubscribing’ from an email distribution list”.
An acquirer reviewing a subscription business will look for exactly these elements. For the legal side in the US and the EU, see click-to-cancel rules.
Disputes that pile up after billing events
Recurring billing concentrates charges on renewal dates. A confusing renewal, an annual charge nobody remembered or a trial conversion without a reminder can produce many disputes in a short window. The network programs count those disputes per month:
| Program | Merchant threshold (most regions) |
|---|---|
| Visa VAMP | 1.5% and 1,500 fraud reports plus disputes a month |
| Mastercard ECP | 1.5% and 100 chargebacks a month |
| Mastercard EFM | 0.5% fraud chargeback ratio and USD 50,000, among other conditions |
The figures and their sources are detailed in our chargeback ratio guide. Stripe notes that won disputes still count, and that acquirers watch their whole portfolio, so processors often act well before you reach a network threshold. You can check your Visa ratio with the free VAMP calculator.
Card testing on signup forms
Trial and signup forms that save a card are a common target for card testing. Visa’s VAMP includes an enumeration ratio for this. A burst of tiny authorization attempts on your signup page is a risk signal on its own, even if no dispute follows.
What changes on a high-risk account?
The most documented control is a reserve: part of your balance held back to cover future refunds and chargebacks. Stripe’s documentation on reserves for connected accounts, which it describes as similar to the reserves Stripe creates for direct accounts, gives the main forms:
| Reserve type | How it works |
|---|---|
| Rolling | A percentage of each charge is held and released a set number of days after that charge |
| Fixed | A percentage of each charge is held until a specified date |
| Hold | A one-off amount set aside |
On that page, Stripe says funds can’t be reserved for longer than 180 days.
Other controls an acquirer can apply depend on its contract: processing limits, closer review of your dispute numbers, or a request for a remediation plan. If a processor offers you a “high-risk” account, ask for the reserve, fees, limits and termination terms in writing before you sign.
How do you stay low risk as a subscription business?
- Make the terms visible at checkout. Price after the trial, billing frequency and how to cancel, next to the payment button.
- Get express consent. A checkbox or button that clearly accepts the recurring charge, and a confirmation email right after.
- Send the 7-day reminders. Before a trial ends and before annual renewals, with the amount, the date and a cancel link.
- Keep cancellation online and simple. Offer a retention step if you want, but the cancel button stays visible. See cancel flow best practices.
- Use a clear billing descriptor. Customers who recognize the charge do not dispute it as fraud. See billing descriptors.
- Refund early warnings and obvious mistakes. A refund before a dispute does not count as one. See Stripe early fraud warnings.
- Measure your ratios monthly, per network, and watch the weeks after renewals and price changes. See preventing subscription chargebacks.
- Protect the signup form against card testing with rate limits and fraud rules.
FAQ
What is a high-risk merchant?
A business that an acquirer or a card network treats as more likely than usual to generate chargebacks, fraud or legal issues, because of its category, its billing model or its dispute history.
Is a SaaS or subscription business high risk?
Not automatically. It is treated as higher risk when it bills like a negative option offer (trials that convert unless cancelled, unclear terms), or when its dispute and fraud ratios rise toward the network thresholds.
What is the Visa Integrity Risk Program?
The Visa program behind its High-Integrity Risk classification. Merchants in the MCCs listed in its guide are High-Integrity Risk Merchants, and their acquirers must register them with Visa and meet extra requirements.
What is a rolling reserve?
A share of each payment held back and released after a set number of days. Stripe also uses fixed reserves (released on a date) and one-off holds, and says funds can’t be reserved for longer than 180 days.
What are Visa’s rules for free trials?
At least 7 days before the first paid charge after a trial, notify the cardholder with the amount, the date and a simple way to cancel online or by SMS. Offer online cancellation if the order was taken online.
How do I get off a high-risk account?
Bring your dispute and fraud ratios down and keep them down. Card network programs require a period below the thresholds before exit, and processors usually review reserves and limits based on that history.
How NoChurn helps
NoChurn does not underwrite accounts or decide your risk level: that stays with your processor. It works on the numbers that drive it. Cancel flows keep a one-click cancel visible next to any retention offer. Disputes from your payment provider show with their reason, so you can see which causes push your ratio, and NoChurn gathers the evidence it has and drafts a reply with AI that a person reviews before submitting. On Stripe, early fraud warnings can be refunded in one click, before they turn into disputes.
NoChurn connects to Stripe in one click and works with Chargebee, Recurly, Paddle, Braintree and others, or with any billing through the API. Pricing depends only on MRR, with no commission (a custom sending domain needs a paid plan, from $9). See chargebacks and cancel flows.