Visa's VAMP Ratio, Read From the Merchant Side

Visa’s “excessive” threshold for merchants under its Acquirer Monitoring Program, VAMP, dropped from 2.2% to 1.5% on 1 April 2026 in Asia Pacific, Canada, Europe and the US. That’s six months ago, so this isn’t news. I’m writing it up because most of what I read about VAMP fixes on that one number, and from a merchant’s side I don’t think it’s the number that decides most outcomes. What decides them is how the ratio is counted and which threshold your acquirer is managing to.

How the ratio is built

Visa’s fact sheet defines the VAMP ratio as the count of fraud reports (TC40) plus disputes (TC15), divided by the count of settled transactions (TC05). The fraud and disputes are on card-not-present transactions, and acquirer guides, including Solidgate’s documentation and a Chargeback Gurus post published by the Merchant Risk Council, describe the denominator as settled card-not-present transactions too. It counts events, not money.

Three details make it a different number from the chargeback rate most merchants already track. A fraudulent transaction that produces both a TC40 and a dispute is counted twice; Stripe’s documentation says so explicitly. A TC40 can arrive without any dispute at all, and Stripe notes that issuers have to report possible fraud on a captured payment even if it was refunded. And dispute outcomes don’t matter, because the programs count disputes when they’re raised, not when they’re won. Visa does exclude disputes resolved through its pre-dispute solutions and TC40s that qualify for Compelling Evidence 3.0.

The practical upshot is that a merchant whose internal dashboard shows a comfortable chargeback rate can still have a VAMP ratio well above it.

The thresholds, region by region

Per Visa’s fact sheet, the merchant “excessive” level was set at 220 basis points from 1 June 2025 and falls to 150 basis points on 1 April 2026 in AP, Canada, the EU and the US, with a minimum of 1,500 fraud reports and disputes a month. Latin America was already at 150. CEMEA stays at 220, with a different floor: at least 150 fraud reports and disputes and at least USD 75,000 in amount. Visa says programs for Brazil, Chile and India will be announced separately.

At the portfolio level, an acquirer is “above standard” at 50 basis points and “excessive” at 70, with a similar count floor. The advisory period ended on 30 September 2025, and Visa’s own update said only the excessive level would be enforced from that point. The Chargeback Gurus post and Solidgate’s docs both put enforcement of the above-standard tier from 1 January 2026; I haven’t found that date in a Visa document I could read, so treat it as their reporting.

On fees, Visa’s public fact sheet gives no amounts, and the guides I read quote different per-transaction figures. I’d take the number from your acquirer’s own schedule.

The acquirer’s line is the one I’d watch

Imagine a merchant running at 1.2%. It’s under Visa’s merchant line with room to spare. It’s also more than twice the 0.5% at which its acquirer’s whole portfolio becomes above standard. If I were that acquirer with a portfolio drifting toward 0.5%, the first calls I’d make would be to merchants like this one. That’s my reading of the incentives, not something Visa says, but acquirers do put their own levels in writing. Stripe’s documentation lists a “non-compliant” level at a 0.5% ratio and a count of just five, well below anything on Visa’s merchant table.

The count floor works the same way. At 1.5%, reaching 1,500 events takes about 100,000 settled card-not-present transactions a month, so plenty of smaller merchants will never meet Visa’s merchant-level criteria. Their fraud reports and disputes still sit in the acquirer’s portfolio ratio. For high-risk verticals, where legitimate businesses often run closer to thresholds than mainstream ones, this is where the conversation starts, and I’ve written before that every bank connection behind a provider carries its own risk appetite. For a merchant with a low dispute rate, none of this changes much.

What I’d watch

I’d calculate a VAMP-style ratio myself every month, the way Visa counts it: by events, with double counting, assigned to the month the report arrives, and per statement descriptor and acquirer, since Stripe says that’s how Visa identifies an account. I’d track TC40s and early fraud warnings as their own line, not just chargebacks. If someone proposes loosening fraud rules to lift approvals, this ratio is where the bill shows up a few weeks later, which is the argument in why approval rate is a dangerous KPI. Card testing has its own VAMP metric, at 20% of authorizations and 300,000 enumerated transactions, and it doesn’t need a single dispute to trip.

I’d also manage to the combined ratio across every acquirer, not each one separately. Splitting traffic across accounts so that each one stays under a threshold is a tactic to avoid monitoring programs, and the FTC’s Nuvei and Humboldt orders prohibit exactly that kind of tactic, load balancing included, for those two companies; I wrote about it in what “should have known” means for a processor. Routing exists for approvals, cost and coverage, and the combined number is the one that tells you the truth.

One more date: Stripe’s docs say Visa’s Merchant Elevated Risk Program applies to merchants in Asia Pacific from October 2026, aimed at newer accounts, with thresholds Visa doesn’t publish. For anyone launching in AP, the first months of fraud reports and declines now count for more than they used to.