Visa VAMP: How the Visa Acquirer Monitoring Program Counts Disputes

The table summarises Visa's own fact sheet, which is dated 2025 and carries a footnote about the April 2026 change. The rows are explained in the sections that follow.

Visa's rules add little detail in public. Section 10.4.3.1 of the Visa Rules says Visa will identify an acquirer under VAMP if it meets the requirements specified in the Visa Acquirer Monitoring Program Guide. That guide is not among Visa's public documents, so the fact sheet is the best primary source available to a merchant.

Visa's fact sheet says the updated program consolidates the earlier VAMP, the Visa Fraud Monitoring Program and the Visa Dispute Monitoring Program into a single global program. Each month Visa monitors fraud, dispute and enumeration levels and identifies acquirers or merchants that exceed the thresholds. Those identified are required to implement risk mitigation control measures.

The dates need care because Visa's documents give more than one. Visa's announcement says the evolved program became effective on 1 April 2025, with an advisory period running through 30 September 2025. The fact sheet says the updated thresholds took effect on 1 June 2025. In a published conversation, Visa's head of ecosystem engagement said that enforcement would begin after the advisory period, and only at the Excessive level at that time.

The name tells you who Visa holds responsible. The program is aimed at acquirers, the banks and processors that sponsor merchants into the network. A merchant feels it through its acquirer, and Visa advises merchants to ask their acquirers what their VAMP ratio is and what follows from the acquirer's own portfolio performance.

The fact sheet gives the formula in Visa's record types. Fraud is TC40, the record of a fraud report from an issuer. Disputes are TC15. Settled transactions are TC05. Visa describes the result as a single, count-based ratio that includes key components of fraud and disputes.

Count-based means every event weighs the same. A disputed charge of 9 dollars moves the ratio as much as one of 900 dollars. For a subscription business with many small charges, the denominator is large and so is the opportunity for small-value disputes to accumulate.

The numerator has two parts that can come from the same sale. Chargeflow, a dispute vendor, points out that an issuer can file a fraud report without a dispute following, and under the formula that report still counts. The fact sheet does not say how a transaction with both a fraud report and a dispute is treated, so ask your acquirer whether it is counted once or twice in your reporting.

Here is the arithmetic for two merchants in the United States. The first settles 100,000 card-not-present Visa transactions in a month and receives 700 fraud reports and 900 disputes. Its ratio is 1,600 divided by 100,000, which is 1.6% or 160 basis points, and its count of 1,600 is above 1,500. The second settles 2,000 transactions and receives 40 fraud reports and disputes. Its ratio is 2%, but its count of 40 is far below the minimum in the fact sheet.

The fact sheet sets the acquirer levels on the whole portfolio. An acquirer is identified as Above Standard if its ratio is at or above 50 basis points and as Excessive at or above 70 basis points. Both levels share the same minimum monthly count of fraud reports and disputes.

If the acquirer is not at either level, the Excessive Merchant thresholds apply to individual merchants. The fact sheet's main table shows 220 basis points for Asia-Pacific, Canada, the EU and the United States, with a footnote stating that the threshold was reduced to 150 basis points in those regions on 1 April 2026. Latin America and the Caribbean were already at 150 basis points.

Visa's published conversation explains the minimum count. The minimum of 1,500 was set so that the program focuses on significant issues and not on normal business fluctuations. Visa's speaker said most clients will not be affected and described VAMP as an outlier program.

Visa's speaker tied the exclusions to the higher minimum count. Visa added fraud to the equation, raised the minimum count to 1,500 and excluded investments in pre-dispute tools as well as Compelling Evidence 3.0, which she said helps with friendly fraud.

Pre-dispute solutions are the tools that resolve a cardholder's complaint before it becomes a formal dispute. Visa's dispute guide for merchants describes two. Order Insight shares transaction details with the issuer when a cardholder questions a charge. Rapid Dispute Resolution lets a merchant set rules, through its acquirer, to resolve eligible disputes automatically. The guide tells merchants to confirm with their acquirer how Rapid Dispute Resolution outcomes appear in dispute counts.

Compelling Evidence 3.0 is narrower. It applies to one fraud dispute condition and requires earlier undisputed transactions from the same cardholder. The exclusion in the fact sheet is for fraud reports that qualify under it.

The phrase about timing is a real limit. An exclusion that lands after the monthly data extract may not be reflected in that month's ratio. The fact sheet does not give the extract schedule.

Enumeration is rapid, automated guessing of card details against a merchant's checkout. Visa's announcement calls it a brute force card testing attack at scale and attributes 1.1 billion dollars in annual fraud losses to it.

The fact sheet says VAMP requires acquirers to take proactive steps to prevent merchants from exceeding two enumeration thresholds. The enumeration ratio is the count of enumerated authorization transactions, approved and declined, divided by all authorization transactions, at 2,000 basis points or more. The enumeration count is 300,000 or more enumerated transactions.

This test has nothing to do with customer disputes. A subscription merchant with a clean dispute record can still be flagged if bots use its payment form to test stolen card numbers.

The fact sheet states the obligation in one sentence: entities identified as exceeding program thresholds are required to implement risk mitigation control measures. The Visa Rules add that Visa may require an acquirer or its merchant to deploy remediation tools or technologies. Visa also describes an early warning for clients that are approaching a threshold.

Fees are another matter. Chargeback Gurus, Checkout.com and EasyPayDirect report a fee of about 8 dollars for each fraud report or dispute once a merchant is above the Excessive level, reduced from 10 dollars, charged to the acquirer and passed through. We did not find that figure in any public Visa document. Treat it as vendor reporting and ask your acquirer what your agreement says.

Visa has published early results. It says nearly half of the acquirers identified in the program improved their performance within a single quarter, and that the ratio among identified acquirers declined 45% quarter over quarter. Those are Visa's own figures about its own program.

The acquirer levels are much lower than the merchant level: 50 and 70 basis points against 150. An acquirer near its own line has a reason to act on merchants well below the Visa merchant threshold. What it does is governed by its contract with the merchant, which is why Visa points merchants to their acquirers.

Subscription billing produces the kind of dispute that feeds the numerator. Visa's dispute guide notes that card-absent fraud disputes can arise when a cardholder does not recognise a charge or does not recall what they agreed to, including subscription purchases where the terms were not clear at checkout. When an issuer also reports such a claim as fraud, that is the TC40 record the formula counts.

Two responses follow from the fact sheet itself. Disputes resolved before they become formal disputes are excluded, and fraud reports that meet Compelling Evidence 3.0 are excluded. Both depend on having the transaction details, the customer's history and the record of what they agreed to ready when the issuer asks.

• Ask your acquirer for your monthly VAMP ratio and count, and for its own portfolio position
• Ask how it treats a transaction that has both a fraud report and a dispute
• Ask which pre-dispute tools it supports and how their outcomes appear in the count
• Ask what fees or other terms your agreement applies above a threshold