High-Risk Merchant

A high-risk merchant is a business that an acquirer or payment provider classifies as carrying elevated risk, because of how often its customers dispute payments, the regulatory exposure of what it sells, or the reputational damage it could cause. Online gambling, adult content, cryptocurrency, nutraceuticals and supplements, retail forex and binary options, travel, and subscription businesses with free trials are commonly placed in this category.

The label belongs to the acquirer, not to a regulator. No law defines a high-risk merchant; each acquirer, payment service provider and sponsor bank sets its own risk appetite, informed by card network rules and its own losses. The same business can be refused by one provider and accepted as standard by another.

An acquirer is financially liable for the merchants it signs up. If a merchant takes card payments, fails to deliver, and goes out of business, cardholders win their chargebacks and the acquirer pays them. Card networks also hold acquirers responsible for any illegal transactions their merchants process. The main risk factors are:

• Dispute and fraud rates: businesses with delayed delivery, recurring billing or intangible products generate more chargebacks.
• Regulatory exposure: products such as gambling, cannabis-related goods, firearms or crypto are legal in some jurisdictions and illegal in others.
• Reputational risk: some sectors attract consumer complaints, media scrutiny or pressure from the networks.
• Financial weakness: start-ups and businesses that take payment long before delivering, such as airlines and event organizers, create exposure if they fail.

Visa and Mastercard identify sensitive sectors through the merchant category code (MCC) assigned to each merchant, and require acquirers to register and monitor merchants in certain high-risk categories. Both card networks run monitoring programs that fine acquirers when a merchant's chargeback or fraud ratio exceeds set thresholds for consecutive months, and both maintain brand-protection programs aimed at illegal or deceptive transactions.

Mastercard also operates the MATCH list (Mastercard Alert to Control High-risk Merchants), a shared database of merchants whose accounts were terminated for reasons such as excessive chargebacks, fraud or laundering. A merchant listed on MATCH typically finds it very hard to open a new account with a mainstream acquirer for several years.

Acquirers that serve high-risk merchants manage their exposure through underwriting and contract terms. Common measures include:

• Enhanced due diligence on owners, business model, website, refund policy and licensing, along the lines of enhanced due diligence in AML compliance.
• A rolling reserve: a share of each day's settlement, often 5 to 10 percent, held back for a period such as 180 days to cover future chargebacks.
• Higher pricing: a higher merchant discount rate and per-transaction fees.
• Delayed settlement, volume caps and ongoing monitoring of refund and chargeback ratios.

A supplement seller processes US$500,000 a month in card sales. Its acquirer charges a higher rate than a standard retailer and keeps a 10 percent rolling reserve for 180 days. Each month US$50,000 is withheld; after six months the reserve reaches about US$300,000, and from then on each month's oldest tranche is released as a new one is taken. If the merchant suddenly stops trading and customers file US$120,000 in chargebacks, the acquirer pays them from the reserve rather than absorbing the loss.

Because high-risk merchants require more monitoring and carry more liability, many banks decline them altogether, a form of de-risking. In the United States, the Justice Department initiative known as Operation Choke Point, launched in 2013, became controversial for pressuring banks to drop lawful but disfavored businesses. Refused merchants often turn to specialist high-risk acquirers, to payment facilitators with a high-risk appetite, or to acquiring banks in other countries. Misdescribing a business or using a false MCC to obtain an account, or processing another business's sales through an approved account (known as transaction laundering), breaches network rules and exposes both merchant and acquirer to fines and termination.