Merchant risk classification is the process by which an acquirer, payment facilitator or payment service provider assigns each merchant a risk level, usually low, medium or high, or a numerical score. The classification reflects how likely the merchant is to cause losses through chargebacks, fraud, insolvency or regulatory breaches, and it determines the merchant's pricing, settlement terms, reserves and the intensity of monitoring. It is set at onboarding and reviewed during the relationship.
The classification draws on the provider's own risk appetite and on card network rules, which single out certain industries as higher risk. It is closely tied to the merchant onboarding workflow and to ongoing card scheme compliance. Merchants placed in the top category are commonly called high-risk merchants and may need a specialist high-risk acquirer.
Merchant risk classification in plain terms
Insurance companies charge young drivers with fast cars more than experienced drivers with family saloons, because they are more likely to claim. They may also insist on a larger excess, or refuse cover altogether for drivers with a bad record.
Payment providers think the same way about businesses. A local bakery that takes payments face to face is unlikely to generate disputes. An online business selling subscriptions, travel booked months ahead or products with health claims is more likely to face refunds and chargebacks, so it is classified as higher risk and handled more carefully.
Factors used in classification
- Industry. The merchant category code and the real nature of the goods or services, since some sectors have high dispute or legal risk.
- Business model. Card-not-present sales, subscriptions, free trials and delivery long after payment all increase exposure.
- Geography. Where the merchant, its owners and its customers are located, including cross-border sales and sanctions risk.
- Track record. Processing history, the chargeback ratio, refund rates and any previous terminations.
- Financial strength. Size, profitability and capital, which affect whether the merchant could cover refunds if it got into trouble.
- Ownership and management. Background checks on owners and directors, including sanctions and adverse media.
Many providers combine these into a risk score, often using models that weight each factor, similar to customer risk segmentation in anti-money laundering programmes.
Industries commonly treated as high risk
| Category | Main concern |
|---|---|
| Gambling and betting | Legal restrictions vary by country; dispute and money laundering risk |
| Adult content and dating | Brand and legal risk; disputes from unrecognised charges |
| Nutraceuticals and some health products | Misleading claims and free-trial subscription traps |
| Travel and ticketing | Long gap between payment and delivery; supplier failure |
| Crypto and money services | Fraud, money laundering and licensing issues |
| Direct marketing and subscriptions | High chargeback rates and cancellation problems |
Card networks maintain their own lists of business types that carry higher brand or legal risk and require acquirers to register such merchants and apply extra oversight. Visa runs an integrity risk programme for these categories, and Mastercard has comparable registration requirements.
Effects of classification
Higher-risk merchants typically pay higher fees and may be required to accept a rolling reserve or other merchant reserve, longer settlement times, lower processing limits or caps on refunds. They may face more frequent reviews and transaction monitoring, and in some cases must use specific authentication such as 3-D Secure on all online payments. Low-risk merchants benefit from quicker onboarding, next-day settlement and lower prices.
As an illustration, a provider might place a neighbourhood café taking chip and contactless payments in its lowest tier, with next-day payouts and no reserve. An online travel agency selling holidays months in advance might sit in the highest tier, with payouts delayed, a reserve held back from each settlement for several months, and a monthly review of its bookings and refunds. A software subscription business might fall in between, with standard payouts but close monitoring of its cancellation flow and dispute rates. Terms like these are set out in the merchant agreement and can be changed if the merchant's risk level moves.
Classification also affects the acquirer: networks track acquirers whose merchant portfolios generate excessive fraud or disputes, so a provider with many high-risk merchants must invest more in controls.
Limitations and criticism
Industry-based classification can be blunt, treating well-run merchants in a high-risk sector the same as poorly run ones, and it can push legal businesses towards a few specialist providers. Some merchants misrepresent their activity to obtain a lower classification, which is a form of transaction laundering and a breach of network rules. Classifications based on old data can miss sudden changes, such as a merchant switching products or being taken over. For these reasons, good practice combines classification at onboarding with continuous monitoring and periodic reclassification, so that risk levels reflect current behaviour rather than a one-off assessment.