Payment Processing Service Agreement
ANNEX 3
PAYMENT SCHEME RISK MONITORING PROGRAMS
to the Merchant Services Agreement
1. Introduction and Scope
1.1 This Annex forms an integral part of the Merchant Services Agreement entered into between the “Company” and the Merchant (the “Agreement”). It describes the principal payment scheme risk monitoring programs that apply to the Merchant’s card-not-present (CNP) transaction activity processed through the Company, and sets out the related operational obligations of the parties.
1.2 The programs described in this Annex are operated by Visa Inc. and its affiliates (“Visa”) and by Mastercard International Incorporated and its affiliates (“Mastercard”), each a “Scheme”. The Company participates in these Schemes as an acquirer and is bound by their respective rules, including the Visa Core Rules, the Visa Product and Service Rules, the Visa Acquirer Monitoring Program Guide, and the Mastercard Security Rules and Procedures (together, the “Scheme Rules”).
1.3 In the event of any inconsistency between this Annex and the Scheme Rules, the Scheme Rules shall prevail. The Schemes may amend the Scheme Rules, the thresholds, the assessments and any other element of the programs described in this Annex at their sole discretion and without prior notice to the Merchant. The Company shall use reasonable endeavours to notify the Merchant of any material amendments promptly after publication by the relevant Scheme.
1.4 Capitalised terms used in this Annex have the meanings given to them in the Agreement and, where not defined in the Agreement, the meanings given in the Scheme Rules. For the avoidance of doubt, where this Annex refers to “TC40” it means a fraud transaction reported by an issuer to Visa, “TC15” means a dispute submitted by an issuer to Visa, and “TC05” means a settled card-not-present transaction. The unit “bps” means a basis point, equal to 0.01%.
1.5 The Merchant acknowledges that all of its CNP transactions processed by the Company are subject to monitoring under the programs described in this Annex, and that the Merchant’s failure to maintain its performance within the applicable thresholds may result in the consequences set out in this Annex and in the Agreement, including financial liability.
2. Visa Acquirer Monitoring Program (VAMP)
2.1 Overview
2.1.1 The Visa Acquirer Monitoring Program (the “VAMP”) is the card-not-present transaction monitoring program operated by Visa under which fraud, dispute, and enumeration activity is monitored at both the acquirer portfolio and the merchant level on a monthly basis. The VAMP consolidates the former Visa Fraud Monitoring Program (VFMP) and Visa Dispute Monitoring Program (VDMP) into a single unified framework.
2.1.2 Visa evaluates Merchant performance under the VAMP using transactional data from the previous calendar month, processed by Central Processing Date (CPD) for settled transactions and disputes, and by fraud post-date for fraud reports.
2.2 Performance Metrics
2.2.1 The Merchant’s performance under the VAMP is measured by reference to the following ratios, expressed in basis points (bps):
(a) VAMP Ratio — calculated as the sum of TC40 fraud reports and all categories of TC15 disputes, divided by the count of TC05 settled card-not-present transactions for the calendar month in question. The Merchant acknowledges that the same underlying transaction may give rise to both a TC40 and a TC15, in which case both items are counted in the numerator.
(b) VAMP Enumeration Ratio — calculated as the count of card-not-present authorisation attempts identified by Visa’s Account Attack Intelligence (VAAI) system as part of an enumeration or BIN attack, divided by the total count of CNP authorisation attempts for the calendar month in question.
2.3 Items Excluded from the VAMP Ratio
2.3.1 Subject to the timing of Visa’s data extract, the following items are excluded from the VAMP Ratio calculation:
- (a) disputes resolved through pre-dispute solutions, including Rapid Dispute Resolution (RDR); provided that, where an RDR refund is processed and the issuer subsequently files a TC40, only the TC40 is counted;
- (b) disputes resolved via the Cardholder Dispute Resolution Network (CDRN); and
- (c) TC40 fraud reports that qualify under Visa’s Compelling Evidence 3.0.
Note: The Merchant is encouraged to enrol in RDR and to make use of Compelling Evidence 3.0 in order to reduce its exposure under the VAMP.
2.4 Merchant Identification Thresholds
2.4.1 The Merchant shall be identified by Visa under the VAMP at the Merchant Excessive level if, in any calendar month, its VAMP Ratio or VAMP Enumeration Ratio meets or exceeds the thresholds set out in the table below, and the applicable minimum monthly count is met.
| Indicator | Threshold | Minimum monthly count |
| VAMP Ratio (Merchant Excessive) | ≥ 150 bps | 1,500 combined TC40 + TC15 |
| VAMP Enumeration Ratio | ≥ 2,000 bps | 300,000 enumerated authorisations |
2.4.2 Merchant-level identification under the VAMP applies only where the Company’s overall acquirer VAMP Ratio is above 50 bps.
Note: For merchants registered in the CEMEA region, the minimum monthly count is 150 combined TC40 and TC15 events, provided that the combined fraud and dispute amount is at least USD 75,000. The Merchant is registered in the Europe region for the purposes of this Annex unless otherwise notified by the Company in writing.
2.5 Per-Event Fees under VAMP
2.5.1 Where the Merchant is identified by Visa at the Merchant Excessive level, Visa levies a per-event fee on the Company for each TC40 fraud transaction and each TC15 dispute transaction attributable to the Merchant in the relevant calendar month. The applicable thresholds and fees by region are set out in the table below:
| Identification Level | Region | Threshold (from 1 April 2026) | Fee per Count |
| Excessive (Merchant) | NA, EU, AP | ≥ 150 bps | USD 8 |
| Excessive (Merchant) | LAC | ≥ 150 bps | USD 8 |
| Excessive (Merchant) | CEMEA | ≥ 220 bps (min. 150 count and ≥ USD 75,000) | USD 8 |
2.5.2 No per-event fees are levied by Visa in respect of an identification under the VAMP Enumeration Ratio; provided, however, that an enumeration identification counts towards the Grace Period referred to in clause 2.7 and may give rise to other consequences under the Visa Rules.
2.5.3 Any per-event fee, assessment or other amount levied by Visa on the Company in respect of the Merchant’s activity under the VAMP shall be passed through to the Merchant in accordance with the Agreement.
2.6 Early Warning
2.6.1 Visa may issue a courtesy Early Warning notification where the Merchant’s VAMP Ratio reaches 40 bps or greater but remains below 50 bps.
2.6.2 An Early Warning notification does not constitute a VAMP identification, does not give rise to any fee, and does not affect the Grace Period referred to in clause 2.7. However, the Merchant shall use such notification as an indication of elevated risk and shall undertake commercially reasonable steps to bring its performance back within acceptable levels.
2.7 Grace Period
2.7.1 Where the Merchant has had no VAMP identification in the preceding 12 consecutive months, a Grace Period of three (3) consecutive calendar months shall apply on the Merchant’s first subsequent identification. During the Grace Period, no enforcement fees are assessed by Visa to the Company in respect of the Merchant.
2.7.2 The Grace Period runs to completion regardless of whether further identifications occur during the three-month period. Once the Grace Period ends, any subsequent identification shall be subject to immediate enforcement and fees.
2.8 Notification and Remediation
2.8.1 Where the Merchant is identified under the VAMP, the Company shall notify the Merchant in writing, setting out the reason for the identification, the applicable threshold exceeded, and the potential consequences of non-compliance.
2.8.2 The Merchant shall, within five (5) business days of receipt of the Company’s notification, provide the Company with:
- (a) an analysis of the root cause of the elevated fraud, dispute, or enumeration activity;
- (b) a written remediation plan specifying the concrete corrective measures the Merchant will implement and the target dates for their implementation; and
- (c) such supporting documentation as the Company may reasonably request.
2.8.3 Upon a written and reasoned request from the Merchant submitted before the expiry of the period set out in clause 2.8.2, the Company may, at its sole discretion, grant the Merchant a one-time extension of up to a further five (5) business days to provide the documents listed in clause 2.8.2. No further extension shall be granted.
2.8.4 The Company shall use reasonable endeavours to support the Merchant throughout the remediation process and may, without limitation, recommend specific risk controls, 3D Secure (3DS) routing optimisations, fraud rule adjustments, or enrolment in pre-dispute solutions. The Merchant acknowledges that the implementation of these measures remains its own responsibility.
2.9 Exit Criteria
2.9.1 A VAMP identification shall be resolved and the case closed where the Merchant’s VAMP Ratio falls below the applicable Merchant Excessive threshold (as set out in clause 2.4) for the region in which the Merchant is registered. An Enumeration identification shall be resolved where the VAMP Enumeration Ratio falls below 2,000 bps.
2.10 Mitigation Measures
2.10.1 Without prejudice to its rights under the Agreement, the Company recommends that the Merchant adopt the following measures to maintain its compliance under the VAMP:
- (a) ensure that its 3D Secure routing and exemption settings are correctly configured to maximise authenticated traffic;
- (b) consider enrolling in Rapid Dispute Resolution (RDR) or equivalent pre-dispute services to resolve disputes before they are counted as TC15 events;
- (c) monitor its chargeback and fraud levels regularly using the reporting tools available in the Company’s Control Panel;
- (d) respond promptly to fraud rule optimisation suggestions provided by the Company’s Risk Team; and
- (e) where it processes transactions in regions with elevated fraud exposure, calibrate its fraud filters and velocity controls accordingly.
3. Mastercard Excessive Fraud Merchant Program (EFM)
3.1 Overview and Application
3.1.1 The Mastercard Excessive Fraud Merchant Program (the “EFM”) is operated by Mastercard with the objective of reducing fraud on e-commerce transactions, strengthening the security of the ecosystem, and improving the cardholder experience. The EFM measures compliance at the Merchant Identifier (MID) level and operates through notifications and financial assessments delivered to the Company as acquirer.
3.1.2 Merchants registered in countries excluded from the EFM by Mastercard are not subject to monitoring under the EFM. The list of excluded countries is published by Mastercard and may be updated from time to time.
3.2 Identification Thresholds
3.2.1 The Merchant shall be classified as non-compliant under the EFM where, in any calendar month, all of the following criteria are met:
| Criterion | Threshold (all must be met) |
| Monthly fraud chargeback volume (USD) | ≥ USD 50,000 |
| Fraud chargeback ratio | ≥ 0.50% (≥ 0.20% for Australia) |
| Monthly cleared transaction count | ≥ 1,000 |
| 3DS usage rate | < 10% (non-regulated countries) / < 50% (regulated countries) |
Note: The term “regulated” refers to countries with a legal or regulatory requirement for strong cardholder authentication. The term “non-regulated” refers to countries without such requirement. The Merchant shall request the current list of regulated and non-regulated countries from the Company’s Risk Team.
3.3 Regulated and Non-Regulated Countries
3.3.1 For information purposes, the following countries are currently classified by Mastercard as “regulated” for the purposes of the EFM:
- Bangladesh
- Malaysia
- Singapore
- Nigeria
3.3.2 All non-EU countries other than those listed in clause 3.3.1 are currently classified as “non-regulated” for the purposes of the EFM.
3.4 Assessments
3.4.1 Mastercard applies financial Violation Assessments to acquirers in respect of merchants appearing on the EFM at incrementally increasing amounts depending on the number of consecutive months for which the merchant has been above the EFM thresholds, in accordance with the schedule set out in the table below:
| Number of months above EFM thresholds | Violation Assessment |
| 1 | USD/EUR 0 |
| 2 | USD/EUR 500 |
| 3 | USD/EUR 1,000 |
| 4 to 6 | USD/EUR 5,000 |
| 7 to 11 | USD/EUR 25,000 |
| 12 to 18 | USD/EUR 50,000 |
| 19 + | USD/EUR 100,000 |
3.4.2 Any Violation Assessment or other amount levied by Mastercard on the Company in respect of the Merchant’s activity under the EFM shall be passed through to the Merchant in accordance with the Agreement.
3.5 Exit Parameters
3.5.1 The Merchant shall exit the EFM where its performance is below the program thresholds set out in clause 3.2 for three (3) consecutive calendar months.
4. Card Testing and Enumeration / BIN Attacks
4.1 Definitions
4.1.1 For the purposes of this clause 4:
(a) “Enumeration attack” means a scheme by which a malicious actor systematically submits card-not-present transactions using enumerated values (such as primary account number, CVV2, expiration date, and postal code) for the purpose of deriving legitimate payment account details, using the authorisation response to identify valid accounts.
(b) “Account testing” means the practice of initiating low-value transactions (typically USD 1 to USD 2) to verify whether a payment account is active, with the intention of using the account for subsequent fraudulent purchases or sale on illicit markets. Such activity typically focuses on a single BIN range and uses common name, email or billing address fields across multiple transactions.
(c ) “Merchant account takeover” means the unauthorised access by a third party to the Merchant’s payment gateway, typically obtained through phishing or other social engineering, used to conduct illicit transactions through the Merchant’s account.
4.2 Indicators of Enumeration or Account Testing
4.2.1 The Merchant acknowledges that the following patterns may indicate an enumeration attack or account testing:
- (a) a high number of transaction attempts within a short period, particularly from a single IP address or directed at a specific BIN or account range; and
- (b) an elevated number of declined or timed-out authentication attempts that receive a challenge request.
4.2.2 The Merchant shall notify the Company’s Risk Team without undue delay where it identifies any such patterns in its own processing activity.
4.3 Mastercard BIN Attack Definition
4.3.1 Mastercard defines a third-party fraud event as a BIN attack where both of the following conditions are met:
- (a) at least 100 authorisation or authentication requests are sent within one hour for a given BIN or BIN account range from one or more merchants; and
- (b) the issuer, its service provider, or Mastercard (using a network fraud detection tool) declines fifty per cent (50%) or more of such requests within that one-hour window.
4.4 Visa Enumeration Monitoring Thresholds
4.4.1 Visa monitors CNP authorisation attempts concentrating on a single BIN or multiple BINs while iterating through combinations of payment values. The Visa enumeration monitoring thresholds are as follows:
| Timeline | ROC Block Count | ROC Block Rate |
| Early Warning | ≥ 1,000 and ≤ 5,000 —OR— ≥ 50,000 | ≥ 10% —OR— ≥ 1% and ≤ 5% |
| Standard | ≥ 5,000 | ≥ 5% |
| Excessive | ≥ 50,000 | ≥ 10% |
Note: The ROC (Risk Operation Center) Block Rate is calculated as the number of ROC-blocked transactions divided by the total card-absent transaction count for the relevant period.
4.5 The Company’s Internal Controls
4.5.1 The Company maintains internal fraud prevention controls intended to mitigate enumeration attacks, account testing and merchant account takeover so far as commercially reasonable. The existence of such controls does not relieve the Merchant of its own obligations to implement appropriate security measures, monitor its activity, and respond to risk indicators in a timely manner.
5. Chargeback Monitoring Programs
5.1 Mastercard Excessive Chargeback Program (ECP)
5.1.1 The Mastercard Excessive Chargeback Program (the “ECP”) evaluates merchants that receive an excessive number of chargebacks on a monthly basis. The Merchant shall be evaluated under the ECP at the MID level.
5.1.2 Under the ECP, the chargeback-to-transaction ratio (the “ECP Ratio (CTR)”) is calculated by dividing the number of chargebacks received in the current calendar month by the number of transactions processed in the previous calendar month.
5.1.3 The Merchant may be identified under the ECP in one of two categories: Excessive Chargeback Merchant (“ECM”) and High Excessive Chargeback Merchant (“HECM”). The thresholds for each category are set out below:
| Program | Chargeback-to-Transaction Ratio | Minimum monthly chargeback count |
| ECM (Excessive Chargeback Merchant) | ≥ 1.50% | ≥ 100 |
| HECM (High Excessive Chargeback Merchant) | ≥ 3.00% | ≥ 300 |
5.2 Non-Compliance Assessments under the ECP
5.2.1 No assessment is levied for the first month in which the Merchant exceeds the ECM threshold.
5.2.2 For the second and each subsequent consecutive month in which the Merchant exceeds the ECM (or, where applicable, the HECM) threshold, Mastercard shall levy a Violation Assessment on the Company in accordance with the schedule set out in the table below. From the fourth consecutive month onwards, an additional Issuer Recovery Assessment shall also apply.
| Months above ECM threshold | Violation Assessment if ECM | Violation Assessment if HECM | Issuer Recovery Assessment applies |
| 1 | USD/EUR 0 | USD/EUR 0 | No |
| 2 | USD/EUR 1,000 | USD/EUR 1,000 | No |
| 3 | USD/EUR 1,000 | USD/EUR 2,000 | No |
| 4 to 6 | USD/EUR 5,000 | USD/EUR 10,000 | Yes |
| 7 to 11 | USD/EUR 25,000 | USD/EUR 50,000 | Yes |
| 12 to 18 | USD/EUR 50,000 | USD/EUR 100,000 | Yes |
| 19 + | USD/EUR 100,000 | USD/EUR 200,000 | Yes |
5.2.3 The Issuer Recovery Assessment is calculated as follows:
Issuer Recovery Assessment = (Number of chargebacks − 300) × USD/EUR 5 per chargeback.
Example: A merchant with 500 chargebacks in the relevant month would be assessed USD/EUR 1,000 in Issuer Recovery (calculated as (500 − 300) × USD/EUR 5).
5.2.4 Any Violation Assessment, Issuer Recovery Assessment, additional assessment or other amount levied by Mastercard on the Company in respect of the Merchant’s activity under the ECP shall be passed through to the Merchant in accordance with the Agreement.
5.3 Exit Parameters under the ECP
5.3.1 The Merchant shall maintain its status under the ECP until its performance is below the ECM thresholds set out in clause 5.1.3 for three (3) consecutive calendar months.
6. General Provisions
6.1 Pass-Through of Scheme Fees and Assessments
6.1.1 Without limiting the financial responsibility provisions of the Agreement, the Merchant acknowledges that any fee, assessment, fine, or other financial consequence levied by Visa or Mastercard on the Company in connection with the Merchant’s activity under any of the programs described in this Annex shall be passed through to and borne by the Merchant in full, in accordance with the Agreement.
6.2 Reservation of the Company’s Rights
6.2.1 Without prejudice to any other rights it may have under the Agreement or applicable law, the Company reserves the right to take any or all of the following measures at any time where the Merchant’s performance approaches or exceeds the thresholds set out in this Annex:
- (a) require the Merchant to enable 3D Secure on all or part of its CNP transactions;
- (b) impose limits on transaction counts, amounts or velocity;
- (c) increase the rolling reserve or other security held by the Company;
- (d) suspend processing for specified BINs, issuing countries, or merchant categories;
- (e) require the Merchant to enrol in pre-dispute services (such as Rapid Dispute Resolution and Order Insight) and/or Compelling Evidence 3.0; and
- (f) terminate the Merchant’s processing services in accordance with the termination provisions of the Agreement.
6.3 Updates and Amendments
6.3.1 The Schemes may amend the rules, thresholds, fees, and other elements of the programs described in this Annex at their sole discretion. Where any such amendment becomes effective, the corresponding provisions of this Annex shall be deemed automatically updated to reflect the current Scheme Rules.
6.3.2 The Company shall use reasonable endeavours to notify the Merchant of any material change to the programs described in this Annex (such as a reduction in a threshold or the introduction of a new fee category) promptly after the Company becomes aware of such change.
6.4 Contact
6.4.1 For questions concerning the programs described in this Annex, the Merchant’s compliance status, or the optimisation of its performance, the Merchant shall contact the Company’s Risk Team at the contact details set out in the Agreement or on the Company’s Control Panel.
Signature:
| Client (Company Name) | |
| Representative, Title | |
| Signature | |
| Date |