Visa’s Integrity Risk Program, better known as VIRP, decides which merchants get labeled high integrity risk, what controls they must run, and what they pay for the privilege. Get the classification wrong, and you can lose your merchant account. Get it right, and you gain a stable, bank-backed way to accept cards for years.
This guide breaks down the tier system, the current fee structure, the control requirements that took hold in 2026, and a practical readiness checklist you can work through this week. We wrote it for business owners and sales agents who want plain answers, not a rulebook.
What the Visa Integrity Risk Program Actually Is
Visa launched VIRP on May 1, 2023, to replace the Global Brand Protection Program, or GBPP. The older program sorted merchants into two loose buckets based on brand damage. VIRP takes a sharper view. It targets businesses that operate legally but could process transactions for activity that is not legal, and it asks acquiring banks to prove they have controls in place.
The shift matters for one reason, above all others. VIRP puts the burden on the acquirer, not only on the merchant. When Visa flags a merchant, the acquiring bank becomes the responsible party. That is why underwriting questions got longer, approval times stretched, and terms of service got tighter across these higher risk industries.
Visa also has a clear motive. The company reported in September 2025 that it identified more than one billion dollars in fraud attempts over the prior year. Card fraud losses worldwide reached $33.41 billion in 2024 according to Nilson Report data published in January 2026, with projections climbing toward $41 billion by 2030. Programs like VIRP are Visa’s answer to that curve.
VIRP is not the same as VAMP
Merchants mix these two up constantly, and the confusion costs them time. Here is the clean split:
| Visa Integrity Risk Program (VIRP) | Visa Acquirer Monitoring Program (VAMP) | |
| What it measures | The nature of the business and the transaction | Fraud and dispute performance |
| Trigger | Business category and evidence of prohibited activity | Ratios that cross a defined threshold |
| How many merchants it takes | One merchant can open a case | A pattern across the portfolio |
| Main fix | Registration, controls, documentation, and sometimes termination | Lower the ratios |
| Applies to | Merchants in listed high integrity risk categories | All merchants |
A merchant with a spotless chargeback record can still trigger a VIRP case. A merchant with clean products can still land in VAMP. Many high-risk businesses sit in both at once, and the two programs need separate responses.
The Three VIRP Tiers, Explained
Visa sorts high-risk merchants into three tiers based on Merchant Category Code, or MCC. Your MCC is the four-digit code that tells the card networks what you sell. It carries more weight than anything on your website.
| Tier | Risk level | Control assessment | Common examples and MCCs |
| Tier 1 | Highest | Required for each MCC, with annual reassessment | Adult Content (5967), Gambling (7995), Online Pharmacies (5122, 5912), Dating Services (7273) |
| Tier 2 | High | Required at the tier level, with annual review | Cryptocurrency (6051, 6012), Cyberlockers (4816), Skill-based Gaming (5816) |
| Tier 3 | Moderate | Not required by default, but Visa can request one anytime | Outbound Telemarketing (5966), Tobacco (5993), Negative-option and Subscription Billing (5968) |
Being High Risk Does Not Automatically Mean You Need to Register with the Card Brands
This is the single most common misread of the program, and it costs merchants money in both directions.
“High risk” is a label your processor uses to describe pricing, reserves, and underwriting appetite. Card-brand registration is a separate thing with a narrower trigger. Registration applies only when your business falls inside a listed Visa VIRP category, or a listed Mastercard Specialty Merchant category.
Plenty of businesses get priced as high risk without ever needing registration. Others assume that because nobody has mentioned registration, they must be outside the categories, when in fact their MCC puts them squarely inside one.
Two examples of how this goes wrong.
Priced high risk, no registration required. A travel booking company collects payment months before a trip happens. Banks call that future delivery risk. The business gets high-risk pricing, rolling reserves, and a longer underwriting review. None of that pulls it into card-brand registration, because travel does not sit in a Visa VIRP tier or on Mastercard’s specialty merchant list. This owner pays more than a standard retailer and pays nothing in annual registration. An owner who assumes the two go together may agree to fees that do not apply to the business.
Registration required, and nobody mentioned it. A tobacco shop sells in person for years without a single registration conversation. Then it launches an online store. Tobacco carries MCC 5993, which sits in VIRP Tier 3 and on Mastercard’s specialty list, and the card-not-present channel is what pulls the business into scope. The counter sales never needed registration. The website does. Owners in this spot often learn about it when the fee appears on a statement or, worse, when the account gets terminated for processing unregistered.
The deciding factors in both cases are your MCC and your sales channel, not the label on your pricing.
What VIRP Costs in 2026
Visa restructured VIRP pricing effective April 1, 2024. Three-line items drive the Visa side of the cost.
| Cost item | Structure |
| Registration fee | $950 initially and $950 annually thereafter, generally for each acquirer or provider the merchant registers under, raised from $500 |
| Transaction fee | $0.10 per transaction |
| Volume fee | 0.10% of processed volume, which is ten basis points |
| Non-compliance assessment | Visa’s rules provide for a $25,000 assessment per impacted merchant when an acquirer alters merchant details such as name, MCC, or merchant data to dodge VIRP registration |
The registration fee catches people twice. It is not a one-time cost. It repeats every year, and it repeats per provider. A merchant registered under two acquirers carries two registration fees, not one. Consolidating providers is one of the few levers that reduces this line directly.
Visa Is Only Half the Bill: Total Card-Brand Registration Cost
Most coverage of VIRP treats Visa in isolation. Merchants do not pay in isolation. If your business needs card-brand registration in the United States, you are almost certainly registering with both networks.
As of July 28, 2026:
| Network | Program | Annual cost per merchant |
| Visa | Integrity Risk Program (VIRP) | $950 initially, then $950 annually, generally per acquirer or provider registered under |
| Mastercard | Specialty Merchant Registration | $1,000 annually, raised from $500 effective May 1, 2026 |
| Combined | Visa + Mastercard | $1,950 per merchant, per year |
That $1,950 is the floor, not the ceiling. It excludes:
- Any acquirer or processor markup layered on top
- The newer transaction and volume-based integrity fees on both networks
- Your own compliance spends on monitoring, age verification, and record keeping
Mastercard also added a separate annual license fee that acquirers must carry to keep registering specialty merchants, reported at $50,000 per year. Merchants do not pay that directly. They feel it, because acquirers spread that cost across the specialty merchants they board. If your provider suddenly got pickier about which high-risk accounts it accepts, this is part of the reason.
Card brand fees are not the whole picture, though. Acquirers absorb real compliance cost under VIRP, and a portion of that reaches merchants through pricing and tighter terms. Budget for the direct fees and for the operational spend on monitoring tools, age verification, and record keeping.
One more thing worth noting. The $25,000 figure exists because MCC manipulation is a known tactic. Miscoding a business to look lower risk is not a workaround. It is the single fastest way to turn a manageable registration into an enforcement matter.
The 2026 Control Requirements That Catch Merchants Off Guard
Registration is the entry ticket. The controls are what keeps you in the program. VIRP-eligible businesses must run these where they apply:
- Real-time transaction monitoring. You need to spot suspicious charges as they happen, not in a monthly report.
- Age verification. Any business selling age-restricted goods or services must verify buyer age. This hits tobacco, adult, and online gaming merchants hardest.
- Content moderation. Platforms hosting user-generated content must moderate what appears on them. Visa holds you responsible for what your users post and sell.
- Member authentication standards. Subscription, membership, and recurring billing businesses need strong authentication at signup to block fraudulent enrollments.
Card networks moved from suggestions to mandate merchant monitoring more broadly. Mastercard’s parallel framework now requires a content or transaction laundering scan before a merchant onboarded on or after January 1, 2026, processes its first transaction, and it extends monitoring to members-only and password-protected areas of a merchant website. Visa’s VIRP obligations run alongside those requirements, so a business in both networks faces two sets of expectations at once.
The practical takeaway is simple. Surface-level compliance no longer passes. If your gated content, your second storefront, or your affiliate domain sells something your MCC does not cover, a scan will find it.
How VIRP Changed Onboarding for High-Risk Merchants
Merchants used to open a high-risk account in days. That timeline stretched. Here is what changed and why.
- Documentation grew. Acquirers now request details on your operations, your products, your internal risk controls, your fraud prevention stack, and your compliance infrastructure. A one-page application will not clear underwriting.
- Approval takes longer. Control assessments and information disclosures add weeks in many cases. Plan your launch calendar around that, not around the old timeline.
- Due diligence deepened at every tier. Even Tier 3 merchants sit through more review than a standard retail account.
- Monitoring never stops. Tier 1 and Tier 2 merchants face annual reassessments. Visa reserves the right to audit Tier 3 merchants whenever it chooses.
None of these makes high-risk processing impossible. It makes preparation the difference between a two-week approval and a two-month one.
A Seven-Step VIRP Readiness Framework
Work through these in order. Each step produces a document or a control you can show when someone asks.
- Confirm your MCC and your tier. Pull your acquiring bank paperwork. Match the code to Visa’s tier structure. Write down which tier you land in and why.
- Audit your full web presence. List every domain, subdomain, landing page, and gated area tied to your business. Check each one against what your MCC covers. Fix mismatches before an outside scan finds them.
- Install the required controls. Real-time transaction monitoring, age verification, content moderation, and member authentication, depending on what you sell.
- Build a records system. Visa expects reporting on customer interactions and transaction data. Timestamps, scan records, and remediation notes belong in one retrievable place, not in someone’s inbox.
- Write an escalation policy. Name who reviews a flag, who decides, and how fast. A named owner beats a general policy every time.
- Train your staff. Employees need to recognize compliance risk and know the reporting path. Refresh the training as the program evolves.
- Report problems fast. Tell your payment provider the moment you spot suspicious transaction patterns or questionable activity on your platform. Moving early demonstrates active risk management, which factors into how Visa views the case.
Pros and Cons of the Visa Integrity Risk Program
Most coverage treats VIRP as a burden. That is only half true.
| Upside for merchants | Downside for merchants |
| Clearer rules than the old brand risk model, so you know where you stand | Higher registration, transaction, and volume costs |
| Controls that cut fraud also cut chargebacks, and the average U.S. chargeback carries a transaction value near $110 per Mastercard data | Longer approval timelines |
| Compliant merchants gain stable, long-term network access | Heavier documentation and record keeping |
| Fewer bad actors in your vertical means less collateral scrutiny | Tier classifications can change without much warning |
| A documented control program strengthens your position in any review | Tighter terms of service from providers |
What This Means If You Sell Merchant Services
Agents and ISOs feel VIRP from a different angle. Every merchant you place in a listed category carries registration obligations, control expectations, and documentation your acquirer will ask about. A deal that looks simple becomes a compliance conversation.
The agents who do well under VIRP do three things. They screen the vertical before they write the application. Additionally, they set the merchant’s expectations on a timeline and cost up front. They partner with a group that already knows the registration path for that category.
AllayPay is a registered ISO but also is able to place high-risk merchant accounts across multiple acquiring banks based on what each bank actually approves. That flexibility matters under VIRP, because a Tier 1 merchant that one bank declines may be a straightforward approval somewhere else. Our team has spent years placing businesses in the categories Visa watches most closely, and we partner with other agents who need a home for accounts their current processor will not take.
Where the Visa Integrity Risk Program Is Heading
Visa treats VIRP as a living framework rather than a fixed rulebook. The categories it monitors shift as abuse patterns shift, and the control expectations have tightened each year since launch.
Two directions look likely based on the pattern so far, though Visa hasn’t confirmed. First, monitoring expectations keep moving toward continuous rather than periodic review. Second, the evidence standard keeps rising, meaning acquirers and merchants need to show what they checked and when, not just state that they check.
The businesses that will handle the next round of changes well are the ones that build documentation habits now, while the requirements are known.
VIRP Compliance for High-Risk Industries
The Visa Integrity Risk Program raised the cost and effort of accepting cards online. It also gave compliant merchants something the old system did not: a defined path to stable network access. Know your MCC. Know your tier. Run the required controls. Document what you do.
If you are not sure where your business lands, or your current provider cannot answer tier questions clearly, that is a signal worth acting on. Talk to a payment processing team that works in these categories every day and can tell you what your registration path looks like before you apply.
Ready to find out where your business stands under VIRP? Contact us today for a straight answer on your tier, your registration requirements, and your options across multiple acquiring banks.
Frequently Asked Questions About the Visa Integrity Risk Program
What is the Visa Integrity Risk Program?
The Visa Integrity Risk Program, or VIRP, is Visa’s compliance framework for merchants in categories that are legal but carry a higher chance of illegal activity without proper controls. It launched May 1, 2023, and replaced the Global Brand Protection Program. VIRP requires registration, sorts merchants into three risk tiers, and holds acquiring banks accountable for the merchants they board.
Who has to register for VIRP?
It comes down to whether your Merchant Category Code is on Visa’s list of high-risk categories or not. If your code is on the list, you register. If your code is not on the list, you do not register with VIRP. This stays true even when your processor calls your account high-risk and holds a reserve.
How you sell matters too. Some categories only require VIRP registration for online and phone orders, and not for in-person sales. Not sure about your code? Check the paperwork from your acquiring bank or ask your provider if your code is on the list.
How much does the Visa Integrity Risk Program cost?
As of the April 1, 2024, pricing update, VIRP carries a $950 registration fee per provider per acquirer, up from $500. It also adds a $0.10 per transaction fee and a volume fee of 0.10% of processed volume. Visa’s rules also provide for a $25,000 assessment per impacted merchant when merchant details are altered to avoid registration.
What is the total card-brand registration cost for a US high-risk merchant?
As of July 28, 2026, a merchant registered with both networks pays roughly $1,950 per merchant, per year. That breaks down as $950 annually for Visa VIRP, generally per acquirer or provider registered under, and $1,000 annually for Mastercard Specialty Merchant Registration. Mastercard raised its side from $500 effective May 1, 2026. The $1,950 excludes acquirer or processor markup and the newer transaction and volume-based integrity fees on both networks.
Does being a high-risk merchant automatically mean I have to register with Visa and Mastercard?
No. High risk is how a processor describes your pricing and underwriting profile. Registration has a narrower trigger: your business must fall within a listed Visa VIRP category or a listed Mastercard Specialty Merchant category.
Here is an example. A travel agency charges customers months before a trip. That worries banks, so the agency gets high-risk pricing and a rolling reserve. But travel is not on either network’s list. So, the travel agency doesn’t have to register with either one.
Did Mastercard raise its high-risk registration fee in 2026?
Yes. The annual Specialty Merchant Registration fee doubled from $500 to $1,000 per merchant, effective May 1, 2026. Mastercard also introduced additional transaction and volume-based fees on specialty categories, and a separate annual license fee that acquirers must carry to keep registering specialty merchants. Merchants do not pay the license fee directly, but acquirers spread that cost across the specialty accounts they board.
What are the three VIRP tiers?
Tier 1 covers the highest risk categories such as adult content, gambling, online pharmacies, and dating, and requires a control assessment for each MCC.
VIRP Tier 2 covers cryptocurrency, cyberlockers, and skill-based gaming, and requires a control assessment at the tier level.
Finally, Tier 3 covers moderate risk categories such as telemarketing, tobacco, and subscription businesses, where assessments are not required by default, but Visa can request one.
What is the difference between VIRP and VAMP?
The Visa Integrity Risk Program looks at what a merchant sells and whether prohibited activity is present. A single merchant can open a case. VAMP, the Visa Acquirer Monitoring Program, looks at fraud and dispute ratios across a portfolio and triggers when those ratios cross a threshold. A business can be compliant under one and in trouble under the other.
How does VIRP differ from the old GBPP?
GBPP sorted merchants into broad brand risk buckets and applied basic monitoring. VIRP introduced the three-tier structure, periodic control assessments, higher fees, and specific control requirements such as age verification, real-time transaction monitoring, and content moderation. The standard is meaningfully stricter.
What happens if my business does not comply with VIRP?
Non-compliance can lead to fines and to the closure or termination of your merchant account. Because the program holds acquirers responsible, providers move quickly when Visa raises a concern. Losing access to the Visa network effectively ends card acceptance for most businesses.
Does the Visa Integrity Risk Program apply to existing merchants or only new ones?
It applies to both. Merchants previously registered under GBPP now fall under the VIRP framework, including its control assessments and registration fees. Tier classifications can also change over time, so an existing merchant can move into a stricter tier without changing anything about its own business.
What controls does VIRP require in 2026?
Where applicable, VIRP-eligible merchants must run real-time transaction monitoring, age verification for age-restricted products, content moderation for platforms hosting user-generated content, and member authentication standards for subscription and recurring billing models.
Why is my high-risk application taking so long under VIRP?
Acquirers must complete enhanced due diligence and, for Tier 1 and Tier 2, control assessments before boarding. The documentation covers your operations, products, risk controls, fraud tools, and compliance infrastructure. That review adds weeks compared with a standard low-risk account.
What should I do if my business is placed under a VIRP review?
Contact your payment provider immediately. A provider with high-risk categories can walk you through the review, help assemble documentation, and respond on your behalf. Waiting or ignoring the notice raises the odds of losing network access.
Can I change my MCC to avoid VIRP registration?
No. Visa’s rules provide for a $25,000 non-compliance assessment per impacted merchant when an acquirer changes merchant details such as name, MCC, or merchant data to avoid VIRP registration. Correct classification is the safer and cheaper path.
