High Risk Merchant Handbook

What High Risk MCC Codes Mean for You

High risk MCC codes are not a banned list. They are the codes Visa and Mastercard attach extra rules to, and here is what that means for you.

High risk MCC codes get talked about as if someone published a banned list. What makes a code "high risk" is the extra rules a card network attaches to it. If your business sits in one of those codes, the network's rules apply to your acquirer.

What a high risk MCC actually is

A merchant category code, or MCC, is a four digit label that describes what a business sells. Networks use it to sort merchants and to decide which of their own rules apply to you.

Instead, each network names business types it worries about and writes rules for them. Some of those rules name a code. Others name a business type and let the acquirer figure out the code.

So when people ask which MCC codes the networks treat as high risk, the honest answer is: the ones with extra network rules attached. Those rules are public, and this article walks through the main ones.

Who assigns an MCC and where the codes come from

Your acquirer assigns your MCC. Visa's standards say acquirers assign the MCC that most accurately describes a merchant outlet's business. Visa's manual says its MCCs and descriptions come from SIC Codes and ISO Codes.

The code follows the business, not the other way around. If you sell two very different things from one place, that matters. Visa's standards say acquirers assign 2 or more MCCs to a merchant outlet when separate lines of business are located there.

Can your MCC be wrong? Yes. A processor can pick a code that fits poorly, or your business can shift over time until the old code no longer fits. The networks tell acquirers to watch for this, which is the next problem.

Codes the networks single out

The two networks each have their own programs, and their rules are theirs alone. A Visa rule binds Visa acquirers. A Mastercard rule binds Mastercard acquirers. Never assume one network's rule applies to the other.

Mastercard's named codes

Mastercard requires some merchants to register. It also says how some sales must be coded. Its rules name these:

  • Mastercard requires high-risk cyberlocker merchants with MCC 4816 to register.
  • Mastercard requires high-risk securities merchants with MCC 6211 to register.
  • Mastercard's rules say an acquirer must register a merchant with Mastercard before acquiring non-face-to-face pharmaceutical or tobacco transactions.
  • Mastercard's manual says an acquirer must identify non-face-to-face adult content transactions using MCC 5967 with TCC T, or MCC 7841 with TCC T.

Mastercard's manual also covers crypto and negative option billing. It says an Acquirer must identify all Cryptocurrency Transactions using MCC 6051, TCC U, and a Transaction Type Identifier value of P70. And it says an Acquirer must use MCC 5968 and TCC T to identify all non-face-to-face negative option billing Transactions.

Registration is not free for the acquirer. Mastercard's manual says it assesses the Acquirer an annual USD 500 registration fee for each Merchant and Sponsored Merchant under the listed categories.

Visa's high-brand and high-integrity risk types

Visa sorts its risky merchants into two groups.

Visa's guide says it classifies some merchant types as high-brand risk when they take card-absent payments, because they bring more disputes or brand risk. Visa's guide says acquirers must get a High-Brand Risk Acquirer Registration from Visa before contracting with a high-brand risk merchant.

Visa's program says acquirers must be granted High Integrity Risk Acquirer Registration before soliciting, contracting with, or processing for any High Integrity Risk Merchant. Visa's standards say high integrity risk merchants may need extra due diligence to check compliance with the VIRP requirements.

Visa's rules also reach specific codes. They say adult content purchases under MCC 5967 require the merchant to meet all requirements in the Visa Integrity Risk Program Guide. And Visa's manual says a transaction on behalf of another high-risk merchant must use that merchant's MCC, such as 7995 for loading a gambling wallet.

Why these codes draw extra scrutiny

One common thread is card-absent sales. You type a card number instead of swiping a card. Visa's guide says some of these merchant types bring more disputes or brand risk.

The second thread is brand risk. Visa's guide uses the term high-brand risk for these types.

None of this means a high risk MCC blocks you from a merchant account. It means the network may want the acquirer to register or code your sales a set way.

MCC mismatches and miscoding

Both networks tell acquirers to watch for merchants whose paperwork does not match their code.

Visa's standards say acquirers must review a merchant's business activity when issuer documents show it does not match the assigned MCC. Visa's standards also say acquirers monitor for mismatches in merchant identifiers such as merchant names and MCC.

Mastercard recommends that acquirers monitor mismatches of merchant name, MCC, merchant ID, and terminal ID. Its manual goes further for online sellers. It says acquirers should check for products unrelated to the merchant's business or MCC when screening e-commerce merchants.

Do not pick a friendlier code on purpose. A code that hides what you sell is miscoding, and both networks tell acquirers to look for it. If your real code carries registration rules, the honest path is to meet them. To see how a processor's bank fits in, read why banks watch payment processors.

What to expect from underwriting

Visa's standards say acquirers must establish a risk-based onboarding policy that segments merchants into risk categories. So your acquirer puts you in a risk group when you sign up.

If your code carries registration rules, your acquirer has to register you with the network before processing. Ask your acquirer what that step needs from you. Expect questions about what you sell.

If you sell by phone, read about billing authorization.

How to prepare before you apply

Know your true business type before you fill anything out. If you run two lines of business from one outlet, say so. The acquirer may need to assign more than one MCC.

Be ready to explain your sales channel. Many of these rules name card-absent sales.

Check the network rules for your category yourself. Both networks publish their manuals. Read the sections that name your business type, and bring what they ask for to your application.

Ask your processor which MCC it plans to assign you, and check that it matches what you actually sell. A wrong code that you let stand is a problem you chose. Fix it before processing starts, not after.

Sources