Who Keeps a High-Risk Merchant List

There is no single official high-risk merchant list. Card networks, banks and regulators each keep their own, and here is what each one does.

Oct 11, 2026

You have been told your business is high-risk. That label did not come from one place. There is no single official high-risk merchant list. Several parties each keep their own, and each one uses it for its own purpose. Knowing who wrote which list tells you what happens next.

What the label means

High-risk is a label, not one list. It is a judgment about the chance of disputes, fraud or money moving through your account in a way a bank cannot explain. The label comes from the card networks, from the banks and processors that sign merchants, and from bank regulators. Each party has its own list, its own rules and its own reason for keeping score.

Who keeps a list

Three groups decide whether your business type shows up somewhere.

Card networks. Visa and Mastercard sort merchant types into risk groups and make rules for them. Visa's guide says it classifies some merchant types as high-brand risk when they take card-absent payments, because they bring more disputes or brand risk. Mastercard runs a Specialty Merchant Registration Program. It covers merchant types Mastercard names.

Acquirers and processors. These are the companies that sign you and move your money. Visa's standards say acquirers must establish a risk-based onboarding policy that segments merchants into risk categories. That policy is the acquirer's list.

Bank regulators. FinCEN and the FDIC tell banks what to watch. FinCEN's advisory says third-party payment processors are financial institution customers that provide payment processing services to merchants and other businesses. FDIC guidance says payment processors pose greater money laundering and fraud risk if they cannot effectively verify their merchant clients' identities and business practices. This is why banks watch payment processors so closely.

The regulator view

FinCEN's advisory says payment processors serving telemarketing and Internet merchants may present a higher risk profile to a financial institution than other businesses. It also says processors now serve many merchants at home and abroad, including Internet gaming firms. So a processor that serves phone or online sellers may look riskier to its bank. If you sell by phone, read about billing authorization.

Mastercard's registration categories

Mastercard's manual has a chapter on the Specialty Merchant Registration Program. Under it, an acquirer must register a merchant with Mastercard before it can process certain transactions. The merchant types Mastercard names include:

Adult content and services when the buyer is not present in person
Pharmacy or tobacco sales when the buyer is not present in person
Non-face-to-face gambling
Lottery ticket sales when the buyer is not present in person, even by a licensed online agent
Securities transactions
Cryptocurrency merchants
High-risk cyberlocker merchants with MCC 4816
High-risk securities merchants with MCC 6211

Mastercard also requires an acquirer to use MCC 5968 and TCC T to flag all non-face-to-face negative option billing transactions. The acquirer handles registration, but it must happen before your sales run.

Visa's two risk groups

Visa sorts risky merchants in its own way. Its guide says acquirers must get a High-Brand Risk Acquirer Registration from Visa before they can sign a high-brand risk merchant. Visa's Integrity Risk Program also sorts High Integrity Risk Merchants into three tiers. Each tier has its own due diligence checks. Visa's program says acquirers must be granted High Integrity Risk Acquirer Registration before soliciting, contracting with, or processing for any High Integrity Risk Merchant. Visa's standards say these merchants may need extra due diligence to check they follow the program's rules.

The two groups are not the same. Each network wrote its own rules, so check with your acquirer about which one applies to your business.

Your MCC puts you in a bucket

Visa's standards say acquirers assign the MCC that most accurately describes a merchant outlet's business. That code is how the networks and the acquirer sort you. It decides which rules attach to your account. This is why the code must match what you actually sell. Visa's standards say acquirers collect and verify extra items for e-commerce merchants. They include each URL the merchant uses. So your website should show what you really sell.

What acquirers check first

Before signing you, an acquirer runs through its own checks. Visa's standards say acquirers must check the Terminated Merchant File before finalizing a contract with a prospective merchant. That file is the record of merchants other acquirers have ended. Visa's standards also say past terminations, excess chargebacks, fraud or illegal activity can affect the underwriting decision. So your past can affect a new application.

Mastercard's manual says an acquirer must run MATCH checks under the proper ICA Number.

Why misrepresenting the business backfires

It can be tempting to describe your business as something safer to dodge the label. Visa's guide says businesses declined or terminated may misrepresent information on merchant applications to obtain payment services. The networks plan for this. Describe the business as it is and let the acquirer place it in the right bucket.

What to do next

Some products on these lists carry legal questions. Whether your product is legal where you sell it is a question for a lawyer. Check with a lawyer about your product's status, and tell the processor plainly what you sell. It means an acquirer will run the checks above first.