High Risk Merchant Handbook

Visa High Integrity Risk Merchants

Visa's Integrity Risk Program sets tiers, registration and due diligence rules for high integrity risk merchants. Here is what Visa's own standards say.

Visa sorts some merchant types into a group it calls High Integrity Risk Merchants. The label sits in Visa's own rules, and it changes what your acquirer must do before it can sign you or run your sales. Here is what Visa's published standards say about the program and where your business fits in it.

What "high integrity risk" means in Visa's standards

Visa's risk standards name two integrity risks. One is skipping the sign-up steps for high-integrity risk processing. The other is running illegal sales. Visa wants to keep illegal sales out of the Visa system.

Visa's standards say the Integrity Risk Program spells out which merchants and sales it covers. It then sets detailed rules for them. The goal, in Visa's words, is to deter illegal transactions from entering the Visa Payment System.

The Visa Integrity Risk Program and what replaced it

The program's full name is the Visa Integrity Risk Program, or VIRP. Visa's document says the VIRP replaces the Global Brand Protection Program. If you have read the older program's name in an old contract or an old article, the VIRP is its successor.

Visa says the VIRP makes sure acquirers and their agents keep good controls in place. Those controls aim to keep out illegal sales.

The three tiers of High Integrity Risk Merchants

Visa's program sorts these merchants into three tiers. Each tier carries its own due diligence requirements.

For acquirers, the tiers work like this:

  • Tier 1: an acquirer needs Visa's approval for each Tier 1 category. It must ask for this on top of its base registration.
  • Tier 2: an acquirer must pass a first review of its controls for Tier 2 business types.
  • Tier 3: an acquirer must register with Visa to process Tier 3 business types. Approval for Tier 3 covers Tier 3 categories only.

So an acquirer cleared for Tier 3 is cleared for Tier 3 only. What an acquirer may do depends on your tier.

Visa says it will review the label from time to time and update the program's rules.

What acquirers must do: registration and approval steps

Visa's program says an acquirer must register with Visa first. Only then may it seek out, sign or process for a High Integrity Risk Merchant. That is a hard order.

To sign up, an acquirer must follow all of Visa's rules. Acquirers must also be in good standing in all Visa risk management programs.

There is one more step before approval. An acquirer applying for registration must promise Visa one thing first. No sales from VIRP merchants will enter the Visa system before approval.

Due diligence and attestation requirements

Registration is only the start. Visa's standards require acquirers to establish enhanced due diligence processes for all High Integrity Risk Merchants under the VIRP. Visa's program says the acquirer must do these checks and attest to them before it signs a merchant in this group.

Visa's standards also set control rules. They apply to acquirers and their agents who process sales for these merchants. And Visa's standards say these merchants may need extra checks to make sure they follow the VIRP.

For a merchant owner, this means more checks before you are signed. Visa's program says the acquirer must attest to those checks.

Payment facilitators and third-party agents under the VIRP

The VIRP reaches beyond direct acquirers. Visa's rules include a section on High-Integrity Risk Payment Facilitator Requirements. Visa's rules say a PayFac in this group must register with Visa.

Third-party agents are covered too. An acquirer that hires agents to sign High Integrity Risk Merchants must register those agents. The acquirer must also attest that it checked the agent, as GARS lays out.

So if you reach Visa through an agent or a PayFac, the same program covers them. Visa's rules say they must be registered too.

MCC coding and how Visa reads the transaction

Visa's manual says a transaction made on behalf of another high-risk merchant must use that merchant's MCC. Visa gives one example: loading a gambling wallet must use MCC 7995.

Visa's rules also say adult content sales under MCC 5967 must meet all of the VIRP Guide's rules.

Non-compliance and what Visa's rules say about it

Visa's rules include a section on High-Risk/High-Integrity Risk Acquirer Non-Compliance Assessments. Visa's rules also say breaking the VIRP is a reason for prohibition. That includes illegal sales or sales that hurt the Visa brand.

Visa's standards warn that weak controls here could lead to losses, harm to a good name and broken laws. That risk sits above your merchant account, which is why banks watch payment processors so closely.

Visa's standards also list a VIRP scorecard item. It checks that no case comes up for illegal or miscoded sales. Acquirers are measured on it.

What this means for a merchant owner

If your business type falls in the VIRP's scope, three things follow from Visa's own rules.

First, your acquirer must hold the right registration for your tier and category. Until then it cannot even ask for your business.

Second, expect extra checks before you sign up. The acquirer must vouch for those checks to Visa.

Third, your MCC must be right. A sale with the wrong MCC is a miscoded sale. Visa's scorecard checks for those.

None of this tells you whether your application will succeed. Visa's rules set what acquirers must do, and each acquirer applies them. If you sell by phone, other rules on billing authorization apply to you too. Ask your processor early which tier you are in. Then ask if it is registered for that tier.

Sources