High Risk Merchant Handbook

What Makes a Business High Risk

High risk is not a label you earn alone. Banks, acquirers and card networks judge it from your product, your sales method and your owners.

No business calls itself high risk. Someone else does. A bank, an acquirer or a card network looks at what you sell, how you sell it and who owns the company. Then it makes a call. That call is what makes a business high risk, and it follows rules you can read.

What high risk means, and who says it

The label comes from the payment chain above you. Your acquirer is the bank-side firm that signs you and takes you on. Visa's standards say acquirers must establish a risk-based onboarding policy that segments merchants into risk categories. They must also build a risk-based underwriting process for new merchants.

So the acquirer sorts you into a bucket before you take your first card. The bucket is not a punishment. It is the acquirer managing its own risk. To learn more, read why banks watch payment processors.

The product or service itself

Some of the judgment is fixed by what you sell. Visa's guide says it classifies some merchant types as high-brand risk when they take card-absent payments, because they bring more disputes or brand risk.

Legality can shift by region. Visa's guide says certain goods or services may be legal in one region but illegal in another. Check with a lawyer and your processor about where you can sell.

Counterfeit goods are a named concern. Visa's guide says counterfeit goods span industries including media, apparel, accessories, electronics, pharmaceuticals, and medical devices. Visa's guide also names what illicit businesses hide through transaction laundering. It lists illegal gambling, fake online pharmacies, illegal drugs and counterfeit goods.

Some products are barred outright. Visa's guide says payments involving the sale of illegal narcotics, recreational drugs, or designer drugs are strictly prohibited from entering the Visa payment system. That is Visa's rule for its own system.

How the sale happens

Card-absent sales are sales where the card is not there at the till: online, by phone, by mail. Visa's guide ties the high-brand risk label to merchants that take these payments. Visa's label covers only some merchant types that sell this way.

Visa's standards say acquirers collect and verify additional elements for e-Commerce merchants, including a listing of URLs the merchant uses. Acquirers must also check that the merchant really owns its domains and websites.

Phone sellers have more to read. See billing authorization for phone sales.

The business's history

Visa's standards say a merchant's history of terminations, excessive chargebacks, fraud or illegal activity can affect the underwriting decision. Past terminations matter. So do chargeback levels and any fraud on record.

Visa's guide also warns of a pattern. Visa's guide warns that a merchant turned down or let go may put false information on a new application to obtain payment services. Do not do this.

The people behind the business

Underwriting checks who you are. Visa's standards say underwriting must include verifying a seller's name, address, email, phone number, business registration and documents. Acquirers must conduct fraud checks when onboarding a merchant.

The checks go further. Visa's standards say acquirers must carry out ongoing AML due diligence including sanction, politically exposed persons and derogatory media screening. Visa says acquirers checking a merchant's credit should pull financial and credit reports from outside firms. They should also use enhanced due diligence.

The reason reaches above the acquirer. FinCEN's advisory says criminals can use payment processors to mask illegal or suspicious transactions and launder proceeds of crime. FDIC guidance says payment processors pose greater money laundering and fraud risk if they cannot effectively verify their merchant clients' identities and business practices. So the people behind the business get screened, and the screening never fully stops.

Network programs that formalize the label

The networks do not leave high risk to each acquirer's judgment. They run their own programs.

Mastercard's manual says a merchant may be deemed in violation of Rule 5.11.7, the Illegal or Brand-damaging Transactions Rule. Mastercard's BRAM Program investigates merchants referred to Mastercard as potentially engaging in illegal or brand-damaging transactions. Those are Mastercard's rules for its own network.

Visa runs a program with tiers. Visa's program classifies High Integrity Risk Merchants into three tiers, each with its own due diligence requirements. Visa's Tier 1 covers businesses where potential illegal activity could cause significant harm to people's health, safety or wellbeing. Visa's Tier 2 covers businesses where potential illegal activity could cause financial or other economic harm to individuals.

The two ideas are worth telling apart. High-brand risk is about disputes and harm to the card brand. High integrity risk is about crime. Visa's guide says high-brand risk merchants need extra due diligence. Its integrity program sets its own checks for each tier.

What underwriting does with the profile

Once the acquirer has the picture, it decides. Visa's standards say an application decision can be approval, decline or conditional approval with exposure mitigation strategies such as reserves or holds.

The acquirer takes you but caps its own exposure. Visa's guide also says an acquirer may bar or limit more merchant types. So the list of barred types can differ by acquirer.

One limit matters. Visa's guide says merchants should be underwritten on their merits, and reserves are not a reason to onboard unreasonably high-risk merchants. A reserve does not make a bad merchant safe to sign.

What you can and cannot change

Some of your risk profile is fixed. Your industry, your product and where you sell it set a floor.

The rest is yours. You control your chargeback level. You control how honest your application is, who owns your domains, and how well your sales scripts follow the rules. You cannot talk an acquirer out of its network's programs, but you can hand it a clean file.

Visa's guide says facilitating transactions for illegal pharmacies could expose participants to litigation, prosecution, and financial risk. Stay away from that edge, and keep your history clean.

Sources