> [!FOUNDER]
> "Every merchant I have watched lose processing lost it the same way: they managed their chargeback rate and ignored their fraud-report rate, because those lived in two different reports. VAMP ended that separation. Your issuer-reported fraud and your customer disputes are now one number, judged monthly, and the acquirer holding your account is judged on the same number across its whole portfolio. Manage one ratio and you are managing half the risk." — Enow A. Jovial, Founder & Chief Executive Officer
What VAMP replaced, and why the merger matters
Visa launched the Visa Acquirer Monitoring Program (VAMP) in an advisory period on April 1, 2025, with enforcement beginning October 1, 2025. It replaced two legacy programs: the Visa Dispute Monitoring Program (VDMP), which watched chargebacks, and the Visa Fraud Monitoring Program (VFMP), which watched fraud. Sift’s program summary counts six existing programs and 38 remediation processes folded into one ratio.
The merger is the whole story. Under VDMP, a merchant could run a clean dispute rate while issuer fraud reports piled up elsewhere, and under VFMP the reverse. Under VAMP, both streams feed one numerator. A merchant whose customers rarely dispute but whose cards are heavily fraud-reported is now visible in the same metric as a merchant drowning in friendly fraud. And because the program is an acquirer program, the acquirer’s portfolio ratio is the sum of its merchants: an acquirer under pressure will tighten, reprice, or terminate its worst merchants long before Visa formally flags them, because its own standing depends on it.
Scope first, because scope decides whether any of this applies to you. VAMP covers card-not-present (CNP) transactions. Sift’s guidance describes a minimum monthly threshold of 1,000 disputes or fraudulent transactions; acquirer guidance published through September 2026 describes enrollment as requiring at least 1,500 combined fraud reports and disputes in the month. The two floors come from different vintages of guidance, and the direction is consistent: Visa does not chase small merchants on this program, but the floor is a count floor, not a mercy rule. Cross it, and the ratio decides everything.
The ratio, stated exactly
$
ext{VAMP Ratio} = rac{ ext{TC40 Fraud Reports} + ext{TC15 Disputes}}{ ext{Settled Visa Transactions (same month, CNP)}}
$
TC40 is Visa’s fraud-report record: issuer-reported fraud claims. TC15 is the dispute record, and under VAMP it now includes both fraud and non-fraud disputes, under condition codes 11, 12, and 13. The denominator is a count of settled transactions, not dollars. A $5 dispute and a $5,000 dispute carry equal weight against the ratio, which is why a low-ticket merchant with sloppy descriptors can trip a threshold faster than a high-ticket merchant with the same dollar losses.
> [!KEY TAKEAWAY]
> VAMP is a count ratio, not a dollar ratio, and it counts fraud reports plus disputes together. Control the count of events, not just the value of losses, and control it before authorization, because nothing after authorization removes a TC40 report from the numerator.
Three properties of the numerator catch merchants out. First, double counting: a single transaction that appears in both the TC40 and TC15 datasets counts twice, once in each stream. Second, timing: disputes arrive weeks after the sale that caused them, so a merchant’s worst month can be built by its best month’s volume. Third, asymmetry of remedies: most post-authorization tools change who pays, not what counts. Rapid Dispute Resolution (RDR) removes a case from TC15 but not from TC40, so it helps non-fraud disputes and does nothing for the fraud report underneath a fraud dispute. The Cardholder Dispute Resolution Network (CDRN), including Verifi and Ethoca alerts, can keep a case out of TC15 while the TC40 report remains. Compelling Evidence 3.0 (CE 3.0) is the exception that proves the rule: a chargeback successfully deflected through CE 3.0 stays out of the ratio, which is why evidence quality is a ratio defense, not just a revenue-recovery tactic. Our companion guide to chargeback defense engineering covers the alert and evidence mechanics in full.
The threshold history, including the revision most guides missed
This section exists because the published record contradicts itself, and the contradiction has a date on it. Read the dates, not just the numbers.
| Vintage | Merchant excessive line | Acquirer lines | Reported fee per event |
| :--- | :--- | :--- | :--- |
| October 2025 enforcement | 1.5% | Above standard 0.3% to 0.5%; excessive above 0.5% | $10 excessive; $5 above-standard acquirer |
| Early 2026 guidance (Sift, updated February 2026; Fingerprint, May 2025) | 0.9% from January 2026 | Same 0.3% / 0.5% structure | $10 excessive; $5 above-standard acquirer |
| Current, per acquirer guidance through September 2026 | 1.5% from April 1, 2026 (cut from 2.2%), plus 1,500 combined events | Above standard 0.5%; excessive 0.7% | $8 per fraud or dispute event |
| Authority | PayKings summary of acquirer program guidance; Sift and Fingerprint program guides | PayKings and Merchanto summaries of 2026 acquirer guidance | PayKings ($8, current); Sift and Fingerprint ($10, earlier vintage) |
The honest reading: the 0.9% merchant step that early 2026 guidance announced for January 2026 did not survive as the current line. Acquirer guidance published through September 2026 puts the merchant excessive threshold at 1.5%, cut from 2.2% on April 1, 2026, with the 1,500-event floor and an $8 per-event fee. The acquirer tiers moved too, from 0.3% / 0.5% to 0.5% / 0.7%. Visa revises this program by bulletin, and acquirer summaries disagree at the edges, so treat every figure here as the latest published schedule and confirm the live schedule with your acquirer in writing before deciding on a tenth of a percent. A guide quoting 0.9% without a date is not wrong about history; it is wrong about the present, and the present is what gets billed.
> [!WARNING]
> Once a merchant crosses the excessive line, the reported fee applies to every fraud or dispute event in the month, not just the events above the threshold, and it keeps applying every month the ratio stays over the line. At the current reported $8 per event, 2,000 events cost $16,000 in a month before any chargeback losses, representment costs, or acquirer pass-through markup. The fee is the smallest part of an excessive designation; termination is the largest.
Worked examples: the ratio, the floor, and the double count
Example A: the ratio that does not enroll. A merchant settles 12,000 CNP transactions in a month, with 90 TC40 reports and 110 TC15 disputes.
$
ext{VAMP Ratio} = rac{90 + 110}{12{,}000} = rac{200}{12{,}000} = 1.67%
$
1.67% exceeds the 1.5% merchant line, but the month holds only 200 combined events, far below the reported 1,500-event enrollment floor. On the current schedule this merchant is not enrolled on ratio alone. A small merchant can run a frightening ratio without triggering the program; a growing merchant can cross the floor without its ratio changing.
Example B: the month that bills. A merchant settles 120,000 CNP transactions, with 1,100 TC40 reports and 900 TC15 disputes.
$
ext{VAMP Ratio} = rac{1{,}100 + 900}{120{,}000} = rac{2{,}000}{120{,}000} = 1.67%
$
Same ratio as Example A, different outcome: 2,000 combined events clears the 1,500 floor, so the merchant is excessive, and the fee math is immediate.
$
ext{Monthly VAMP Fee} = 2{,}000 imes $8 = $16{,}000
$
At the earlier $10 schedule the same month would have cost $20,000, which is why the fee line in your model should carry its source date.
Example C: the double count. A merchant has 500 fraud transactions that each generate both a TC40 report and a TC15 dispute, plus 200 genuine non-fraud disputes, against 80,000 settled transactions.
$
ext{VAMP Ratio} = rac{500 + 500 + 200}{80{,}000} = rac{1{,}200}{80{,}000} = 1.50%
$
Exactly at the line, built from only 700 real problem transactions. Every fraud event that double-reports contributes two to the numerator, so a fraud problem that looks like 0.88% of volume (700 / 80,000) presents as 1.50%. Reconcile TC40 and TC15 as one combined ledger, deduplicated for analysis but summed for the ratio, exactly as Visa sums them.
The enumeration ratio: the second tripwire
VAMP’s second metric has nothing to do with disputes. The enumeration ratio measures card testing: fraudsters running stolen card numbers through a checkout to see which ones approve.
$
ext{Enumeration Ratio} = rac{ ext{Confirmed Enumerated Transactions}}{ ext{Settled Transactions}}
$
An enumeration ratio at or above 20% is excessive. Sift’s guidance adds a high absolute volume condition, stated as over 300,000 enumerated transactions, alongside the 20% ratio. Enumeration counts approved and declined attempts alike, so declining the test transactions does not save the ratio. The only defense is keeping the testing traffic off the checkout: velocity controls, bot detection, device intelligence, and CAPTCHA-style friction on high-risk patterns, applied before authorization. A merchant that discovers enumeration from its VAMP report has already paid for it; enumeration belongs as an alert in the fraud stack, not a line in a monthly notice.
VAMP versus Mastercard: two programs, two different maths
A merchant that accepts both networks is scored twice, under formulas that share nothing but the word ratio. Treating them as one number is the fastest way to be blindsided.
| Attribute | Visa VAMP (current schedule) | Mastercard Excessive Chargeback Program | Authority |
| :--- | :--- | :--- | :--- |
| Numerator | TC40 fraud reports + TC15 disputes (fraud and non-fraud) | First-presentment chargebacks only | Visa program guidance; Mastercard acquirer guidance |
| Denominator | Settled transactions, same month | Sales transactions, previous month | Visa program guidance; Mastercard acquirer guidance |
| Merchant excessive line | 1.5% plus 1,500 combined events | ECM: 100 to 299 chargebacks and 1.50% to 2.99%; HECM: 300+ and 3.00%+ | PayKings acquirer-guidance summary, September 2026 |
| Fee shape | Per event, reported $8 currently | Monthly assessment escalating by program month ($1,000 in month 2, rising to $100,000 ECM / $200,000 HECM by month 19) | PayKings acquirer-guidance summary |
| Exit | Below the line, then acquirer remediation | Three consecutive months below ECM thresholds; one bad month resets the count | Mastercard acquirer guidance |
| Distinct trap | Double counting and enumeration | Previous-month denominator: falling volume inflates the ratio while disputes from the busier month still arrive | Sift; PayKings worked example |
The Mastercard denominator deserves its own warning, because it punishes decline. Mastercard divides current-month chargebacks by previous-month sales, so a merchant whose volume falls from 12,000 sales to 8,000 still answers for the disputes generated by the bigger month. Track both monthly from your own transaction data, never from a processor dashboard that blends them into one reassuring percentage.
Who this is for, and who should not rely on it
This playbook is for card-not-present merchants with material Visa volume, high-risk verticals, B2B subscription and SaaS trial businesses, and any merchant whose acquirer has already mentioned ratios in a pricing conversation. It is also for the acquirer-facing operator: the person who has to answer, in writing, why the portfolio ratio moved.
It is not a substitute for acquirer counsel. Visa’s schedules change by bulletin, regional variations exist (Fingerprint notes higher percentage allowances with lower volume thresholds in the Middle East and North Africa, and Europe and Asia-Pacific merchants avoiding a fine on transactions they did not directly approve), and your merchant agreement can impose stricter ratios than the network’s. Nothing in this article overrides a signed agreement. If your acquirer’s schedule differs from the figures here, your acquirer’s schedule governs your account, and the discrepancy itself is worth a written question, because it may mean your acquirer is passing through an older schedule.
The defense playbook, in order
1. Build one combined ledger. TC40 and TC15 from your acquirer dispute-reporting API feeds, monthly, with the double-counted transactions flagged, not deduplicated away. If you cannot produce your VAMP ratio from your own data within a day of month-end, you are flying on your acquirer’s timetable.
2. Forecast the floor, not just the ratio. Model the month your combined events cross 1,500 at current growth, and the month your ratio crosses 1.5% at current dispute rates. The earlier of the two is your real deadline.
3. Deflect before presentment. CE 3.0 evidence on friendly fraud, pre-dispute alerts through Verifi and Ethoca, and RDR or CDRN settlement for non-fraud disputes. Each deflected case is one fewer event in the numerator, which is the only direction the ratio moves within the current month. The evidence mechanics are covered in our chargeback defense engineering guide and our representment evidence guide.
4. Stop fraud before authorization. Device intelligence, velocity rules, and bot controls on the checkout, because a TC40 report is created at authorization and no post-authorization tool removes it. 3-D Secure (3DS) helps liability, not the ratio; budget it as liability protection, not ratio protection.
5. Fix the boring dispute causes first. Billing descriptor clarity, cancellation paths that work without a phone call, and refunds issued before the customer calls the bank. A large share of non-fraud disputes are customer-service failures with a network fee attached.
6. Watch enumeration as its own alert. Card-testing spikes, approval-rate collapses, and repeated small authorizations from one device or network should page someone the same day, not appear in a monthly report.
7. Get the schedule in writing, every quarter. Ask your acquirer for the current VAMP merchant and acquirer thresholds, the fee per event, and the enrollment floors that apply to your MID, and keep the dated answer with your compliance file. When the schedule moves again, and it will, the dated answer is what proves which forecast was reasonable.
Execution checklist
> [!TIP]
> Run the VAMP calculation on the 5th of every month, not at quarter-end. The ratio is monthly, the fees are monthly, and the cheapest month to fix a breach is the month before enrollment, when the only cost is the fix itself. A merchant that discovers a breach from an acquirer letter has already bought the most expensive version of the lesson.
Related reading on this site: the chargeback defense engineering guide, for the alert networks and 3DS mechanics behind deflection; the representment evidence guide, for the CE 3.0 packets that keep cases out of the ratio; and the Visa VROL and MATCH-list defense guide, for what happens when a network flag escalates past fees. To price the fee exposure against your margins, run it through the break-even calculator. For the compliance side of the same payments stack — the SAQ ladder, merchant levels, and the scope math that shrinks the audit — see the PCI DSS scope playbook for SaaS.