VAMP and BRAM: the scheme rules that decide whether you keep processing

What changed, and why it matters more than the number

Visa previously ran two separate monitoring programmes: one counting disputes, one counting fraud reports. A merchant could sit comfortably under both while being uncomfortable on each.

The Acquirer Monitoring Program merged them. The ratio is now fraud reports plus disputes, divided by settled card-not-present transactions.

That consolidation is a bigger change than the headline percentage. A subscription business with a confusing billing descriptor generates fraud reports rather than refund requests — the customer does not recognise the charge, so they call it fraud. Under the old structure those sat in a separate bucket. Now they add directly to the same ratio as genuine service disputes.

The 2026 position

From April 2026 the merchant excessive threshold tightened to 1.5 percent, down from 2.2 percent, with per-transaction assessments of roughly eight dollars per disputed or fraudulent transaction and no warning tier before penalties apply. Acquirers carry their own thresholds, commonly cited at 0.5 percent above-standard and 0.7 percent excessive. The 1.5 percent figure applies in the US, Canada, Europe, Asia-Pacific and Latin America; the CEMEA region stayed at 2.2 percent.

The absence of a warning tier is the practical change. Previously a merchant drifting upward had a period of visibility before consequences. Now the first month over is a month with assessments attached.

The floor that decides whether any of this applies to you

The percentage is the number everyone quotes. The floor underneath it is the number that decides whether you are in the programme at all, and it is almost never mentioned.

VAMP only enumerates a merchant at or above 1,500 combined fraud and dispute events in a month. Below that count, your ratio is not the mechanism that gets you into trouble.

This cuts both ways, and both are worth being clear about:

• If you are a smaller merchant, the headline is not about you. Forty disputes on a thousand transactions is a four percent ratio and it is not a VAMP breach, because forty is a long way below the floor. Plenty of merchants are frightened into buying dispute tooling by a programme that does not currently enumerate them.
• That is not the same as being safe. Your acquirer monitors you on its own terms and needs no scheme programme to act. A four percent ratio will cost you your account whether or not Visa is counting, and it is the acquirer, not the scheme, that terminates merchants.
• Growth crosses the floor quietly. The floor is a count, not a rate. A merchant holding a steady one percent ratio enters enumeration purely by growing volume, with nothing about their performance having changed.

Separately, the enumeration ratio for card-testing attacks — 20 percent — applies only to merchants seeing 300,000 or more enumerated transactions, which is a different and much larger population again.

Why your acquirer acts before Visa does

Assessments flow through the acquirer, and the acquirer’s own portfolio ratio is affected by your performance. An acquirer whose book is approaching its own threshold will remediate or exit merchants who are pulling it upward, and will do so before the scheme forces the issue.

This is why threshold breaches so often end as terminations rather than as fines. Your acquirer is not being unreasonable; they are managing a number that has their name on it.

Mastercard runs two programmes, and only one of them is BRAM

Comparisons usually set VAMP against BRAM, which gets the structure wrong. BRAM is not Mastercard’s answer to VAMP. Mastercard monitors chargeback volume under a separate programme entirely, and a merchant worried about ratios is worried about that one.

The Excessive Chargeback Program (ECP) is the direct counterpart to VAMP. You are identified as an Excessive Chargeback Merchant at 100 to 299 chargebacks in a month together with a chargeback ratio of 1.5 percent or higher — both conditions, not either. A High Excessive Chargeback Merchant is 300 or more chargebacks with a ratio of 3 percent or higher. Both triggers generally have to persist for two consecutive months before Mastercard formally identifies you.

Two details catch people out. The count requirement means the same small-merchant logic applies here as under VAMP: ninety chargebacks at a four percent ratio is not an ECM. And Mastercard divides this month’s chargebacks by last month’s sales, not this month’s. A merchant whose volume is falling gets a materially worse ratio than the one they calculate themselves, and seasonal businesses can breach on the way down from a peak while their own dashboard says they are fine.

BRAM — Business Risk Assessment and Mitigation — is a different problem entirely. It is not about dispute volume at all. It concerns illegal or brand-damaging transactions, transaction laundering, and merchants processing under an MCC that does not describe what they actually sell.

A merchant can be immaculate on VAMP and ECP and in serious trouble on BRAM, and the remedies are unrelated. Ratio problems are fixed with dispute management. BRAM problems are fixed by not doing the thing, and the assessments attached to them are substantially larger.

What to do this month

1. Check your descriptor. It is the cheapest intervention and it now helps twice.
2. Get your ratio calculated the new way. Fraud reports plus disputes over CNP transactions. Many merchants are still tracking the old figure and think they have more headroom than they do.
3. Turn on dispute alerts. Refunding before a chargeback is filed keeps the transaction out of the ratio entirely.
4. Remove cancellation friction. Every obstacle between a customer and a refund is a chargeback waiting to be filed.