The Visa Integrity Risk Program, and why your acquirer fears it

The structural fact that explains everything

VIRP penalties fall on your acquirer, not on you.

Almost everything merchants find inexplicable about high-risk acquiring follows from that one sentence. Your acquirer is not being paranoid when it asks what is on page four of your catalogue, and it is not being unreasonable when it terminates you within days of a query it cannot immediately resolve. It is managing an exposure that has its name on it, on a programme where the escalation depends on how fast it acted.

You are a line in someone else’s risk register. Once you understand that, the underwriting questions stop looking like distrust and start looking like what they are.

What VIRP actually covers

VIRP replaced the Global Brand Protection Program and concerns the integrity of what is being sold through the network rather than how often customers complain. Three things bring merchants into it:

Illegal transactions. Goods or services unlawful in the market where the sale happens. Legality is per-jurisdiction, so a catalogue that is fine in one state and not in another is a live exposure the moment you ship into the second one.

Merchant category miscoding. Processing under an MCC that does not describe what you sell. This is the most common entry point and very often has no deceptive intent behind it at all — a business changes what it sells and the code never changes with it.

Transaction laundering. Putting third-party volume through your account, or arranging your own so that restricted products settle somewhere that would not have accepted them. Splitting a catalogue across two checkouts to keep part of it away from the acquirer that would decline it is this, whatever the intention.

Why this is not VAMP

These are routinely conflated and they have almost nothing in common.

VAMP is a ratio. It measures disputes and fraud reports against your card-not-present volume, so it measures how your customers behave. You manage it with descriptors, dispute alerts and refund policy.

VIRP asks what your business is. You do not manage it; you either are compliant or you are not. A merchant with a 0.2 percent dispute ratio can be a severe VIRP problem, and a merchant at 1.4 percent can be entirely clean on it.

What this means when you apply

The underwriting questions that annoy merchants most — what exactly do you sell, which states do you ship to, what is on every page of your site, who else’s volume touches your account — are VIRP questions. They are not a judgement about you.

Two practical consequences:

• Answer fully and early. An underwriter who finds an unmentioned product line halfway through declines the whole application, and that decline follows you.
• Fix your MCC before someone else finds it. A merchant who reports a mismatched code and asks for the right one has an administrative problem. A merchant whose mismatch is discovered by the scheme has a VIRP problem. The cost of the first is a phone call.

On the numbers you will see quoted

Registration is widely cited at 950 dollars per provider per acquirer, raised from 500 dollars on 1 April 2024, and fines are described as starting in the tens of thousands and escalating for repeat findings.

Visa does not publish a public fee schedule or fine ladder for this programme. Those figures come from acquirers and consultants rather than from Visa, which is why they vary between sources. We would rather tell you the number is not authoritatively published than repeat it as though it were. Your acquirer will know the real one.

Where we fit

We are an introducer, not a processor, and we have no role in any scheme programme.

Where we are useful is before you apply: making sure your category, your coding and your shipping map are described accurately, so an underwriter reads a clean file rather than finding something on page four. If what you are doing is a VIRP problem, no introduction fixes it, and we will tell you that instead of sending you at a provider who will decline you.