Merchant Monitoring Programs Explained: VAMP, ECM, SMMP and GMAP

Every merchant is watched by monitoring programs, whether they know it or not — but "the program" is really four different things, and confusing them is expensive. A merchant who fixes a ratio to escape ECM can still be investigated under SMMP the same week, because SMMP does not use ratios at all. A merchant safely under Visa's line can trip Mastercard's, because the two networks count different things over different months. And a merchant clear of everything today can trip Mastercard's line in 2030 without changing anything, because the line itself moves. This guide takes each program in turn: what it counts, what trips it, what happens inside it, and how you get out. If you just want your own position checked, the Merchant Monitoring Program Checker runs all four against one month's figures.

Three shapes, not one program

Keep this split in mind for everything that follows:

• Ratio programs (VAMP, ECM/HECM): a ratio line plus a monthly count gate, both in the same month. Enrollment means a remediation plan, assessments that escalate with time in the program, and an exit that takes consecutive clean months.
• Signal program (SMMP): no ratio, no count gate, no fines, no plan. A signal starts a 72-hour acquirer investigation; a confirmed case ends processing immediately.
• Future shape (GMAP): Mastercard's ratio programs from April 2027, with the same structure and a tightening ratio floor. Everything about GMAP in this guide is labelled as an acquirer-summary figure, because the bulletin behind it is not public.

Visa VAMP

Visa's Acquirer Monitoring Program — VAMP — replaced the separate Visa Dispute Monitoring Program and Visa Fraud Monitoring Program on April 1, 2025, with a single combined ratio. The ratio is TC40 fraud reports plus TC15 non-fraud disputes, divided by settled card-not-present transactions in the month. Two details make it harsher than the old programs it replaced. First, fraud reports count even when they never become chargebacks, so the ratio Visa computes can run higher than your raw chargeback ratio. Second, accountability sits partly with the acquirer: acquirers are scored on their whole portfolio, which is why an acquirer may act on your account before any merchant tier trips.

Since April 1, 2026, the published merchant tier is Excessive at 1.5% (down from 2.2%), and it applies once the merchant generates at least 1,500 fraud reports and disputes in the month, for merchants in the US, Canada, Europe, Asia-Pacific and Latin America group. Both conditions must hold in the same month: a 2% ratio on 900 events does not trip the merchant tier, and 2,000 events at 1.2% does not either. The lower figures sometimes quoted alongside VAMP — 0.5% Above Standard and 0.7% Excessive — sit at the acquirer level, not the merchant level, and this guide does not use them as merchant trip lines. The retired VDMP lines (Early Warning 0.65% / 75, Standard 0.9% / 100) are history, not thresholds to plan around — although 0.9% remains a sensible internal alarm, because it is where many acquirers start paying attention.

What happens inside VAMP: the acquirer is required to put a remediation plan in place, per-dispute assessments apply to excessive merchants, and the position is reviewed monthly. Disputes resolved through pre-dispute solutions, and fraud that qualifies for Compelling Evidence 3.0, can be excluded depending on timing — which is why the first question to your acquirer is always what its VAMP count actually is, not what your own spreadsheet says. This guide states no VAMP fee amount: published per-event figures vary by source and the binding schedule is the one in your merchant agreement.

Mastercard ECM and HECM

Mastercard's Excessive Chargeback Program runs two tiers on one structure. ECM (Excessive Chargeback Merchant) trips at 100 or more chargebacks in a month and a ratio of 1.5% or more; HECM (High Excessive Chargeback Merchant) at 300 or more and 3.0% or more. Both conditions in the same month, as with VAMP — but the ratio itself is computed differently, and that difference is the trap. Mastercard divides this month's first-presentment chargebacks by last month's transactions. A quiet sales month therefore raises next month's official ratio on the same chargeback count, and seasonal sellers feel it first. Worked example from this site's ratio guide: 120 chargebacks this month on 10,000 transactions this month is 1.20% on Visa's basis, but 1.50% on Mastercard's basis if last month had 8,000 transactions — exactly on the ECM line, with nothing about the disputes having changed.

What happens inside ECM/HECM: in the published pattern, assessments start in the second month in the program and escalate steeply the longer a merchant stays in, with an issuer recovery assessment on chargebacks above 300, and processors commonly add reserves or slower payouts alongside the network assessments. This guide states no assessment amount, for the same reason as VAMP: published schedules vary and your agreement governs. Exit generally takes three consecutive months under the thresholds — one good month changes nothing. And the rule that surprises merchants most: winning disputes does not lower the ratio. Mastercard counts first-presentment chargebacks and does not recalculate for representment outcomes. Fighting cases recovers revenue; only preventing a dispute from posting — alerts, screening, authentication — lowers the program count.

Mastercard SMMP: the signal program

The Scam Merchant Monitoring Program, enforced since July 24, 2026, exists because the ratio programs miss a whole kind of merchant: one whose customers pay willingly because they were misled — a fake shop, an investment scheme, a subscription that is not what it claims — and only complain later, when refunds and chargebacks spike or issuers start blocking the merchant's transactions in bulk. SMMP therefore watches signals, and it runs independently of ECM, EFM and VAMP. A merchant can clear every ratio and still be investigated under SMMP.

The signals, as published by program guides that agree on them, fall into two sets:

• All merchants: an authorization approval collapse — at least 25 purchase transactions in 72 hours with the approval rate dropping by 50 or more percentage points, or falling below 30%. BIN attacks and acquirer-side system issues are excluded. A Mastercard GRIP letter linking the account to suspected scam activity. An alert from an approved Merchant Monitoring Service Provider (MMSP).
• New merchants only (6 months or less of Mastercard acceptance): fraud reports (Fraud Type 56, manipulation of cardholder) from two or more issuers; chargebacks from two or more issuers with documentation referencing scams or manipulation; or a combined refund-and-chargeback rate above 5% of purchase transactions over any rolling 30-day window, with at least 500 transactions in that window.

Three corrections matter. First, the 5% figure is not a universal SMMP trigger: it applies only in a merchant's first 6 months, and it is widely misreported as applying to everyone. Established merchants are not subject to that specific threshold, though they remain subject to the authorization, GRIP and MMSP signals. Second, the 5% counts refunds and chargebacks together, which makes it a harder number to manage than a chargeback ratio alone — a generous refund policy can push a new merchant over it. Third, a signal is not a finding: it starts an investigation, and the acquirer has 72 hours to investigate. If the investigation confirms scam activity, the acquirer must block the merchant from Mastercard and Maestro processing immediately, and the merchant is typically added to the MATCH terminated-merchant file. There are no fines, no warnings and no grace period in SMMP — which is exactly why the preparation is different: an evidence file that can be produced in hours (customer journey, fulfillment records, refund logs), not a monthly remediation plan.

Mastercard GMAP from April 2027

On April 1, 2027, Mastercard's Global Merchant Audit Program replaces the Acquirer Chargeback Monitoring Program. It folds the existing merchant categories (EFM, ECM, HECM) under one framework, scores acquirers on the same fraud-and-dispute calculation used for merchants, and adds new High and Excessive Dispute Merchant tiers aimed at small merchants with extreme ratios. The change was announced through bulletin GLB 14127.1, "Revised Standards for the Acquirer Chargeback Monitoring Program (ACMP), the Global Merchant Audit Program (GMAP), and the Questionable Merchant Audit Program (QMAP)", published July 28, 2026 — on Mastercard Connect, the portal Mastercard uses to communicate with acquirers. That is why there is no public press release to link to: network bulletins go to the member institutions they govern, not to the open web.

Because the bulletin is acquirer-only, every GMAP figure in this guide comes from acquirer/provider summaries and must be confirmed with your acquirer. On those summaries — Chargeflow's SMMP/GMAP section and Slyce360's GMAP explainer, which agree on the schedule — the ECM ratio floor tightens in steps while the 100-chargeback minimum stays: 1.5% in 2027 and 2028, 1.3% in 2029, 1.1% in 2030, 0.9% in 2031, with HECM unchanged at 300 chargebacks and 3.0%. The practical consequence is worth stating plainly: a merchant holding steady at a 1.2% ratio with 100 or more chargebacks a month is outside ECM today and in 2029, but inside it in 2030, when the floor drops to 1.1% — without anything about the business having changed. The thresholds for the new High and Excessive Dispute Merchant tiers are not stated in this guide: they rest on a single provider summary and are not corroborated well enough to put numbers on. Ask your acquirer for the bulletin text if you have portal access through them; if you do not, treat every GMAP figure here as a planning signal, not a rule to build a budget on.

The related program: Mastercard EFM

For completeness: Mastercard's Excessive Fraud Merchant (EFM) program tracks fraud alone, not all chargebacks. It trips when a merchant meets all four criteria in the same month: at least 1,000 e-commerce transactions, at least $50,000 in fraud chargebacks, a fraud ratio of at least 0.5%, and low 3D Secure use (at or below 10% in the US and Canada, 50% in Europe). EFM is not computed by the companion checker, because the checker does not ask for fraud dollars or 3DS rates — and guessing them would be worse than leaving EFM out. If your disputes are fraud-heavy, ask your acquirer for your EFM position alongside your ECM position; breaching both in the same month is billed under EFM only, with the ECM assessment paused until EFM is exited.

Getting out, and what actually lowers the number

For the ratio programs, exit is slow by design: generally three consecutive months under the thresholds, with assessments escalating while you remain in. For SMMP there is no exit-by-months at all: either the 72-hour investigation clears you, or a confirmed case ends processing. That split decides the strategy. For ratios, work the inflow, in the order merchants usually feel it: fix the billing descriptor so customers recognize the charge; turn on pre-chargeback alerts so a refund replaces a dispute before it posts; make cancellation painless and send renewal reminders; read reason codes monthly and fix the product, page or traffic source behind each cluster. For signals, keep the evidence file ready: a new merchant's refund-plus-chargeback rate, an authorization collapse with its cause documented, and a customer journey an acquirer can follow in hours. And in both cases, get your acquirer's own counts in writing — VAMP counts fraud reports you may never have seen as chargebacks, Mastercard counts last month's transactions you may have forgotten, and SMMP counts signals no ratio dashboard shows.

Frequently asked

Related reading

• Merchant Monitoring Program Checker: which program trips?
• Chargeback Ratio Calculator
• Chargeback Ratio Explained
• Chargeback Reason Codes: The Complete List

Sources (checked October 27, 2026): This site's chargeback-ratio-calculator.html and guides/chargeback-ratio-explained.html (VAMP 1.5% / 1,500, ECM 1.5% / 100+, HECM 3% / 300+, same-month vs lagged measurement months, three-month exit pattern); Chargeflow — Visa VAMP rules guide and Mastercard Excessive Chargeback Program guide (VAMP 1.5% from Apr 1, 2026, TC40 + TC15, acquirer tiers, ECM / HECM, EFM four criteria, SMMP enforced Jul 24, 2026, GMAP from Apr 1, 2027 with ECM floor steps); Chargeback.io — Mastercard Chargeback Monitoring Program guide and Mastercard Chargeback Guide (ECM / HECM, fines from month two, issuer recovery above 300, EFM criteria); Dodo Payments — Visa VAMP Explained (1.5% from Apr 1, 2026, 1,500 events, regions); Chargebacks911 — Mastercard Scam Merchant Monitoring Program guide (5% signal limited to merchants under 6 months with 500+ transactions, 72-hour investigation, immediate termination on confirmation, no fines); The Payments Edge — Mastercard SMMP guide (authorization collapse: 25+ transactions in 72 hours, 50+ point drop or below 30%, GRIP and MMSP signals, new-merchant triggers); Slyce360 — Mastercard GMAP Explained (bulletin GLB 14127.1, Jul 28, 2026, Mastercard Connect, acquirer-only; ECM floor steps; HECM unchanged) and Mastercard SMMP Explained (enforced Jul 24, 2026, 72-hour investigation, immediate termination). Network rulebooks are not public; figures are as published by program guides, processors and acquirer summaries, and can change.

Open the monitoring checker