Two linked threats can cost a payment company its card scheme access: transaction laundering and miscoding. In the first, an illicit merchant processes payments through a legitimate merchant’s account. In the second, a wrong merchant category code hides what the merchant really does. Visa and Mastercard hold acquirers responsible for their merchants, and acquirers pass fines down.
Checked on 21 October 2026. Rules and sources are current as of this date.
Transaction laundering and miscoding
Transaction laundering
An illicit merchant uses an approved merchant’s account to process its payments. The front site sells books, while a shadow site takes bets or sells banned goods through the same gateway. It passes KYC/KYB because the shop window is clean.
Miscoding
Every card merchant has a four-digit merchant category code (MCC), for example 5942 for book stores and 7995 for gambling. The code sets fees, risk level and which scheme rules apply. A wrong or vague code hides the real business. It can be innocent, such as an outdated code, or deliberate to avoid restrictions.
The two often go together: a fraudster first registers a company under a low-risk code, then uses it to process illicit payments.
How Visa defines transaction laundering
In its Visa Acceptance Risk Standards (VARS), transaction laundering, also known as factoring, is described as a sophisticated form of money laundering where an unknown business uses an approved merchant’s payment credentials to process card payments for undisclosed goods or services. Visa separately treats as unacceptable transactions knowingly intended to hide the true source and nature of the payment by layering it through what looks like a low-risk business but is in fact selling prohibited goods or services.
Visa treats the risk of miscoding and transaction laundering as its own category of legal and regulatory risk. Acquirers must put controls in place during underwriting and monitoring so that concealed illegal transactions do not enter the Visa system.
Visa’s recommended tools include regular review of transaction data for unusual patterns, such as an unusually high number of transactions, similar amounts or transactions that do not match the underwritten business. They also include checking that merchant websites sell only what is declared and have a checkout process, web crawling, behavioural analytics, and monitoring for mismatches in merchant name and MCC and for suspicious URL connections and backlinks.
What Mastercard requires of acquirers
In Mastercard’s Security Rules and Procedures (Merchant Edition), transaction laundering is expressly named among the things that ongoing monitoring must cover. An acquirer must periodically review a merchant’s activity for changes over time, including monthly volume and transaction count, refunds, fraudulent transactions, average ticket size, chargebacks, activity inconsistent with the business model, transaction laundering and potentially illegal or brand-damaging activity.
A specific rule applies to merchants with six months or less of Mastercard acceptance history. If more than five percent of purchase transactions are refunded or charged back in a rolling 30-day period with at least 500 purchases, the acquirer must investigate the merchant as a potential scam merchant.
For acquirers in the Europe Region, Mastercard recommends additional checks on e-commerce merchants. At onboarding and rescreening, look for unrealistic promotions, including countdown timers, products unrelated to the merchant’s business or MCC, and customer service contacts that are unreachable or lack the merchant’s name. In transaction monitoring, warning signs include a very low approval rate, many authorisations without CVC2, a low CVC2 match rate, no 3DS when adding a card on file and significant volumes from issuer countries that do not match the merchant’s target market. On such alerts the acquirer is recommended to pause or temporarily block payouts to the merchant.
What the card schemes do about it
Visa’s Integrity Risk Program (VIRP) replaced the earlier GBPP. It focuses on card-absent merchants in high integrity risk categories, sorted into three tiers: gambling, adult content, dating and pharmacies in the first; crypto, file sharing and games of skill in the second; telemarketing, high-risk trading platforms, negative-option subscriptions and cross-border tobacco sales in the third. Under the VIRP the acquirer must include in the merchant agreement Visa’s right to limit or terminate it.
Mastercard’s BRAM (Mastercard’s Business Risk Assessment and Mitigation program) covers transaction laundering, illegal or miscoded gambling and other brand-damaging activity. Its Merchant Monitoring Program encourages acquirers to use monitoring tools, and this affects the size of the mitigation, as shown below. Fines go to acquirers, and terminated merchants stay in the MATCH (Mastercard’s list of terminated merchants) database for five years.
We will review your situation and propose a solution for your project.
BRAM and Mastercard’s assessment mitigation
The BRAM program investigates merchants referred to Mastercard as potentially engaging in illegal or brand-damaging transactions. It mainly enforces the rules on integrity of brand and network (3.7) and on illegal or brand-damaging transactions (5.12.7). An investigation can start from a referral by law enforcement, rights holders or industry groups, a complaint from customers or cardholders, or Mastercard’s own identification. If a violation is confirmed, Mastercard opens a case, notifies the acquirer and, after the response and documents, makes a final determination on the violation and any assessments.
Participation in the Merchant Monitoring Program (MMP) is optional. An acquirer that takes part engages a Mastercard-approved monitoring provider (MMSP). The provider scans the merchant before its first transaction, monitors it persistently, including the payment page and members-only areas, and reports violations to the acquirer within five business days. The acquirer then investigates and stops the violation within 15 calendar days and sends Mastercard monthly reports. The size of the mitigation depends on this.
| Acquirer in MMP | Acquirer not in MMP | |
|---|---|---|
| Found by the acquirer or MMSP, stopped before Mastercard identified it | 100% mitigation | 100% mitigation |
| Found by Mastercard, stopped within two business days | 75% mitigation | 25% mitigation |
| Found by Mastercard, not stopped within two business days | No mitigation | No mitigation |
An acquirer that does not monitor for transaction laundering gets no mitigation of assessments for transaction laundering. For terminated merchants Mastercard keeps the MATCH database, where transaction laundering has its own reason code 03 and records stay for five years.
What is at stake
Fines and liability
Scheme assessments are made against acquirers, who usually pass them on to merchants under their contracts. You also carry the chargebacks of the illicit merchant and may face higher processing fees.
Regulatory exposure
Facilitating laundering, even unintentionally, breaches AML (anti-money laundering) rules and can end in licence loss and personal liability for management.
Partners
Acquirers and schemes can terminate you at once, and a record in the terminated merchants database makes new accounts hard to open.
Reputation
News that your platform moved illicit money damages trust with clients and investors.
Case analysis
An acquirer notices that an online clothing store has, within a month, a growing share of transactions that do not look like its declared business, and several receipts look like payments for other goods. A sensible order of action is to check the actual site and goods against the declared MCC, request supply documents from the merchant, suspend payouts until clarified and, if a mismatch is confirmed, correct the MCC or end the relationship.
How to protect the business
Set your risk appetite and MCC list
Define which businesses you accept, keep an approved MCC list and review it regularly.
Start hereScrub the portfolio
Review what each merchant really sells and assign the most accurate MCC, filling gaps.
Go deeper at onboarding
Look at the business model, not just documents: hidden links, price and product mismatches, traffic sources.
Monitor continuously
Combine transaction monitoring, website crawling and checks for prohibited content or hidden payment pages.
ImportantFix it in the contracts
Merchant agreements should require an accurate MCC, give audit and termination rights and allow passing fines on. We covered which clauses to include in our article on merchant agreements and protection from transaction laundering.
Taking part in Mastercard’s Merchant Monitoring Program with an approved provider lifts the mitigation from 25% to 75% when Mastercard itself finds the violation and you stop it within two business days.
Standard KYC is no longer enough: you need to know what the merchant really does after onboarding, not only who it is.The LegalBit team
Frequently asked questions
How does Visa define transaction laundering?
As an unknown business using an approved merchant’s payment credentials to process card payments for undisclosed goods or services. Acquirers must put controls in place during underwriting and monitoring.
What assessment mitigation does Mastercard’s MMP give?
Up to 100% if the acquirer finds and stops the violation itself, 75% if Mastercard finds it and it is stopped within two business days while the acquirer is in the MMP, and 25% if it is not. If the violation is not stopped within two business days, there is no mitigation.
Is miscoding always intentional?
No. A code can be outdated, vague or too general, for example when a merchant adds new products. But a deliberate wrong code to avoid restrictions is a violation either way.
Who pays scheme fines?
The schemes assess acquirers, and acquirers usually pass fines down to the merchant under their contracts. Your agreements decide how far this goes.
Can monitoring reduce the penalties?
Yes, if the acquirer takes part in Mastercard’s Merchant Monitoring Program. Mitigation is 100% if the violation is found and stopped before Mastercard identifies it, and 75% instead of 25% if Mastercard finds it and it is stopped within two business days. Monitoring does not replace your own controls.
See also: Brazil’s Betting Ban: Provisional Measure No. 1,394; How banks block fintech startup accounts and how to avoid it; EU AI Act checklist for IT companies and SaaS developers; EMI and Payment Institution Licence in the EU, UK and Canada; KYC and KYB for Payment Providers; Payment Facilitators, Aggregators and ISOs: Who Is Responsible for Sub-Merchants; Illegal Gambling Through Other Businesses’ Card Payments; Accepting crypto payments in business. Services: legal services for fintech and payments.
This is what we do
How we help projects with this topic:
