Visa's VAMP Program: The April 2026 Enforcement Update

This article covers the April 2026 VAMP enforcement changes specifically — what tightened, what it means operationally, and how dispute response fits into compliance strategy. For a full reference on how the VAMP ratio is calculated, how thresholds are structured by region, and how the program works from the ground up, start here: Understanding VAMP Thresholds: The Complete Merchant Reference.

April 1, 2026 marked a meaningful shift in how Visa monitors merchants for fraud and disputes. The Visa Acquirer Monitoring Program (VAMP) has entered stricter enforcement — and the merchants who understand its mechanics are the ones who won't be caught off guard.

Most of the industry conversation around VAMP focuses on fraud prevention: stop bad transactions before they become chargebacks. That framing is correct but incomplete. What gets far less attention is the role that dispute response plays in your VAMP ratio — specifically, how the way you handle chargebacks after they land can directly remove transactions from Visa's calculation. That distinction matters more than most merchants realize.

What Changed on April 1, 2026

VAMP launched April 1, 2025, replacing the Visa Fraud Monitoring Program and Visa Dispute Monitoring Program into a single ratio: TC40 fraud alerts plus TC15 disputes divided by settled CNP transactions. After an advisory period through September 2025, fines for Excessive merchants began October 1, 2025. Stricter Above Standard acquirer thresholds took effect January 1, 2026. Then on April 1, 2026, the merchant Excessive threshold dropped from 2.2% to 1.5% across the US, Canada, EU, and Asia-Pacific.

Key dates:

October 1, 2025 — Enforcement begins: fines for Excessive merchants
January 1, 2026 — Stricter Above Standard thresholds for acquirers
April 1, 2026 — Merchant Excessive threshold: 2.2% → 1.5% (US, Canada, EU, APAC)

The full ratio formula, threshold table by region, fine structure, enumeration ratio, and double-counting mechanics are covered in the foundational VAMP reference. What this article focuses on is what the April 2026 tightening means in practice — and specifically why dispute response, not just fraud prevention, is now a direct compliance lever.

The Fine Print Most Merchants Miss

Three mechanics are worth keeping front of mind as context for everything that follows. First, a single fraudulent transaction can count twice — the TC40 fraud alert and the TC15 chargeback both enter the ratio separately, meaning one order can generate $16 in fines if you're above threshold. Second, refunding pre-chargeback removes the TC15 but not the TC40 — RDR resolves one side only. Third, disputes you're not financially liable for still count toward your ratio regardless. For the full mechanics including the double-counting diagram, monthly evaluation rules, and the grace period provision, see the complete VAMP threshold reference.

The Acquirer Pressure Most Merchants Underestimate

While the merchant Excessive threshold is 1.5%, acquirers are held to a portfolio-level threshold of just 0.7% for Excessive and 0.5% for Above Standard. Every merchant in their portfolio contributes to that single aggregate number.

The practical implication: your acquirer's internal threshold for you is likely well below the published 1.5%. Many processors are setting merchant-level internal caps between 1.0% and 1.2% to maintain adequate buffer. A merchant operating at 1.3% — technically compliant with Visa's published merchant threshold — may still receive pressure from their acquirer, face increased reserve requirements, or lose their processing relationship entirely.

This creates a particularly acute problem with large enterprise accounts that have high transaction volume but elevated TC40 rates. A major retailer can have a low chargeback rate but a substantially higher TC40 rate, and under VAMP's unified formula, both count. If a large merchant is disproportionately contributing to an acquirer's portfolio ratio, the acquirer faces difficult choices: work to reduce the merchant's TC40 rate, terminate the anchor merchant, or offboard large numbers of smaller merchants to rebalance the portfolio. This pressure is already translating into real merchant terminations across the industry.

What This Means Operationally

VAMP metrics are calculated by merchant descriptor. Visa has indicated that merchants who believe their descriptors should be grouped differently should engage their acquirer directly. If your dispute exposure is concentrated in specific product lines, how transaction volume maps to descriptors affects your reported ratio — worth reviewing with your acquirer proactively, not reactively.

Requesting monthly TC40 data, asking for your VAAI (Visa Account Attack Intelligence) report, and understanding your contribution to your acquirer's portfolio ratio are now core parts of payment infrastructure risk management. Most merchants cannot view TC40s directly — request this data from your acquirer or processor explicitly.

CE3.0: The Primary Tool for Removing Transactions From Your VAMP Ratio

Visa's Compelling Evidence 3.0 (CE3.0) is the only mechanism documented in Visa's official program materials through which a TC40 fraud alert can be removed from your VAMP ratio. This makes it uniquely important compared to all other dispute resolution tools, which address TC15s but leave TC40s in place.

CE3.0 allows merchants to challenge a Dispute Condition 10.4 (fraud) chargeback by presenting evidence that the cardholder completed at least two prior undisputed transactions using the same device fingerprint and IP address. When a CE3.0 case is accepted and resolved within the same calendar month as the dispute, Visa removes both the TC40 and the TC15 from the VAMP ratio.

Potential CE3.0 Expansion — Monitor for Official Visa Confirmation

Industry commentary has referenced a potential Visa update that would allow qualifying CE3.0 transactions to come from different merchants (not only the same merchant), and would permit transactions on related credentials linked to the same underlying card to qualify. If confirmed, this would significantly expand the available evidence pool. We are monitoring this and will update this article when Visa publishes official documentation with confirmed scope, mechanics, and effective date.

For the current program as officially documented: qualifying transactions must come from the same merchant. Executing CE3.0 at meaningful volume requires device ID and IP address to be captured, stored, and linked across your full transaction history — and submitted quickly enough to fall within the same calendar month as each dispute. At Disputed.ai, we work across millions of transactions with eCommerce merchants of varying scale, linking device signals and prior transaction history systematically to surface CE3.0 qualifying evidence at the speed the same-month rule demands.

Dispute Response as a VAMP Compliance Lever

The dominant conversation around VAMP has focused on upstream fraud prevention: stop bad transactions before they become chargebacks. That is correct — but it addresses only one side of the ratio.

A critical distinction many operations teams miss: winning a chargeback dispute does not remove the TC15 from your VAMP ratio. The financial reversal and the ratio impact are separate. The only paths to ratio reduction after a dispute has been filed are pre-dispute resolution for TC15s, and CE3.0 for TC40s. Everything else is revenue recovery — not compliance management.

Pre-Dispute Resolution and RDR

Visa's Rapid Dispute Resolution (RDR) is the most direct tool for keeping TC15s out of your VAMP ratio. When an RDR alert is triggered and resolved before a chargeback is filed — within the same calendar month — the dispute is excluded from the VAMP calculation. RDR does not suppress the corresponding TC40, so for merchants with high fraud-coded dispute rates, CE3.0 must be deployed alongside it.

Response Speed and the Same-Month Rule

The same-month requirement is the operational constraint that makes dispute response infrastructure matter as much as accuracy. A CE3.0 that would succeed in removing a transaction from VAMP — but is submitted two days late and falls into the following calendar month — provides no ratio benefit for the month in question. At meaningful dispute volumes, the difference between a team that executes CE3.0 within days and one that takes three weeks is directly measurable in basis points.

Practical Steps for Merchants Operating Under VAMP

Know your ratio today. Calculate your VAMP ratio monthly using TC40 and TC15 event counts against your settled CNP transaction volume. Our VAMP Compliance Calculator makes this straightforward — including modeling the double-counting impact.
Audit your device ID and IP capture. CE3.0 eligibility depends on having device fingerprint and IP address stored on every CNP transaction, going back at least 120 days. If gaps exist, close them now.
Deploy RDR and CE3.0 together, not separately. RDR removes TC15s; CE3.0 removes TC40s and TC15s. Using only one leaves the other side of your numerator unmanaged.
Request your TC40 data from your acquirer. Without TC40 data, you are calculating your VAMP ratio blind and cannot identify CE3.0 candidates. Ask for monthly access explicitly.
Ask your acquirer what internal threshold they're holding you to. Visa's published 1.5% is not necessarily the threshold your acquirer applies. Operate with meaningful headroom below their internal limit.
Review your descriptor structure proactively. VAMP is calculated per merchant descriptor. If your dispute exposure is concentrated in specific product lines, how your transactions are grouped across descriptors affects your ratio.
Address enumeration separately from VAMP ratio management. The Enumeration Ratio is a distinct metric with its own threshold. Both approved and declined authorization attempts count. Bot detection needs to operate before the authorization layer.
Build CE3.0 response speed into your SLA. CE3.0 must be executed within the same calendar month as the dispute for the ratio exclusion to apply. Speed is as operationally important as accuracy.

One important nuance: if your VAMP ratio is comfortably below threshold, reflexively resolving every pre-chargeback alert through a refund is not the right move. Refunding a dispute you would have won costs you the revenue twice — once in the refund, once in the foregone recovery. Pre-dispute resolution tools are valuable for ratio management, but should be deployed selectively based on your actual headroom, your win rate on similar disputes, and the strength of your evidence. VAMP compliance and dispute revenue recovery are not competing goals. The aim is to resolve the disputes worth resolving early, fight the ones worth fighting, and have the data infrastructure to know the difference on every case.

The Bottom Line

VAMP is Visa's long-term framework for dispute and fraud monitoring. The April 2026 threshold reduction is unlikely to be the last — the trajectory of the program is toward stricter standards over time. And the acquirer pressure dimension means that operating at the published merchant threshold is not the same as operating safely within your processing relationship.

The merchants best positioned for this environment are those who have closed the gap between fraud prevention and dispute response — treating them as two sides of the same compliance function. Every TC40 that qualifies for CE3.0 removal, every dispute resolved pre-chargeback through RDR within the same month, and every fraudulent transaction stopped before authorization is a direct VAMP ratio event that either counts against you or doesn't. The sum of those decisions, executed consistently at scale, is what the ratio reflects at the end of each month.

Want to know where your ratio stands?

Use Disputed.ai's free VAMP Compliance Calculator to estimate your current ratio and model the impact of double-counting.

Check Your VAMP Ratio

Sources: Visa Acquirer Monitoring Program Fact Sheet (official, corporate.visa.com); Compelling Evidence 3.0 Merchant Readiness (official, usa.visa.com)