VAMP Explained: Thresholds, Exclusions, and What Actually Lowers Your Ratio

VAMP is the Visa Acquirer Monitoring Program. Each month Visa monitors fraud, dispute, and enumeration levels, and identifies acquirers or merchants exceeding monthly thresholds. Entities identified above a threshold are required to implement risk mitigation controls.

For a quick history lesson: Visa consolidated two older programs, the Visa Fraud Monitoring Program and the Visa Dispute Monitoring Program, into VAMP as a single global program. VAMP launched April 1, 2025, and the consolidated thresholds took effect June 1, 2025.

Visa then reduced the merchant Excessive threshold from 2.20% to 1.50% on April 1, 2026 in AP, Canada, the EU, and the US. Both dates matter: June 1, 2025 is when the program took its current shape, and April 1, 2026 is when the merchant threshold moved to where it stands today.

What VAMP replaced, and why it matters

Before VAMP, Visa ran two separate monitoring programs in parallel. VFMP tracked the TC40 fraud reports issuers file; VDMP tracked TC15 chargeback disputes. Each had its own ratio, its own threshold, and its own remediation track, which meant a merchant could manage them independently — using pre-chargeback refunds to keep the dispute number clean while accepting fraud-report exposure, or the reverse.

VAMP ended that separation. It combines TC40s and TC15s into a single numerator over settled transaction volume, so the two metrics now interact directly. One fraudulent transaction can generate both records and contribute twice to the same ratio. That double-counting is the most significant practical change VAMP introduced, and it is why many merchants found their exposure higher than expected even before the 2026 threshold reduction.

How is the VAMP ratio calculated?

The metric is count-based and covers card-not-present VisaNet transactions, both domestic and cross-border. Transaction value has no effect on the ratio: a $12 order and a $1,200 order each count as one transaction, and a fraud report or dispute against either counts the same in the numerator.¹ Card-present volume is excluded entirely, so it provides no ratio benefit.

The numerator is broader than most teams assume. TC40 fraud reports are filed by the issuing bank when a cardholder reports a transaction as fraudulent, and do not require a chargeback to exist. TC15 captures the full dispute universe across all reason codes — fraud-coded chargebacks (10.4), merchandise not received (13.1), not as described (13.3), authorization disputes (11.x) and processing errors (12.x). Non-fraud disputes count equally alongside fraud disputes.

A single transaction can generate both a TC40 fraud report and a TC15 dispute record. Visa does not deduplicate, so that transaction counts twice in the numerator. For merchants with high fraud-coded dispute rates, this is the primary driver of ratio inflation relative to what they experienced under the old programs. The mechanics of the two records are covered in TC40 vs TC15, and a full worked example in how the ratio is calculated.

What are the current VAMP thresholds?

Merchant Excessive thresholds

The count floor is the part most merchants miss. A merchant does not get identified on ratio alone. In AP, Canada, the EU, and the US, combined monthly TC40s and TC15s must reach 1,500 before the ratio is applied at all. A merchant running 1,200 combined events a month at a 2% ratio is above the threshold percentage and still below the identification floor. Acquirers can and do apply their own standards below these floors.

Merchant-level thresholds apply when the merchant's acquirer is not itself identified as Above Standard or Excessive.

Acquirer portfolio thresholds

Acquirer thresholds are far tighter than merchant thresholds, which is why acquirers commonly intervene with merchants well before Visa's merchant Excessive line. An acquirer whose whole portfolio must stay under 0.50% cannot carry many merchants sitting at 1.4%. In practice many processors set internal merchant thresholds between 1.0% and 1.2%, well below Visa's published 1.5% — which means your real compliance target is your acquirer's number, and the only way to learn it is to ask. That relationship is the subject of acquirer vs network thresholds.

Enumeration

Enumeration monitoring targets card testing, where an attacker automates authorization attempts across large sets of card numbers, expiry dates, and CVVs to find valid combinations. Enumerated transactions are identified by Visa's Account Attack Intelligence, not self-reported.

The threshold is ≥ 2,000 bps (20%), alongside a minimum count of 300,000 enumerated transactions. Exceeding it carries the same classification and fine structure as exceeding the VAMP ratio.

Because both approved and declined attempts count, blocking at authorization is not sufficient. Detection has to happen before attempts reach the authorization layer.

What does VAMP cost?

Merchants identified at Excessive are assessed $8 per event, administered through their acquirer. Acquirers identified at Above Standard are assessed $4 per event and at Excessive $8 per event.²

The fee is per event, not per month, so exposure scales with the numerator rather than with the ratio. A merchant at 1.6% with 2,000 combined monthly events faces a materially larger assessment than a merchant at 2.4% with 400 events, and only one of them is above the count floor.

How often is VAMP evaluated?

Monthly, on a calendar month, with no rolling average, no grace window inside a month, and no carry-forward. If your ratio is Excessive in March, you are in the program for March regardless of February or April performance. There is no exit period requiring consecutive clean months either; classification is simply the state of your ratio in each individual month.

One provision exists for first-time entry: merchants outside the program for at least 12 rolling months receive a three-month grace period before fines are assessed on first re-entry. It applies only to that first re-entry after a clean 12-month window, and is not a general buffer.

Metrics are calculated by merchant descriptor rather than purely by MID. For merchants with multiple product lines or transaction types mapped to different descriptors, a single MID can have some descriptors well inside compliance and others above threshold, and VAMP treats them separately. Merchants who believe their descriptors should be grouped differently have to take that up with their acquirer.

What does Visa exclude from the VAMP ratio?

Visa's fact sheet names two exclusions, both contingent on the timing of the data extract, which in practice means resolution inside the same calendar month as the dispute:¹

Two consequences follow, and they are the mechanics merchants most often get backwards.

Pre-dispute alerts remove the TC15 and leave the TC40. When an RDR or CDRN alert is triggered and resolved before a chargeback is filed, the dispute is excluded from the calculation. The fraud report is not. A transaction refunded through an alert still counts in the numerator through its TC40, so an alert program can reduce a merchant's dispute count while barely moving that merchant's VAMP ratio. That asymmetry is the subject of RDR vs CDRN vs Order Insight.

Compelling Evidence 3.0 removes the TC40. CE3.0 lets a merchant challenge a Dispute Condition 10.4 fraud chargeback by presenting evidence that the cardholder completed prior undisputed transactions matched on device or IP data. When a CE3.0 case is accepted and resolved inside the same calendar month as the dispute, Visa removes both the TC40 and the TC15. The qualifying criteria are covered in Visa Compelling Evidence 3.0.

Does winning a chargeback lower your VAMP ratio?

No. Winning a chargeback at representment recovers the revenue and leaves the TC15 in the VAMP ratio. Financial recovery and ratio exclusion are separate outcomes.

Ratio relief comes from two places only: pre-dispute resolution before the chargeback is filed, and CE3.0 qualification, both inside the calendar month.

The practical implication is that a merchant approaching a threshold has a different problem from a merchant losing winnable disputes, and the two problems get solved with different tools. Response quality addresses recovery. Pre-dispute resolution, CE3.0 qualification, and upstream root-cause work address the ratio.

Key dates

Related

• How Is the VAMP Ratio Calculated? Step-by-Step with a Worked Example
• TC40 vs TC15: What Counts Where in Your VAMP Ratio
• Acquirer Intervention Thresholds vs Network Thresholds
• Visa Compelling Evidence 3.0 (CE3.0)
• Visa's VAMP Program: The April 2026 Enforcement Update

Sources

1. Visa Acquirer Monitoring Program fact sheet — formula, thresholds, count floors, enumeration definition, and exclusions. ↩ ↩²

2. VAMP operational detail including fee schedules circulates through Visa Business News bulletins distributed to acquirers rather than through the public Core Rules. Merchants should confirm assessments with their acquirer. ↩