MCC 5967 tells a Visa issuer that the merchant sells adult content. In Mastercard's latest public code booklet, dated April 2024, the same four digits still mean inbound telemarketing. Visa renamed the code between its April 2024 and April 2025 manuals, and this month it moved escort services into it too.
The merchant category code rides on every card authorisation. It sets US interchange, decides whether a UK credit card prices the payment as a cash advance and whether a bank's gambling block fires, and can leave an acquirer owing Visa USD 100,000 a month. The pages ranking for "merchant category code" are code lists and glossaries. Most get wrong who assigns the code, and none maps it to the API fields that carry it. Rules here were checked against Visa's Merchant Data Standards Manual (October 2026), the Visa Core Rules (18 April 2026) and PSP OpenAPI specs on 28 October 2026.
What Is a Merchant Category Code (MCC)?
An MCC is a four-digit number that classifies a merchant outlet by what it mainly sells: 5411 for grocery stores, 5812 for restaurants, 4511 for airlines. It travels with every card transaction. In the authorisation request it sits in ISO 8583 data element 18 (Merchant Type). In Mastercard's clearing file it goes in DE 26 (Card Acceptor Business Code), and an invalid value gets the presentment rejected with error 0531. The ISO 20022 card messages carry it as MrchntCtgyCd in cain.001, typed ISO18245MerchantCategoryCode with the pattern [0-9]{4}.
Of the few merchant fields an issuer sees on an authorisation, the MCC is the only one built for software to reason about. Fraud models, spend controls and rewards engines all lean on it.
Who Assigns a Merchant Category Code?
The acquirer. Not the merchant, not the card issuer and not the scheme. Visa Core Rules section 1.5.1.11 says an acquirer "must assign to a Merchant Outlet the MCC that most accurately describes its business". Mastercard Rules 5.8.1 requires the code to reflect the primary business and gives Mastercard the final word in a dispute.
Public explanations drift here, including from banks. Nationwide's gambling-support page says gambling companies assign their own codes. A Financial Ombudsman decision describes the code as applied by the merchant. Santander's cashback terms say Mastercard assigns them. What actually happens: the merchant describes its business at onboarding, and the acquirer, or a payment facilitator acting for it, picks the code and answers for it.
Visa requires two or more MCCs at one outlet when it runs an automated fuel dispenser alongside face-to-face sales, or when separate lines of business share the outlet and any of these applies:
- each line has its own merchant agreement
- the premises display different merchant names
- one line is designated high-integrity risk
- a linked website qualifies for a different MCC
Who Maintains the MCC List: ISO 18245, Visa or Mastercard?
Officially ISO 18245. In practice, the schemes. The 2023 edition of ISO 18245 is two pages long and contains no codes. Its foreword says the list now sits with a maintenance agency in a separate document, and ISO's register names AFNOR as that agency. The 2003 edition printed the list in an annex and named ASC X9.
Even the 2003 list marked 3000 to 3999 "reserved for private use", and that is where the schemes put airline, car-rental and hotel brand codes. Mastercard reserves the whole block: airlines 3000 to 3350, car rental 3351 to 3500, lodging 3501 to 3999. Visa lists only codes it has assigned, reaching 3308, 3441 and 3886 respectively in October 2026, and adds hotel chains every six months (3854 to 3883 in April, 3884 to 3886 this month).
So the documents that define a code are Visa's Merchant Data Standards Manual and Mastercard's Quick Reference Booklet, and they are not identical.
Visa vs Mastercard MCC Definitions: Where the Same Code Differs
The brand codes I spot-checked in the 3000 block match across both schemes. The divergence is in the generic codes, and it falls on the categories that carry the most regulatory and risk weight:
| MCC | Visa (Oct 2026 manual) | Mastercard (Apr 2024 booklet) |
|---|---|---|
| 5967 | Adult Content and Services | Direct Marketing: Inbound Telemarketing |
| 5818 | Large Digital Goods Merchant | Digital Goods: Multi-Category |
| 6540 | Stored Value Card Purchase/Load | Funding Transactions |
| 6051 | Foreign currency, liquid and crypto assets, money orders, account funding | Quasi Cash: Merchant |
| 7801 | Government Licensed On-Line Casinos (US only) | Internet Gambling |
| 5262 | Marketplaces | Not listed |
| Skill games | 5816 | 7994 |
| Escort services | 5967 (moved from 7273, Oct 2026) | 7273 |
The trade-off for anyone building a merchant model: store one human-readable label per MCC and it will be wrong for one scheme on exactly the codes that matter most. Keep the four digits as the key and treat the label as scheme-specific display text.
Visa's 5818 is a second trap. A digital-goods merchant only qualifies once it processes more than 25 million transactions a year, or in Europe more than 6 million Visa transactions plus PCI Level 1. Below that it belongs on a narrower code such as 5815, 5816 or 5817, so a growing app business can outgrow its classification.
MCC 5734 vs 5817 vs 7372: Which Code Fits a Software Company?
This question has its own search traffic and few useful answers. Visa's definitions settle most of it:
- 5734 Computer Software Stores sells software programs for business and personal use, and may sell hardware. Visa's entry adds that merchants selling mobile apps "should use MCC 5817".
- 5817 Digital Goods – Applications (Excludes Games) sells applications or software delivered in electronic format.
- 7372 Computer Programming, Data Processing, and Integrated Systems Design Services sells services: programming, systems design, website design, data processing.
5734. If you run a platform and never set MCCs, count how many accounts sit on the fallback.
High-Risk MCCs in 2026: Visa VIRP vs Mastercard Registration
Visa has dropped the phrase "high-brand risk"; it does not appear anywhere in the April 2026 Core Rules. The term is now High-Integrity Risk, under the Visa Integrity Risk Program (VIRP), which replaced the Global Brand Protection Program. Mastercard's equivalent is the Specialty Merchant Registration Program in chapter 9 of its Security Rules and Procedures.
| Category | Visa VIRP | Mastercard registration |
|---|---|---|
| Adult | 5967 (Tier 1) | 5967, 7841 |
| Dating | 7273 (Tier 1) | Not listed |
| Gambling | 7995 (Tier 1); 7801, 7802 US only | 7800, 7801, 7802, 7995, 9406 |
| Pharmacy and drugs | 5122, 5912 (Tier 1) | 5122, 5912 |
| Crypto | 6051, 6012 (Tier 2) | 6051 |
| Cyberlockers | 4816 (Tier 2) | 4816 |
| Skill games | 5816 (Tier 2) | 7994 |
| Other | 6211, 5966, 5968, 5993 (Tier 3) | 6211, 5968, 5993 |
| Penalty for not registering | USD 100,000 a month (Tier 1/2) or 25,000 (Tier 3), plus USD 2,000 per merchant a month | Up to USD 10,000 per violation, plus USD 500 a year per registered merchant |
The penalties land on the acquirer, which passes them on, and they explain why PSPs keep restricted lists. Stripe marks 48 of the 288 MCCs it supports as restricted, including 4829, 6051, 6540, 7995, 7801 and 7802; you have to contact Stripe before using any of them.
Visa also attaches message rules to these codes. Online gambling must carry 7995 plus the quasi-cash/online gambling indicator in every Visa region except Europe. A crypto purchase must use 4829, 6012, 6540 or 6051 together with a business application identifier and a special condition indicator: 1 for a CBDC or tokenised deposit, 2 for a fiat-backed stablecoin, 3 for a native token, 7 when unknown. Mastercard wants 6051 with transaction category code U and transaction type P70. The AFT vs OCT guide covers the identifier side.
How to Set or Change the MCC in Stripe, Adyen and Checkout.com
Every PSP models the MCC differently, and only some show you which code a payment actually used.
| PSP | Where the MCC lives | Who can set it |
|---|---|---|
| Stripe | business_profile.mcc (Accounts v1), configuration.merchant.mcc (v2) | Platform, on accounts it controls; Stripe verifies |
| Adyen | industryCode on /businessLines; mcc on payment requests; subMerchants[].mcc | Merchant or payment facilitator |
| Checkout.com | profile.mccs at platform onboarding (1 to 5 codes); read back as processing.merchant_category_code | Set at onboarding, not per payment |
| Braintree | merchantCategoryCode on GraphQL TransactionInput | Per transaction, overriding the account default |
| Square | Location.mcc (beta) | Once per location, away from a general-purpose code |
account.updated, and "the platform can't change the new MCC". The September 2026 OpenAPI spec has only three MCC fields (business_profile.mcc, Issuing's merchant_data.category_code and standalone 3DS's acquirer_details.mcc), so nothing on a charge records the code it cleared under.
Adyen onboards platform users with an industryCode, its own classification mapped to MCCs behind the scenes. Never treat it as an MCC: industry code 4531 means florists, whose MCC is 5992, and 89 of Adyen's four-digit industry codes differ from the MCC they map to. Checkout API v72 also takes mcc on payment requests, and subMerchants[].mcc for payment facilitators.
Checkout.com takes no MCC on the payment request, but GET /payments/{id} returns processing.merchant_category_code, as do financial actions and disputes. Onboarding accepts five codes and a payment reports one: store the payment's.
The smaller players have their own quirks. Square assigns 7299 by default outside Japan, and lets you change Location.mcc once, only while it still holds one of its general-purpose codes (8999, 7299 or 5944). Square labels 5944 "Other", while Stripe's list calls the same code jewellery, watch and silverware stores. PayPal's partner onboarding field business_industry.mcc_code accepts any run of digits up to 20 characters long.
Blocking MCCs in Card Issuing: Stripe Issuing vs Marqeta vs Lithic
On the issuing side the MCC is the main lever for spend controls, and the APIs disagree on whether you pass codes or names.
Stripe Issuing takes names.spending_controls.blocked_categories accepts a 295-value enum in the 2026-09-30 spec, including spellings you must reproduce exactly, such as government_licensed_online_casions_online_gambling_us_region_only and truck_stop_iteration. Authorisations carry both forms:
"merchant_data": {
"category": "computer_software_stores",
"category_code": "5734",
"country": "US",
"name": "STRIPE"
}
The response-side category is a plain string with no enum, so a value outside your mapping can arrive. Key your logic on category_code and treat the name as a label.
allowed_mcc and blocked_mcc fields are discontinued.
{ "type": "CONDITIONAL_ACTION", "event_stream": "AUTHORIZATION",
"parameters": { "action": "DECLINE", "conditions": [
{ "attribute": "MCC", "operation": "IS_ONE_OF",
"value": ["7801", "7802", "7995"] } ] } }
mcc or by an MCC group whose mccs list accepts ranges such as "2224-2230", up to 500 entries. A Marqeta control is an exception to the programme default rather than an allow or a block. On a programme that approves by default, a 7011 control blocks hotels; on one that declines by default, the same control allows them. Adyen Issuing uses ruleRestrictions.mccs with anyMatch or noneMatch.
The T&E block is where rules leak. Lithic's own MCC list gives airlines as "3000-3299, 4511", so a rule written on 4511 alone lets brand-coded airline payments through. And Marqeta's mcc field accepts one to four characters, so "742" passes validation where you meant 0742 (veterinary services).
How MCCs Affect Gambling Blocks, Cash Advances and Interchange in the UK
Gambling. The Gambling Commission has banned gambling on credit cards since 14 April 2020 (licence condition 6.1.2). The duty sits with operators, but the Commission evaluated the ban on one bank's MCC 7995 data, and named the gaps: lottery tickets at grocers carry the retailer's code, and some e-wallet top-ups slipped through on gambling companies' coding errors.Bank gambling blocks key off the same code. Nationwide says it cannot block a company using the wrong MCC, and Monzo says miscoded transactions bypass its block. In a February 2024 decision involving Barclays, the Financial Ombudsman found gambling-style games got past the block because they were coded as digital goods and media. A block is only as good as the acquirer's coding.
Cash advances. HSBC's fee page treats gambling, quasi-cash merchants, money transfer, security brokers and Mastercard MoneySend as cash: a 2.99% fee (minimum £3) and interest from the day of the transaction. Those categories are MCC titles. Barclaycard prices crypto purchases at its cash rate and cash fee. In an April 2026 decision the Ombudsman upheld Santander treating a customer's crypto purchases as quasi-cash, so her 0% purchase offer did not apply. Rewards. Santander's Rewards credit card terms (June 2026) say cashback eligibility is decided by MCC, list the codes (fuel 5541, 5542 and 9752; EV charging 5552; rail 4111 and 4112) and warn that buy-now-pay-later providers may use their own MCC instead of the retailer's. Interchange. In the US the MCC moves the fee. Visa's interchange schedule of 24 October 2026 charges $0.75 flat on a card-not-present utility payment, 1.35% plus $0.05 at a charity, and 3.15% plus $0.10 when a credit transaction qualifies for nothing better. In the UK, consumer interchange is capped at 0.2% for debit and 0.3% for credit whatever the merchant sells. For domestic consumer cards the MCC barely touches the fee. It decides instead whether the payment is approved, priced as cash or excluded from rewards. The cross-border exceptions are in the interchange++ guide.Is the Four-Digit MCC Still Enough in 2026?
My view, and it is an opinion: the schemes have stopped trying to fit new kinds of commerce into the four digits, and are bolting indicators on beside them instead. That is the right call, but it means classification is no longer one field.
The rules above show it. Crypto purchases need an MCC plus an identifier and an indicator at both schemes, and online gambling needs 7995 plus an indicator. Visa's recent additions are narrow: guns and ammunition (5723, from July 2024, only where the law requires it), EV charging (5552) and hotel chains. There is no code for buy-now-pay-later or for AI agents, and Santander's terms show the cost: a BNPL purchase can arrive under the lender's MCC instead of the shop's.
My prediction is that neither scheme creates an agentic-commerce MCC. Agent payments will keep the merchant's code and gain an indicator, as crypto did, because Visa's rules already say an agentic payment provider "is considered to be the Cardholder". The agent sits on the cardholder's side of the message; the MCC describes the other side. Model classification as a tuple (MCC, scheme, indicators, BAI), not a single code. The schemes already do.
What This Means for Payment Engineering Teams
- Store the MCC as a four-character string. 0742, 0763 and 0780 are in Stripe's list, and an integer column drops the zero. Validate
^[0-9]{4}$on input, because PayPal accepts up to 20 digits and Marqeta as few as one. - Keep labels per scheme. 5967, 6051, 6540 and 7801 mean different things at Visa and Mastercard.
- Audit Stripe connected accounts for 5734. Set MCCs explicitly on accounts you control, because you cannot change a code Stripe has corrected.
- Give high-integrity-risk lines their own merchant accounts and register them before the first transaction. A sportsbook bolted onto a media site still needs 7995.
- Record the MCC per payment where the PSP returns it, as Checkout.com does. Accounts get recoded, and history should show what the issuer saw.
- On issuing, map codes, not names. Include the 3000 to 3999 brand ranges in any airline, car-hire or hotel rule, and add a branch for category names your enum has never seen.
- For UK consumer products, test what your code does at the issuer. Gambling blocks, cash-advance pricing and cashback all key off it, and a wrong MCC shows up as customer complaints rather than API errors.