Visa VAMP Thresholds in 2026 vs Mastercard ECP

A fraudulent order that turns into a chargeback counts twice against your Visa VAMP ratio: once for the issuer's TC40 fraud report and once for the TC15 dispute. Since 1 April 2026 the Excessive line for merchants in Europe, the US, Canada and Asia Pacific has been 150 basis points, and a merchant over it pays USD 8 per counted event.

Some pages ranking for "VAMP ratio" still quote Visa's October 2024 draft: acquirer levels of 30 and 50 bps, a merchant threshold falling to 90 bps, a 1,000-event floor and USD 10 fees. Visa replaced all of that in May 2025. At least one widely read guide also defines the TC15 side as "non-fraud disputes", which was true under the old programme and is wrong now. The figures below come from Visa's VAMP fact sheet, the Visa Core Rules edition of 24 October 2026, and acquirer and PSP documentation from Stripe, Adyen, Checkout.com and Antom, all checked on 2 November 2026.

What Is Visa VAMP and What Did It Replace?

The Visa Acquirer Monitoring Program launched on 1 April 2025. It replaced the Visa Dispute Monitoring Program (VDMP) and the Visa Fraud Monitoring Program (VFMP), which tracked disputes and fraud separately with different thresholds. VAMP folds both into one ratio and, as the name says, aims it at the acquirer first. Visa identifies and bills the acquirer, and the acquirer decides how much to pass down to you.

The rollout came in stages:

The detailed thresholds and fee tables live in the Visa Acquirer Monitoring Program Guide, which is not public (Core Rules ID# 0029286). Everything public is the May 2025 fact sheet plus what acquirers and PSPs have chosen to publish, which is why the secondary pages disagree so much.

How Is the VAMP Ratio Calculated?

Visa's formula, from the fact sheet:

VAMP ratio = count(TC40 fraud reports + TC15 disputes)
             / count(TC05 settled transactions)
scope: card-not-present only, domestic and cross-border

Four details decide whether your own estimate matches Visa's.

A worked example. You settle 120,000 Visa CNP transactions in a month. Issuers file 900 TC40s. You receive 1,100 disputes, 700 of which are fraud disputes on transactions that already have a TC40. The VAMP count is 900 + 1,100 = 2,000, not 1,300 unique bad orders. The ratio is 2,000 / 120,000 = 167 bps, which is Excessive.

VAMP Thresholds in 2026: Merchant and Acquirer Limits by Region

The UK sits in Visa's Europe region, alongside Switzerland, Norway, Israel and Türkiye, so UK merchants have been on 150 bps since April. CEMEA is a separate region, covering markets such as the UAE, and its minimum is where sources split: Visa says 150 events and USD 75,000, a Checkout.com support article says "greater than 100" for MENA, and Adyen's April 2026 table shows a flat 1.50% with no CEMEA exception at all. Visa says programmes for Brazil, Chile and India "will be announced later".

The 1,500 floor matters more than most guides admit. You cannot be an Excessive merchant until you log 1,500 events, so the ratio needed to trip the merchant tier depends on volume:

Below 100,000 sales a month the merchant tier is hard to reach, which is not the same as safe.

Asia Pacific merchants also face a separate Merchant Elevated Risk Program (Core Rules section 10.4.4.4), which took effect in October 2026 according to Stripe. It carries assessments of USD 25,000 for a first identification and USD 50,000 for a repeat, and Visa does not publish its thresholds.

How Much Are VAMP Fees?

The amounts are flat USD in every region; I found no regional fee schedule. Checkout.com and Antom both describe the fee as charged per dispute or fraud report and neither says it applies only to the excess above the threshold, so budget for the whole count. In the worked example that is 2,000 × USD 8 = USD 16,000 for the month. Because a reported and disputed order counts twice, it plausibly costs USD 16 in VAMP fees on top of the PSP's dispute fee, which at Stripe UK is £20 plus another £20 if you contest.

The second row is the trap. Visa's fact sheet applies the merchant thresholds only "if acquirer is not Above Standard or Excessive". Once your acquirer's whole portfolio crosses 70 bps, any merchant at 50 bps or more pays, and Stripe lists the minimum count for that tier as 5, not 1,500. Your exposure depends on the other merchants your acquirer signs.

First identifications in a rolling 12 months get a grace period. Antom and Solidgate both say 90 days; Checkout.com does not give a length. In the AP and Europe regions, Checkout.com says VAMP fees do not apply where a chargeback already incurs an unsecured dispute fee. Visa measures each statement descriptor and acquirer combination separately, so splitting traffic across descriptors can look like a way to stay under the 1,500 floor. Visa anticipated that: Core Rules 12.5.3.2 sets a USD 25,000 per merchant per month penalty for altering merchant names or data to get around VAMP.

Do RDR, CE 3.0 and 3DS Lower Your VAMP Ratio?

Partly. The fact sheet excludes "disputes resolved through pre-dispute solutions" and "TC 40 fraud qualified for Compelling Evidence 3.0", both contingent on when Visa extracts the data. Everything else stays in.

The Merchant Risk Council reported that Visa chose not to exclude TC40s linked to RDR and CDRN resolutions, and Adyen's documentation says the same. One conflict: Checkout.com's docs table lists CDRN, Ethoca, RDR and Verifi under TC40 exclusions, which contradicts its own support article. I would trust the majority.

The 3DS point catches UK teams out. Under SCA a large share of UK CNP volume is authenticated, the liability shift removes the issuer's fraud dispute right, and teams assume that protects them. It halves the problem. The TC40 still gets filed and still counts, because nothing in the fact sheet excludes authenticated transactions. The 3DS2 frictionless vs challenge guide explains what the ECI values mean for liability.

What Is the VAMP Enumeration Ratio?

Card testing has its own measure. Visa's fact sheet defines it as enumerated authorisations, approved and declined, divided by all authorisations, approved and declined. A merchant breaches it at 2,000 bps (20%) with at least 300,000 enumerated attempts in the month. Visa Account Attack Intelligence flags which attempts are enumeration.

Declines count, so blocking a BIN attack at the issuer does not keep you out of the numerator. Only stopping the attempts before authorisation does. Sources disagree on the cost: Stripe says "Visa doesn't assess fines for VAMP enumeration monitoring", while Checkout.com and Antom list USD 8. Treat it as a fee risk until your acquirer confirms otherwise.

Visa VAMP vs Mastercard ECP and EFM

Mastercard still runs two programmes where Visa runs one: the Excessive Chargeback Program (ECP), with its Excessive Chargeback Merchant (ECM) and High Excessive (HECM) tiers, and the Excessive Fraud Merchant (EFM) programme, which adds a 3DS test.

The trade-off is scale against escalation. VAMP fees grow with your volume from the first month after the grace period, so a large merchant at 160 bps pays tens of thousands a month straight away. Mastercard's fines are flat amounts that escalate with time in the programme, which hurts a small merchant more: ECM month 7 costs 25,000 whatever your size. Mastercard also lets issuers recover EUR/USD 5 per chargeback above 300 from month 4, and a merchant leaves ECP only after three consecutive compliant months.

The 3DS criterion is the sharpest difference for UK and EU merchants. EFM only catches merchants authenticating under 50% of volume in regulated markets, and SCA pushes most of them above that. VAMP has no equivalent exemption.

Mastercard's side is about to change. According to payabl and Chargebacks911, Mastercard announced in July 2026 a Global Merchant Audit Program replacing its chargeback monitoring from 1 April 2027, with the ECM threshold stepping down to 1.3% in 2029, 1.1% in 2030 and 0.9% in 2031. I have not seen the bulletin itself, and the two sources disagree on whether ECP and EFM survive alongside it.

How to Track Your VAMP Ratio with Stripe and Adyen

Both PSPs expose TC40s as their own webhook event, separate from disputes. Stripe calls them early fraud warnings:

{
  "id": "issfr_1QxExample",
  "object": "radar.early_fraud_warning",
  "actionable": true,
  "charge": "ch_3QxExample",
  "created": 1793577600,
  "fraud_type": "made_with_stolen_card",
  "livemode": true,
  "payment_intent": "pi_3QxExample"
}

Adyen also passes through Visa's newer codes 9 and A to D, which cover acquirer-reported counterfeit, account takeover and merchant misrepresentation among others. Stripe's seven values have no slot for those. I'd expect them to arrive as misc, though Stripe doesn't document it.

Stripe's documented Sigma query computes the ratio as (d.dispute_count_exrdr + e.efw_count) / p.sales_count, excluding disputes whose status is prevented, which is how RDR resolutions appear. CE 3.0 eligibility shows on the dispute as enhanced_eligibility_types: ["visa_compelling_evidence_3"].

Why Your Real VAMP Threshold Is 50 Basis Points

This is opinion. The 150 bps figure is what every guide leads with, but for most merchants it is not the number that bills them. A merchant below 100,000 Visa CNP sales a month cannot reach the 1,500-event floor at 150 bps, yet it can pay USD 8 per event at 50 bps the moment its acquirer's portfolio passes 70 bps. You do not control that portfolio. Engineer to 50 bps, alert at 40, and treat anything between 50 and 150 as a live fee risk.

A prediction, clearly marked as one: Visa will publish a merchant threshold below 150 bps before Mastercard's 1.3% step lands in 2029. Visa set the 220-to-150 glide path once and only slipped it by a quarter, and it will not want Mastercard's audit programme to look stricter than its own.

What This Means for Payment Teams in the UK and EU

1. Store TC40s next to disputes, keyed on the transaction. Ingest Stripe early fraud warnings or Adyen NOTIFICATION_OF_FRAUD into the same table as disputes, and count a transaction twice when it has both. 2. Compute the ratio the way Visa does. Visa cards only, card-not-present only, by calendar month of receipt, per descriptor and acquirer. Exclude prevented disputes; keep every TC40. 3. Enrol in RDR and Order Insight, but model them honestly. They remove the dispute half. Only CE 3.0-qualified TC40s leave the numerator. 4. Stop leaning on 3DS for VAMP. SCA moves liability and removes the fraud dispute; the fraud report still counts. The SCA exemptions guide covers where you can skip a challenge without making this worse. 5. Ask your acquirer, in writing, where its portfolio sits. Above Standard (50 to 70 bps) and Excessive (70 bps and up) change your exposure more than your own numbers do. Get the pass-through terms for the USD 4 and USD 8 fees into the contract. 6. Block card testing before authorisation. The enumeration ratio counts declines. Rate limits per card, per IP and per device belong in front of the PSP call. 7. Do not split descriptors to stay under the floor. It is a USD 25,000-a-month penalty.

If you are building a dispute and fraud data pipeline across several acquirers and want a second opinion, you can reach me through Tom Wang.

Key Takeaways

• VAMP ratio = (TC40 + TC15) / settled CNP transactions, by count and calendar month. A reported and disputed order counts twice.
• Merchant Excessive is 150 bps and 1,500 events in the UK, Europe, the US, Canada, AP and LAC; CEMEA stays at 220 bps.
• An acquirer above 70 bps exposes every merchant at 50 bps or more to USD 8 per event.
• RDR, alerts and 3DS remove only the dispute half. Only CE 3.0-qualified TC40s leave the ratio.
• Mastercard ECP counts chargebacks against last month's sales and fines by month in the programme; EFM exempts merchants with enough 3DS volume.