The 2026 Guide to Visa VAMP, Mastercard CMM, and ECM Thresholds

What are VAMP, CMM, and ECM?

Visa, Mastercard, and other card networks run monitoring programs that track merchant dispute and fraud ratios. When a merchant's ratios exceed certain thresholds, the card network imposes warnings, fines, or bans.

These programs exist to protect cardholders. But most merchants have never heard of them. They find out the hard way when their payment processor (Stripe, Square, PayPal) freezes their account, holds their funds, or terminates their service.

Here are the three programs you need to know about in 2026.

Visa VAMP (Acquirer Monitoring Program)

Visa restructured its dispute monitoring in 2026 under the VAMP program. Here are the numbers that matter.

Threshold: 1.5% combined fraud and dispute ratio

How it's calculated: (TC40 Fraud Reports + Disputes) / Total Settled Transactions

TC40 reports are fraud alerts that issuing banks send to Visa when a cardholder reports a transaction as fraudulent. These count toward your VAMP ratio even if the cardholder never files a formal dispute.

What happens when you breach 1.5%:

• Visa notifies your acquirer (Stripe, in most cases)
• Financial penalties begin immediately
• Stripe passes these costs through to you or takes action on your account
• Continued breach leads to enrollment in a formal remediation program

What most merchants get wrong: They only count disputes. VAMP includes fraud reports (TC40s) that you may never see in your Stripe dashboard. A customer can report a charge as fraudulent to their bank without filing a chargeback, and it still counts against your ratio.

Mastercard CMM (Chargeback-Monitored Merchant)

Mastercard runs a two-tier system. CMM is the warning tier.

Threshold: 1.0% dispute ratio AND 100+ disputes in a calendar month

How it's calculated: Disputes / Total Settled Transactions

Both conditions must be met. If your ratio is 1.2% but you only have 80 disputes, you don't technically enter CMM. But Stripe may still take action based on the ratio alone.

What happens at CMM:

• Mastercard issues a formal warning to your acquirer
• No financial penalties yet
• You're expected to bring your ratio below 1.0% within a defined period
• Failure to improve moves you to the ECM tier

The real risk at CMM: Even though there are no Mastercard fines, Stripe often takes independent action when you enter CMM. They may add rolling reserves (holding 5-10% of your revenue for 90-180 days), restrict certain capabilities, or request additional documentation about your business.

Mastercard ECM (Excessive Chargeback Merchant)

ECM is the penalty tier. This is where it gets expensive.

Threshold: 1.5% dispute ratio AND 100+ disputes for 2 consecutive months

How it's calculated: Same as CMM. Disputes / Total Settled Transactions.

The “2 consecutive months” requirement means you need to be above 1.5% with 100+ disputes in both the current month and the previous month to formally enter ECM.

What happens at ECM:

• Fines starting at $25,000 per month
• Fines escalate the longer you stay in the program, potentially reaching $100,000+ per month
• Mandatory remediation plan submission
• Potential placement on the MATCH/TMF list

What is the MATCH list?MATCH (Member Alert to Control High-risk merchants) is effectively a blacklist shared across all card processors. If you're placed on MATCH, no major processor will work with you for 5 years. Not Stripe, not Square, not PayPal, not anyone. Your business loses the ability to accept card payments.

Visa Enumeration (Card Testing)

This is a separate program focused on detecting card-testing bot attacks.

Threshold: 20% decline rate

When bots test stolen card numbers against your checkout, they generate a high volume of declined transactions. Visa monitors your decline rate and flags merchants exceeding 20%.

What happens: Visa can impose fines on your acquirer, and Stripe will pass those costs to you or restrict your account. You may also see a spike in fraudulent charges from the cards that passed the test.

How to prevent it:

• Enable CAPTCHA on your checkout page
• Use Stripe Radar rules to block suspicious velocity patterns
• Enable 3D Secure for high-risk transactions
• Monitor your decline rate weekly

How to Calculate Your Own Ratios

Here are the exact formulas.

VAMP Ratio (Visa):

(TC40 Fraud Reports + Disputes) / Total Settled Transactions

Mastercard Dispute Ratio (CMM and ECM):

Disputes / Total Settled Transactions

Decline Rate (Enumeration):

Declined Transactions / Total Transaction Attempts

All ratios use a rolling 30-day window.

Where to get the numbers from Stripe:

• Disputes:Stripe Dashboard > Payments > Disputes, filter to last 30 days, count the total
• Charges:Stripe Dashboard > Payments, filter to last 30 days, count successful charges
• Fraud warnings: You need API access. GET /v1/radar/early_fraud_warnings
• Decline rate:Stripe Dashboard > Payments, compare total vs declined

The problem is doing this manually every day. Most merchants check once, see a low number, and never look again. The ratio can climb quickly if you have a few bad weeks.

What Stripe Does When You Approach These Thresholds

Stripe runs its own monitoring on top of the card network programs. They often take action before you officially enter VAMP or ECM.

Common actions Stripe takes:

• Adding items to requirements.currently_due on your account (this happens silently, with no email notification)
• Changing account capabilities from “active” to “restricted” or “pending”
• Imposing rolling reserves (holding 5-10% of your volume for 90-180 days)
• Requesting additional documentation about your business model
• Pausing payouts pending review
• Terminating the account entirely

The information asymmetry problem:Stripe sees your ratios in real time. You don't. They make decisions based on data you can't access through the dashboard. By the time you get an email about an issue, the decision has already been made.

How to Stay Below the Thresholds

Respond to every dispute.Even if you think you'll lose. Submitting evidence shows card networks you're actively managing disputes.

Submit evidence quickly.You have a limited window (usually 7-21 days depending on the network). Don't wait until the deadline.

Know which disputes to fight. Not all reason codes have the same win rate:

• product_not_received with tracking proof: approximately 70% win rate
• fraudulent without 3D Secure: approximately 20% win rate
• subscription_canceled with clear terms: approximately 50% win rate

Enable 3D Secure.This shifts fraud liability from you to the card issuer. Disputes on 3D Secure transactions don't count toward your ratio in most cases.

Monitor refund velocity.A sudden spike in refunds can signal problems to Stripe's underwriting algorithms, even if your dispute ratio is fine.

Consider proactive refunds. If you see an early fraud warning (TC40) for a charge, refunding it before the customer files a formal dispute keeps it out of your dispute count. The refund costs you the transaction amount, but it protects your ratio.

Tools for Monitoring

Manual: Check your Stripe Dashboard disputes weekly and do the math yourself. Free but easy to forget.

ShieldScore (free Stripe App): Runs inside your Stripe Dashboard and calculates your ratios automatically. Shows a health score from 0 to 100, tracks trends over 7 days, estimates days until each threshold, and sends email alerts when ratios cross warning levels. Also detects hidden account restrictions. Free on the Stripe App Marketplace.

Chargeflow / Chargeback.io: Focus on fighting disputes after they happen, not monitoring ratios. Complementary to ShieldScore, not a replacement.

Key Numbers to Remember

Safe zone: Keep your dispute ratio below 0.5%. Monitor weekly. Act immediately if you see it climbing.

Warning zone: 0.5% to 1.0%. Investigate the source of disputes. Review your fulfillment, billing descriptors, and refund policy.

Danger zone: Above 1.0%. Take immediate corrective action. Every dispute at this level moves you closer to fines and account restrictions.

ShieldScore is a free Stripe App that monitors your dispute ratios against these thresholds in real time. Install it from the Stripe App Marketplace.