Visa and Mastercard operate monitoring programs that track chargeback and fraud ratios across merchant accounts on an ongoing basis. When a merchant's ratios exceed defined thresholds, they are enrolled in a monitoring program. For merchants in Europe, the most relevant are Visa's VAMP (Visa Acquirer Monitoring Program) and Mastercard's equivalent programs, which track the same chargeback and fraud metrics. Once enrolled, the merchant typically faces ongoing fees that increase with the duration of enrollment, and the acquiring bank faces its own compliance obligations in relation to the enrolled merchant. Visa has also introduced evidentiary frameworks that allow merchants to challenge specific categories of fraud disputes by demonstrating prior legitimate transactions with the same cardholder. These frameworks change the representment approach for merchants with clean transaction histories in subscription and digital commerce verticals. iGaming operators, subscription merchants, and adult content platforms are among the business models most commonly affected. The time between a ratio breach and scheme notification can be short, which is why continuous chargeback monitoring rather than periodic review is the appropriate operational standard.

Understanding how card scheme rules for merchants define and calculate chargeback ratios is the starting point for any serious compliance monitoring program. A chargeback ratio is calculated as the number of chargebacks received in a given month divided by the total number of transactions processed in that same month. Visa and Mastercard apply their own calculation methodologies, which differ slightly in how they count transactions and chargebacks. Merchants should not assume their internally calculated ratio matches the scheme's view. Visa's VAMP program defines specific chargeback and fraud ratio thresholds that trigger enrollment. These thresholds are published in Visa's scheme rules and updated periodically. Merchants should verify current thresholds directly with their acquiring bank or payment partner rather than relying on figures that may have changed since any given piece of content was written. Mastercard operates its own equivalent monitoring programs with a similar threshold structure. These thresholds apply at the merchant category code and acquiring bank level, meaning the same merchant may have different exposure depending on how transactions are coded and through which acquirer they process.

Anti-money laundering compliance requires merchants to have documented processes for identifying customers, monitoring transaction patterns for suspicious activity, and reporting suspicious transactions to the relevant financial intelligence authority. In the EU, AML obligations derive from the Anti-Money Laundering Directives and are implemented through national legislation. The EU's AML framework is evolving, with new supranational oversight structures being introduced. Merchants should monitor updates to AML requirements through their acquiring bank and legal advisors, as the regulatory environment governing these obligations continues to develop. For merchants operating in regulated verticals, including iGaming, crypto, and financial services, AML requirements are more extensive and typically include transaction monitoring thresholds, customer due diligence at specified value levels, and enhanced due diligence for higher-risk customers. Acquiring banks require merchants to demonstrate adequate AML controls as part of onboarding and ongoing account maintenance.

Know Your Customer requirements mandate that financial institutions, payment institutions, and other regulated entities verify the identity of their customers before establishing a business relationship. In the context of merchant acquiring, KYC applies at two levels: the acquirer's KYC of the merchant during onboarding, and the merchant's own KYC obligations toward its end customers where applicable. The mechanisms for conducting KYC have evolved alongside digital onboarding, with electronic verification tools now widely accepted by acquirers for standard documentation. The obligation itself has not changed, but how merchants fulfill it continues to develop. For merchants in regulated industries, failure to demonstrate adequate KYC processes is a material risk to the acquiring relationship. Acquirers are required to conduct ongoing due diligence on their merchant portfolio, which means KYC is not a one-time onboarding exercise. It is a continuous obligation that requires documented processes and periodic review.

Strong Customer Authentication under PSD2 requires that electronic payments be authenticated using at least two of three factors: something the customer knows such as a password or PIN, something they own such as a phone or card reader, or something they are such as a biometric. SCA applies to customer-initiated online card transactions within the European Economic Area. There are defined exemptions, including low-value transactions below the threshold defined in the applicable regulatory technical standards, merchant-initiated transactions, and transactions assessed as low-risk through transaction risk analysis, but these exemptions are subject to conditions and issuer discretion. Merchants should confirm current exemption thresholds with their payment partner. Merchants whose payment infrastructure is not correctly configured for SCA compliance face higher decline rates from issuers applying authentication requirements. SCA requirements are set to evolve as PSD2 is superseded by updated EU payment services regulation. The core authentication principle of two-factor verification is expected to continue, but merchants should monitor regulatory developments through their acquirer or compliance advisor.

Fraud chargebacks, classified under reason codes related to unauthorized transactions, occur when a cardholder states they did not authorize a payment. Dispute chargebacks cover a broader category including non-delivery of goods or services, goods not as described, and processing errors. The distinction matters for two reasons. First, fraud chargebacks feed directly into the scheme fraud ratio calculations that trigger monitoring programs. Dispute chargebacks contribute to the overall chargeback ratio but do not feed the fraud ratio, which is tracked and monitored separately by the card schemes. Second, the representment strategy, meaning the process of challenging a chargeback, differs depending on the reason code. For fraud chargebacks specifically, Visa has introduced evidentiary frameworks that allow merchants to challenge disputes by demonstrating prior legitimate transaction history with the same cardholder. These frameworks apply to specific dispute reason codes and have changed the representment approach for merchants in subscription and digital commerce verticals. Treating all chargebacks the same operationally is a common error that leads to preventable losses and unnecessarily elevated ratios.

Representment is the process of formally disputing a chargeback by submitting evidence to the card scheme that the original transaction was valid and authorized. A successful representment results in the funds being returned to the merchant. However, under the card scheme monitoring program calculations, chargebacks are counted when they are filed. A successful representment recovers revenue but does not remove the dispute from the ratio calculation. This means representment is a financial recovery tool, not a ratio management strategy. A merchant with a structurally elevated chargeback ratio cannot resolve that through representment alone. The underlying causes of the chargebacks must be addressed operationally. For merchants enrolled in or approaching a scheme monitoring program, the priority is reducing the volume of incoming chargebacks, not winning representments on existing ones. Representment addresses individual disputes. Monitoring program exit requires addressing the operational patterns generating them.

Subscription payment compliance encompasses the full set of scheme rules, notification requirements, and billing presentation standards that recurring merchants must meet to maintain compliant merchant accounts. Visa and Mastercard have both published updated rules governing recurring transactions that require merchants to notify cardholders before charging, provide clear cancellation mechanisms, and present recurring transactions with specific descriptor formats that allow cardholders to identify the charge. Free trial billing, negative option billing, and auto-renewal models all have specific requirements that are updated periodically as card schemes respond to consumer complaint patterns in these billing models. Non-compliance is a primary driver of elevated chargebacks in subscription verticals because cardholders who do not recognize a charge, or who believe they cancelled, dispute the transaction rather than contacting the merchant. Subscription merchants represent one of the business models most frequently enrolled in card scheme monitoring programs as a direct result of recurring billing compliance failures. The operational overlap between subscription compliance and chargeback ratio management means that billing compliance is not a regulatory checkbox. It is a direct input to acquiring account stability. Compliance with recurring billing rules is therefore both a regulatory obligation and a practical chargeback reduction strategy.

Scaling compliance alongside volume is one of the defining challenges of merchant payment operations, and the gap between the two is where most avoidable consequences originate. Compliance obligations do not scale automatically with volume. They require deliberate operational investment. A merchant processing low volume can manage scheme thresholds informally. A merchant processing significant volume across multiple acquirers and markets needs documented monitoring processes, clear escalation paths for emerging threshold risks, and a compliance function that operates continuously rather than reactively. The merchants who face the most damaging compliance consequences are typically those who grew their volume without updating their compliance operations to match. The point at which compliance becomes a dedicated operational function rather than a periodic review is earlier than most merchants expect. These are the patterns StreamPayments monitors across every merchant relationship we manage, and the point at which we typically intervene is before volume growth exposes a compliance gap, not after.