This is the first in a 3-part series on systematizing merchant risk and compliance programs to better prepare for card-network scrutiny.
The world of merchant acquiring thrives on calculated risks, but all too often, payments processors accept merchant category codes (MCCs) at face value. While it’s impossible to eliminate risk, setting up systems that prioritize and enforce accurate MCC assignments is a powerful first step in growing a payments business with confidence.
MCCs: The basics
Originally introduced by the IRS to simplify tax reporting, MCCs are four-digit codes used to categorize businesses based on the products or services they offer. A pharmacy will have a different MCC than a clothing store, which in turn differs from a restaurant or bar.
Over time, MCCs have evolved into a cornerstone of growth and risk management programs, helping payments processors:
- Reduce assessment risk: MCCs can be hidden triggers used by card networks to identify potential compliance issues with seemingly low-risk merchants. By proactively addressing these concerns, you can avoid unnecessary network scrutiny and potential fines.
- Mitigate chargeback liability: Misclassified merchants can lead to a surge in chargebacks due to inconsistencies between transaction types and assigned MCCs. Accurate MCCs minimize this risk, helping prevent fraudulent transactions by ensuring the type of purchase aligns with the assigned category.
- Optimize interchange rates: While high-risk MCCs often come with higher interchange rates, inaccurate classifications can lead to missed opportunities for network-negotiated discounts available for specific, lower-risk subcategories within a high-risk MCC.
The high danger in “low-risk” MCCs
If you’re thinking—We only underwrite low-risk merchants, so we’re safe—then this post is especially for you. It may seem counterintuitive, but low-risk MCCs along with those grouped into “miscellaneous” codes (ending in two or three nines…like 8099 or 8999) can put you at higher risk for non-compliance assessments. Acquirers who play in high-risk areas (like gambling, adult content, and pharmaceuticals) typically have their guard up with robust monitoring in place, while those who manage seemingly lower-risk portfolios can be lulled into a sense of false security.
The danger zone in merchant acquiring sits between what a merchant says they sell versus what they actually sell. Consider: Is there any chance that a merchant who provided you with “MCC 5399 Miscellaneous General Merchandise” sells fireworks, cannabis, or weapons? Now imagine a card network asks to review your merchant portfolio. Are you certain that each MCC is complete and accurate? Would you bet your business on it?
MCCs and compliance reporting
Low-risk and miscellaneous MCCs can act as red flags for auditors as they review merchant portfolios for content violations and transaction laundering fraud. Putting systems in place to ensure MCCs are accurate in your merchant portfolio is an often-overlooked strategy for payments businesses looking to grow while remaining at-the-ready to comply with reporting and auditing requirements.
The importance of ongoing monitoring
Even with accurate MCC assignment at onboarding, a merchant’s offerings can evolve over time. For example, a salon initially categorized as a beauty shop (MCC 7230) might start selling CBD products, introducing a new risk profile. It’s important that you make sure to re-check merchant MCCs at regular intervals to identify changes and ensure the assigned MCC continues to reflect the merchant’s business accurately.
Next steps
- Read the next two parts of this series: Future-proofing your payments business against reputational damage and Future-proofing your payments business with effective change detection.
- Watch our webinar, Future-proofing Merchant Compliance, for a conversation with two industry veterans who talk about how they plan for and respond to card network requests.
- Need help? Contact us. We’re here to help.