Effective 1 May 2023, Visa introduced the Visa Integrity Risk Program (VIRP) to replace the Global Brand Protection Program (GBPP). We examine the updated requirements for acquirers and their agents regarding high-risk merchants.
Visa and Mastercard maintain high-risk or high brand-risk programs with broadly similar objectives. They exist to protect the card schemes and their participants from illegal and brand-damaging transactions that pose significant fraud, regulatory, or legal risks, or may cause reputational damage.
Several merchant sectors are listed on these programs due to the goods or services sold, for example, gambling and drug merchants.
However, There is an increasing need to consider how sales are made.
Negative option sales models, free trials, and deceptive marketing practices in general can render any card transaction illegal, even if the goods and services sold are perfectly legal. Every merchant type is susceptible, because it is not what the merchant sells, it is how they sell it that creates risk for acquirers and card schemes.
Both card schemes require acquirers to register and demonstrate that they have adequate controls in place before acquiring merchants in specific sectors.
Visa Integrity Risk Program (VIRP) overview
As VIRP replaced Visa’s Global Brand Protection Program (GBPP), the term ‘high integrity risk merchant’ replaced the term ‘high brand-risk merchant’. Visa describes high integrity-risk merchants as those operating in business types that are legal, but at heightened risk of processing illicit transactions.
There are now three tiers of high integrity risk merchants, with tier 1 being the highest risk tier. Each tier requires commensurate due diligence and controls to mitigate the risks the merchants bring. Please see the table below for a list of merchants and tiers.
High integrity risk MCCs
The high integrity risk MCCs are grouped into three tiers.
Tier 1 MCC
High risk due to sensitive or regulated but legal services:
- Adult content – MCC 5967
- Dating and escort services- MCC 7273
- Gambling – MCC 7995
- Pharmacies – MCC 5122 and 5912
Tier2 MCC
High risk tied to emerging payment models:
- Crypto – MCC 6051 and 6012
- Cyberlockers – MCC 5816
- Game of skills – MCC 5816
Tier 3 MCC
High risk from complex sales or distribution methods:
- Security brokers – MCC 6211
- Outbound telemarketing – MCC 5966
- Subscription merchant – MCC 5968
- Cigar stores – MCC 5993
Visa Integrity Risk Program (VIRP) registration requirements
- Acquirers must register for all merchants operating in high integrity risk categories via the High Integrity Risk Registration (HIRR) system.
- Separate registration is required to become Tier1, Tier 2, or Tier 3 merchant. Tier 1 approval includes Tier 2 and Tier 3. Tier 2 approval includes Tier 3. Tier 3 approval includes only Tier 3.
- Former high brand-risk acquirers under GBPP can continue to process Tier 1 and Tier 2 merchants if they have processed transactions for those categories within the 12 months preceding 6 April 2023, though they still must obtain separate approvals for any Tier 1 categories not already processed.
- Acquirers contracting with third-party agents, such as ISOs, payment facilitators, or digital wallet operators for onboarding high integrity risk merchants are required to register those agents. They need to conduct proper due diligence on agents, their onboarding and monitoring processes, and subject those to assurance and formal oversight at least annually.
G2 Risk Solution is set up for VIRP. If you have any questions about any aspect of the program, please don’t hesitate to contact us.