Fact-Checked by: 
In September 2025, Visa announced that it had identified more than $1 billion in fraud attempts over the past year.[1]Visa Perspective. “Protecting Consumer Payments, One Billion Dollars at a Time.” Accessed October 8, 2025. In response, Visa is taking a holistic approach to cracking down on fraud in its payments ecosystem. One of its main tools is the Visa Integrity Risk Program (VIRP).
VIRP is Visa’s updated compliance framework, which aims to prevent illegal activity on the payment network by providing strict requirements to merchants in high-risk sectors. The program replaces the Global Brand Protection Program (GBPP), bringing tighter controls, more compliance requirements, and mandatory registration for merchants and acquirers.
If your business operates in a high-risk industry, understanding VIRP is essential. In our Visa Integrity Risk Program guide, we break down how it works, associated costs, and what high-risk merchants need to do to stay compliant in 2025 and beyond.
Key Takeaways
- VIRP increases compliance requirements for high-risk merchants and acquirers.
- High-risk merchants are categorized into three tiers based on their risk level.
- Acquirers working with Tier 1 and Tier 2 merchants must undergo Visa control assessments.
- High-risk merchants must now pay higher Visa Integrity Risk Program fees.
- Non-compliance may result in steep fines and loss of access to Visa’s network.
- High-risk payment providers can help businesses navigate the program and ensure compliance.
An Overview of the Visa Integrity Risk Program (VIRP)
Launched on May 1, 2023, the Visa Integrity Risk Program (VIRP) replaced the Global Brand Protection Program (GBPP). The program helps Visa manage potential issues arising from merchants operating in industries that are legal but prone to illegal activity — think adult content, gambling, crypto, and subscription services.
Under VIRP, high-risk merchants are divided into three risk tiers, with Tier 1 being the highest risk. Acquirers servicing merchants in Tier 1 and Tier 2 are subject to control assessments. While acquirers servicing Tier 3 may not require upfront control assessments, Visa reserves the right to request additional assessments as needed. All VIRP‑eligible merchants must be registered.[2]Visa. “Visa Integrity Risk Program.” Accessed October 8, 2025.
Aimed at combating illegal activity on the card network, the Visa Integrity Risk Program’s new regulatory requirements include age verification for age-sensitive industries, content moderation, real-time transaction monitoring, and other internal controls. In addition to the expense of investing in these new compliance measures, the new program significantly increases registration fees from $500 to $950 per provider, plus ongoing transaction fees. These combined costs can severely impact margins for high-risk businesses.
While VIRP makes high-risk payment processing more challenging, it also benefits merchants. The new requirements outlined in the program help merchants reduce payment risk and prevent fraud. Ultimately, this can help businesses combat chargebacks and other payment disputes. And with Mastercard reporting that the average transaction value of chargebacks in the United States is $110, compliance that prevents payment disputes is increasingly valuable.[3]Mastercard. “What’s the True Cost of a Chargeback in 2025?” Accessed October 8, 2025.
High Integrity Risk Merchants Tier Levels
Visa divides high-risk merchants into three tier levels: Tier 1, Tier 2, and Tier 3. Acquirers working with Tier 1 and Tier 2 businesses require a Visa control assessment. Understanding which MCC codes qualify for VIRP is essential to ensure full compliance. Let’s explore the MCCs for each tier below:
| Tier | Risk Level | Control Assessment | Examples (MCC Codes) |
| Tier 1 | Highest | Required per MCC | Adult content (5967), Gambling (7995), Online Pharmacies (5122, 5912), Dating services (7273) |
| Tier 2 | High | Required per Tier | Crypto (6051, 6012), Cyberlockers (4816), Skill gaming (5816) |
| Tier 3 | Moderate | Not required, but can be requested | Telemarketing (5966), Tobacco (5993), Subscription negative-option billing (5968) |
If you’re unsure of your Merchant Category Code (MCC), contact your provider or check your acquiring bank documentation.
Tier 1
Tier 1 merchants face the strictest oversight under VIRP. Acquirers working with these businesses must undergo mandatory Visa control assessments for each MCC. These merchants are subject to comprehensive compliance, higher fees, and ongoing audits. Annual reassessments are required.
Tier 2
Tier 2 businesses are considered high risk and require control assessments at the tier level (not per MCC). While slightly less stringent than Tier 1, they still face enhanced due diligence, annual reviews, and must comply with all VIRP standards.
Tier 3
Tier 3 merchants are under moderate risk. Control assessments are not required by default, but Visa may request them at any time. While oversight is lighter, full registration and compliance with VIRP rules — including transaction monitoring and age verification where applicable — is still mandatory.
VIRP Regulatory Requirements for 2025
In 2025, VIRP-eligible business must adhere to regulatory requirements where applicable, which include:
- Real-Time Transaction Monitoring: Merchants in high-risk industries must use real-time transaction monitoring to spot and prevent suspicious charges.
- Mandatory Age Verification: Merchants in high-risk industries must now use age verification to ensure customers can legally purchase goods or services. This is particularly critical for age-sensitive industries, such as tobacco or adult entertainment.
- Content Moderation: Visa has content compliance standards that must be adhered to by businesses hosting user-generated content. Merchants hosting user-generated content must now be much more careful about the content that appears on their platforms.
- Member Authentication Standards: Businesses offering subscription payments, memberships, or recurring billing must employ robust member authentication standards to avoid fraudulent sign-ups and payments.
Higher Fees & Stricter Terms
In addition to increased compliance requirements, the Visa Integrity Risk Program fees are higher than those of its predecessor program:
- Registration Fee: $950 registration fee, up from $500
- Transaction Fee: $0.10 per transaction
- Volume-Based Fee: 0.10% of total processing volume
Unfortunately, the higher costs aren’t restricted to VIRP’s direct fees. As compliance requirements increase, acquirers may pass on the costs to merchants. Likewise, payment providers are strengthening their terms of service to avoid any exposure to VIRP violations, resulting in tighter operating conditions for merchants.
How Does VIRP Affect High-Risk Merchant Onboarding?
When high-risk merchants apply for payment services, VIRP significantly impacts onboarding. Payment providers must ensure VIRP-eligible merchants are correctly categorized, reported to Visa, and adhere to the strict compliance guidelines. Otherwise, severe penalties for the payment provider and merchant are applicable. Let’s explore the various ways VIRP impacts high-risk merchant onboarding:
Extensive Documentation
While low-risk merchants must also submit documentation during the merchant account onboarding process, the documentation required for VIRP-registered merchants is much more extensive. As acquirers must undergo rigorous control assessments and compliance checks to process high-risk businesses, they now require comprehensive documentation about your operations, products, internal risk controls, fraud prevention systems, and compliance infrastructure.
Longer Approval Time
With VIRP’s extensive documentation and enhanced reporting requirements, merchant account providers now require significantly longer approval timelines for high-risk businesses. Information disclosures and control assessments can extend the application process for weeks.
Enhanced Due Diligence
While all merchant account providers perform standard due diligence and underwriting, VIRP mandates significantly enhanced due diligence procedures for merchants classified in any of its three risk tiers. The level of due diligence varies depending on the merchant’s tier classification. Regardless of your business’s tier, the initial due diligence means the onboarding process will take longer than with low-risk merchants.
Mandatory Ongoing Monitoring
While VIRP requires extensive upfront work before a high-risk merchant can begin accepting credit card payments, it also mandates ongoing monitoring to ensure compliance. Likewise, control assessments aren’t a one-and-done deal. Annual reassessments are required for Tier 1 and Tier 2 merchants, and Visa reserves the right to audit Tier 3 merchants at any time. Your business must follow all guidelines outlined by VIRP to ensure ongoing access to the Visa network.
VIRP Compliance and Best Practices
For businesses that fall into Visa’s high-risk tiers, non-compliance with VIRP can result in significant fines or the closure of a business’s merchant account. Here are five tips for ensuring your business remains compliant with Visa’s new rules:
- Choose a High-Risk Payment Provider: General-purpose providers may not be equipped to handle VIRP’s complexity. By choosing a high-risk payment provider, you gain a payment partner with the experience and resources necessary to ensure your business remains compliant.
- Track Tier Classification Changes: Your industry’s VIRP tier is subject to change at any time. Always keep tabs on your MCC’s classification.
- Maintain Detailed Records: Visa expects robust reporting on customer interactions and transaction data. Failing to keep detailed records may result in non-compliance with VIRP.
- Develop Staff Training Programs: Train employees on VIRP requirements, compliance procedures, and risk identification to ensure adherence to program standards across your business. Regular training updates are essential, as VIRP is an evolving program. Ask your payment provider for guidance on training staff members to ensure all information follows VIRP requirements.
- Report Issues Promptly: Notify your payment provider immediately if you identify suspicious transaction patterns, compliance violations, or potential illegal activity on your platform. Prompt reporting demonstrates proactive risk management and can help prevent enforcement action from Visa.
Closing Thoughts: The Impact of VIRP on High-Risk Businesses
The Visa Integrity Risk Program (VIRP) places much more responsibility on the shoulders of high-risk merchants and the payment providers that service them. It represents a significant shift in Visa’s approach to managing high-risk activity on its network, but it doesn’t have to be a roadblock.
At PaymentCloud, we specialize in helping high-risk businesses meet today’s strictest compliance standards. From navigating tier classification to passing control assessments, we can help you stay ahead of the curve. Contact us today to see how we can support your high-risk business.
Running a high-risk business doesn’t have to be risky.
We know how to help.
PaymentCloud has a 98% approval rating.
Approval
Rating
Frequently Asked Questions
What are the latest pricing and fee updates on Visa’s Integrity Risk Program?
The Visa Integrity Risk Program (VIRP) carries significant fees. As of April 1, 2024, the registration fee increased from $500 to $950. There’s also a $0.10 per transaction fee, 0.10% of processed volume fee, and penalties for non-compliance.
What penalties result from VIRP non-compliance?
Non-compliance with VIRP poses severe risks to both merchants and their payment providers. Failure to register appropriately may result in significant fines to acquirers. If Visa finds that an acquirer in any way changes merchant details (such as merchant name, MCC, or merchant data) to avoid VIRP registration, Visa may charge the acquirer a non-compliance assessment of $25,000 fee for each impacted merchant.[4]Visa. “Visa Core Rules and Visa Product and Service Rules.” Accessed October 8, 2025.
How does VIRP differ from the old GBPP?
Replacing the Global Brand Protection Program (GBPP) on May 1, 2023, VIRP is a much stricter program. The primary difference is that VIRP introduced a three-tier classification system (with Tier 1 being the highest risk) where merchants are assessed based on their potential for illegal activity without proper controls, rather than GBPP’s simpler brand risk categorization. VIRP’s requirement for periodic control assessments and additional compliance (age verification, real-time transaction monitoring, etc.) is much stricter than GBPP’s basic monitoring requirements.
What’s the difference between VIRP and other Visa monitoring programs (like VDMP)?
VIRP is designed to protect the Visa network from illegal activities in high-risk industries, while VAMP (previously VDMP) is intended to prevent businesses from reaching unacceptable chargeback levels.
VIRP differs from other Visa monitoring programs like VAMP in that it’s entirely based on industry classification. VIRP identifies legal industries prone to illegal transactions, and requires businesses in the sectors to undergo additional due diligence and implement compliance tools (such as age verification, content moderation, and real-time transaction monitoring).
On the other hand, VAMP monitors all merchants’ chargeback ratios, regardless of business type. VAMP is designed to spot businesses with excessive chargeback rates and impose fines when they exceed acceptable levels.
Does VIRP apply only to new merchants, or also to existing ones?
VIRP applies to both new and existing merchants. If you were previously registered under GBPP, your business is now subject to the new VIRP framework, which includes updated control assessments and registration fees.
Additionally, an industry’s VIRP tier classification is subject to change at any time, so preparing for a change in your business’s status is critical.
What should I do if my business is placed under a VIRP review?
If your business faces a VIRP review, contact your payment provider. If you work with a high-risk merchant service provider, they can guide you through the VIRP review process. Failing to be proactive in the face of any enforcement or review action from Visa may result in losing access to the Visa payment network.
Are there payment processing providers that specialize in helping VIRP-flagged businesses?
https://paymentcloudinc.com/blog/visa-integrity-risk-program-high-risk-merchants-guide/Yes, high-risk merchant account providers specialize in helping businesses covered by the Visa Integrity Risk Program (VIRP). By partnering with a high-risk payment provider, merchants in VIRP’s designated industries can benefit from payment experts with experience managing the Visa Integrity Risk Program.
