How Network Fines Work
Card networks impose fines to protect the payment ecosystem from excessive risk, poor compliance, and rule violations. These penalties hit acquirers and processors first, but they flow directly to merchants through reserves, higher processing fees, or explicit pass-through charges. In 2026, both Visa and Mastercard have tightened thresholds, combined fraud and dispute metrics, and introduced faster-response penalties, making proactive monitoring essential.
Merchants who exceed limits risk not only monthly fines but also account termination and placement on industry blacklists that complicate future relationships. Understanding the specific numbers and escalation timelines is the first step toward avoiding them.
Visa Fine Structures and VAMP
Visa enforces compliance primarily through the Visa Acquirer Monitoring Program (VAMP), which consolidated separate fraud and dispute tracking into a single risk metric. VAMP evaluates the combined ratio of fraud-related chargebacks and non-fraud disputes against total transactions.
The excessive tier activates at 1.5 percent (150 basis points) combined ratio plus a minimum monthly count of disputes and fraud events, typically 1,000 to 1,500 cases. This threshold dropped from 2.2 percent in prior periods, a 32 percent tightening effective April 1, 2026. The reduction reflects Visa's increasing intolerance for merchants operating near historical limits.
Once flagged as excessive, merchants face per-transaction enforcement fees of approximately $8 for each counted fraud or dispute event. Acquirers in the "Above Standard" tier (portfolio-level ratios starting at 0.5 percent) or "Excessive" tier (0.7 percent) encounter similar charges that they routinely pass downstream. These fees apply monthly until the merchant exits the program through sustained improvement.
Visa also maintains legacy programs such as the Visa Dispute Monitoring Program with monthly penalties of $25,000 to $100,000 in the most severe excessive tiers, though VAMP has largely superseded them for combined risk tracking.
Additional Visa Penalties
Dispute response-time fees introduced in 2025 and enforced throughout 2026 add another cost layer. Merchants who respond to chargebacks within the initial 10-day window pay minimal or no extra fees. Delayed responses trigger tiered charges up to $4 to $7 per case, with full deadline misses adding further penalties. For merchants handling hundreds of disputes monthly, these fees accumulate rapidly.
PCI DSS non-compliance assessments range from $5,000 to $100,000 per month for ongoing violations, escalating sharply after data breaches to hundreds of thousands or millions in recovery costs. The assessment continues until the merchant achieves and demonstrates compliance.
Non-compliance assessments for significant rule violations, including prohibited transactions, inaccurate merchant category codes, or high-integrity risk activity, follow tiered schedules in the Visa Core Rules. Repeat offenses multiply the base amounts, and acquirers may add their own administrative fees on top of the network-imposed penalties.
Mastercard ECP and Escalation Schedule
Mastercard operates the Excessive Chargeback Program (ECP), which monitors merchants monthly for both volume and ratio thresholds. The program features two escalation levels.
Excessive Chargeback Merchant (ECM) triggers at 100 or more chargebacks in a single month combined with a 1.5 percent or higher ratio. High Excessive Chargeback Merchant (HECM) applies at higher volumes and ratios, often around 300 chargebacks and 3.0 percent. The escalation schedule increases the longer the merchant remains non-compliant:
- First month above threshold: typically a warning with no fine
- Month 2: $1,000 base assessment
- Months 3 through 6: $1,000 to $5,000 (ECM) or up to $10,000 (HECM)
- Months 7 through 11: $25,000 (ECM) or $50,000 (HECM)
- Months 12 through 18: $50,000 (ECM) or $100,000 (HECM)
- Month 19 and beyond: $100,000 (ECM) or $200,000 (HECM)
Mastercard adds an Issuer Recovery Assessment of $5 per chargeback beyond the first 300 in qualifying months. These amounts appear in USD or EUR depending on the region and are assessed to the acquirer before passing to the merchant.
Mastercard also enforces separate penalties for excessive authorization attempts, data integrity violations, and prohibited or misrepresented activity. Surcharging rule breaches, for example, can generate fines starting at several thousand dollars and escalating with repeated violations.
How Fines Flow from Networks to Merchants
Networks assess fines against acquirers or processors, not merchants directly in most cases. Acquirers and PSPs then recover the cost through one or more mechanisms: direct pass-through billing on monthly statements, increased reserve requirements that tie up working capital, higher markup fees on all future transactions, or administrative "risk management" fees added to the merchant agreement.
In documented cases, processors have passed network fines of $137,500 or more to individual merchants after portfolio-level violations. High-risk or high-volume merchants often negotiate these clauses during onboarding, but standard agreements grant processors broad rights to recover any network-imposed costs. Merchants should review their processing agreements to understand exactly how fine pass-through works before a violation occurs.
Real-World Impact and Escalation Risks
Fines rarely occur in isolation. Merchants in monitoring programs face simultaneous requirements for detailed remediation plans, enhanced fraud controls, and frequent reporting. Failure to improve within set timelines can lead to account termination, placement on the MATCH (Mastercard) or VMSS (Visa) terminated-merchant files, and additional reserves of 10 to 20 percent or more of projected monthly volume.
These outcomes compound quickly. A merchant processing $1 million monthly at a 2 percent combined ratio could face tens of thousands in monthly fines plus frozen funds during any investigation window. The operational disruption often exceeds the fine amounts themselves, as the merchant scrambles to find alternative processing while managing cash flow constraints from reserves and frozen balances.
Practical Steps to Avoid or Minimize Fines
Merchants who treat network monitoring as a core operational metric stay ahead of penalties. Track combined fraud and dispute ratios monthly using PSP dashboards or orchestration analytics rather than waiting for network notifications. Maintain chargeback ratios well below 0.75 percent through prevention, accurate descriptors, and strong representment.
Respond to all disputes within the fastest possible window to avoid tiered response fees. Use orchestration to route high-risk transactions intelligently and stack fraud tools that reduce both fraud and friendly disputes. Review PCI DSS compliance status quarterly and complete required self-assessments or audits on time. Communicate planned volume spikes or business model changes to acquirers well in advance to prevent sudden flags.
For merchants already flagged, immediate engagement with the acquirer or PSP to submit a credible remediation plan often shortens the penalty period. The plan should include specific actions with measurable targets, such as implementing additional fraud screening tools, adjusting 3D Secure thresholds, or refining billing descriptors. In extreme cases, switching to specialized high-risk processors or adding orchestration for diversified routing can restore stability faster than fighting a single provider's restrictions.