Posted: November 05, 2026
Card networks are beginning to combine fraud and dispute monitoring into a single scorecard. Visa announced the Visa Acquirer Monitoring Program (VAMP) in 2022, and it replaced Visa’s previous fraud and dispute programs on April 1, 2025. Now, Mastercard is introducing the Global Merchant Audit Program (GMAP).
According to ChargebackHelp, Mastercard released information regarding GMAP, published July 28, 2026. As stated in Beast Insights, GMAP will begin April 1, 2027, and replace the Acquirer Chargeback Monitoring Program (ACMP). Similar to VAMP, Mastercard GMAP adds four new programs and outlines a chargeback threshold program for 2029 to 2031.
As noted in Beast Insights, Mastercard has not published bulletin GLB 14127.1 publicly, and the information provided in this article is compiled from Chargeback Gurus, Chargebacks 911, ChargebackHelp, and others. Where information varies, it is mentioned in this article. Because the threshold programs mandate chargeback ratios, merchants are recommended to confirm the information from their acquiring banks.
In recent years, Mastercard has placed ACMP (Acquirer Chargeback Monitoring Program) under its merchant monitoring program. According to an August 2026 report by Chargeback Nerd, ACMP incorporates the High Excessive Chargeback Merchant (HECM) and Excessive Chargeback Merchant (ECM) programs, as well as the Excessive Fraud Merchant (EFM) program.
Merchants are screened against ECM in months when the merchant records 100 to 299 disputed transactions, and the ECM ratio is 1.5%–2.99%. Both assessments are found in BlueSnap documentation for a merchant. Mastercard calculates the ratio of chargebacks to the previous month’s sales count, expressed in basis points. This is found in BlueSnap documentation.
EFM has a different processing flow and covers chargebacks for fraud in the card-not-present environment. A merchant must satisfy four conditions in a given month. Based on Signifyd documentation, the conditions are at least 1,000 e-commerce transactions, $50,000 or more in fraud chargebacks, and a fraud chargeback ratio of 0.50% or higher. Braintree provides the fourth condition, in the documentation, as 3D Secure, a CNP authentication and transaction verification mechanism. The condition is met if 3-D Secure transactions are less than 10% of total volume in non-regulated countries and less than 50% in regulated countries.
Assessments for the three schemes begin in the second month. ECM and HECM charge $1,000 and $2,000, respectively, by the second month, based on a JPMorgan Chase program guide. EFM charges $500 by the second month. In month 19 of the EFM program, the assessment rises to $100,000 per month, based on Signifyd. In all of the programs, a merchant exits the program if assessment is not triggered in three months in a row.
Previously, the distinction was made between chargebacks and fraud. As a result, it was possible for a merchant to be under the ECM and EFM Lines in the same month and have a high total for fraud and disputes. Chargebacks911 mentions that GMAP bridges this gap by combining reported fraud and chargebacks, and doing so relative to the total sales figure.
Moreover, as Yuno mentions, GMAP also changes accountability for the acquirer’s portfolio of merchants.
(GMAP) was first launched by Mastercard with a fraud focus. As described by Chargeback Nerd, the program was initially launched with rolling six-month data and was broken into three tiers. In 2020, the program was abandoned by Mastercard and relaunched by them for 2027.
The main change is the monthly ratio. Verisave describes the formula as: Fraud reports plus chargebacks, divided by the previous month’s sales. Therefore, both fraud and disputes adjustments are fed into this ratio.
The fraud side of the ratio counts transactions submitted to the Mastercard Fraud and Loss Database. ChargebackHelp indicates that counts of reported fraud that did not result in a chargeback are also included on the fraud side of the ratio. The dispute side counts chargebacks filed for reasons other than fraud.
The ratio evaluates the impact of fraud and chargeback activity based on the transaction count and not the transaction dollar amount. ChargebackHelp explains that this difference from a merchant’s perspective often creates a broken ratio.
To clarify, if a merchant processes 10,000 Mastercard transactions within a single month and 300 fraud reports are filed against the merchant in the next month, along with 250 non-fraud chargeback transactions, the count of those transactions would be 550. Divided by 10,000, this would equate to a combined ratio of 5.5%, or 550 basis points. For this example to be of concern to the merchant, the 550 transactions would have to be equal to or greater than $5,000.
Chargebacks911 notes the HDM program applies to both merchants and acquirers for transactions processed on Mastercard, Debit Mastercard, Maestro, and Cirrus.
GMAP moved HECM, ECM, and EFM monitoring to the sub-merchant ID, where it exists, instead of the merchant ID, on April 1, 2027, according to Chargebacks911. Solidgate reports each sub-merchant will be assessed individually as a result of this change. Marketplaces and payment facilitators are most impacted by this change since they work with multiple merchants using a single merchant ID.
GMAP Standards will be published in the Security Rules and Procedures manual by Mastercard, reports ChargebackHelp. The revised Chargeback Guide and Security Rules Manual are still in process. The final Manual text is still pending.
GMAP has expanded its merchant and acquirer categories. Each condition in a row must be met in the same month for a category to apply. The summaries published by Chargeback Gurus and ChargebackHelp provide the following details.
| Category | Level | Entry conditions (same month) | Ratio threshold |
| High Dispute Merchant (HDM) | merchant | Five processed transactions and $5,000+ in combined fraud cases and non-fraud chargebacks | 500 bps (5%) |
| Excessive Dispute Merchant (EDM) | merchant | Five processed transactions and $10,000+ in combined fraud cases and non-fraud chargebacks | 5,000 bps (50%) |
| (HDA) | Acquirer (ICA) | 1,500+ cleared transactions and 1,500+ fraud or non-fraud chargebacks | 50 bps (0.5%) |
| (EDA) | Acquirer (ICA) | 1,500+ cleared transactions and 1,500+ fraud or non-fraud chargebacks | 70 bps (0.7%) |
Table 1. GMAP monitoring categories. Source: Mastercard bulletin GLB 14127.1 (July 28, 2026), as summarized (July 30, 2026) and ChargebackHelp.
According to Chargeback Gurus, HDM does not lead to immediate liability. However, Mastercard may inform issuers if a merchant goes above the HDM trigger point for two successive months, as reported by Chargebacks911.
EDM creates a financial liability exposure. As reported by Chargebacks911, when a merchant exceeds the EDM limit for two consecutive months, they are liable for Mastercard chargebacks arising from transactions processed during the three-month lookback and the six-month liability period. Each month a list of EDMs is published by Mastercard. Issuers may charge back qualified transactions against an EDM merchant using reason code 4849, as reported by Chargebacks911.
If an acquirer does not comply with the rules and requirements for more than one year, the acquirer must undergo a Franchise Management Program at its expense. If the non-compliance continues for more than 19 months, Mastercard has the right to restrict, up to canceling the acquirer’s license, as reported by Chargebacks911.
Assessments continually increase the longer a merchant is under audit. HDM does not charge for the first six months. Charges then increase to $5,000, $10,000 and $25,000 per month. EDM charges start at $5,000 for the first month and increase to $300,000 per month starting at month 19.
Assessments from acquirers follow a similar pattern. EDA and HDA both charge nothing for the first two months, and then charge between $10,000 and $100,000 per month beginning with month 19. Chargeback Gurus notes that HDA charges $50,000 per month, beginning with month 19, while ChargebackHelp and Chargebacks911 note that the charge is $10,000 per month.
Chargeback Gurus states that an audit closes once the acquirer or merchant is below the specified threshold for three months in a row. ChargebackHelp agrees and states that the month counter resets at that point in time.
GMAP lowers the ECM floor in a series of changes. The range of 1.5%–2.99% remains through 2027 and 2028. As of January 1, 2029, it drops to 130 basis points, to 110 basis points on January 1, 2030, and finally to 90 basis points on January 1, 2031. According to Chargebacks911 and ChargebackHelp, a minimum of the 100-chargeback limit remains unchanged.
ChargebackHelp reports that HECM criteria stay at least 300 chargebacks and 300 or more bps. EFM keeps its existing criteria.
Mastercard has updated the Questionable Merchant Audit Program (QMAP) on the same date. The minimum case value has been cut from $50,000 to $10,000. The case window has decreased from 120 days to 30 days, and may be extended to 60 days at Mastercard’s discretion. Chargebacks911 reports that the six-month age limit on identification has been removed.
According to Chargebacks911, GMAP assessments will begin on May 30, 2027. Altopay says that the first GMAP assessments will happen in May 2027 for violations that occurred in April 2027.
Both networks have combined fraud and disputes into a single ratio with count-based limitations. Differences exist in what conditions allow entries and departures from the ratio.
Visa VAMP is defined as the number of TC40 fraud reports and TC15 disputes combined, and divided by the number of settled TC05 transactions. This ratio pertains only to CNP transactions, whether domestic or cross-border.
As noted in the fact sheet, an acquirer portfolio is defined as higher than the standard rate of 50 basis points, and Excessive at 70 basis points. The threshold for the Excessive merchant definition has been lowered to 150 basis points in the aforementioned regions with effect from April 1, 2026. Elsewhere, i.e. CEMEA, the threshold is at 220 basis points; and for Latin America and the Caribbean, the threshold is at 150 basis points.
Fraud reports and disputed transactions combined must be at least 1,500 within a single month for the region to warrant concern for Visa. In some cases, resolved disputes, as well as fraud reports qualified under (CE 3.0) can be excluded from consideration, subject to when the data is extracted.
VAMP also tracks a second metric for card testing. As stated in the fact sheet, the threshold for the VAMP enumeration ratio is set at 20%. This threshold is invoked once enumerated transactions within a single month reach 300,000. Published summaries of GLB 14127.1 do not disclose an enumeration framework similar to GMAP.
The acquirer thresholds are the same under both programs: 0.5% and 0.7%. The difference lies in the merchant discount structure. ECM’s rate will drop from 1.5% in 2027 to 0.9% by 2031, compared with Visa’s flat 1.5% merchant threshold. HDM is also charged at the merchant level at five transactions and $5,000, compared to Visa’s 1,500-transaction monthly floor.
Figure 4. Merchant and acquirer thresholds, Mastercard versus Visa.
| Feature | Mastercard GMAP | Visa VAMP |
| Effective date | April 1, 2027 | April 1, 2025 |
| Ratio | Fraud reports plus non-fraud chargebacks over prior-month sales | Total TC40 fraud reports and TC15 disputes as a share of settled transactions |
| Transaction scope | Mastercard, Debit Mastercard, Maestro and Cirrus | CNP VisaNet transactions |
| Merchant entry floor | 5 transactions and $5,000 (HDM) | 1,500 fraud and disputes per month (most regions) |
| Acquirer thresholds | 0.5% (HDA), 0.7% (EDA) | 0.5% (Above Standard), 0.7% (Excessive) |
| Exit rule | Three consecutive compliant months | One month below thresholds |
Table 2. Sources: Visa VAMP Fact Sheet 2025; Chargebacks911, Chargeback Gurus and Verisave summaries of GLB 14127.1; Solidgate documentation for the VAMP exit rule.
Solidgate explains the difference in enforcement this way: Visa’s pressure is generally fees-related. Mastercard’s pressure is primarily due to the shift in fraud liability, as well as issuer visibility, related to EDM.
Each item below ties to a rule change that published summaries of GLB 14127.1 describe.
Most merchants track chargebacks and fraud independently. GMAP combines them. Track the total count of chargebacks and fraud each month and divide by the total count of sales for that month. ChargebackHelp recommends tracking chargeback counts, not dollars. Thus, track counts, not dollars, for chargebacks and fraud. The 5% HDM threshold and the 1.5% ECM floor apply from April 2027. Thus, it is recommended to test the result against both lines.
Reporting to the Fraud and Loss Database happens regardless of a chargeback. Merchants do not receive these reports directly. Ask your acquirer about the fraud reporting data they have access to and how often they are provided with that data. As it is, Visa includes TC40 issuer fraud reports in VAMP, so merchants that accept Visa and another card brand may have reporting means to extend to the other card brand as well.
Sub-merchant IDs must be included on all transactions processed by payment facilitators and marketplaces. As of April 1, 2027, ECM, HECM and EFM activities will use the ID to trace the associated merchant. If the ID is either missing or the same ID is used for multiple transactions, determining the merchant that caused the ratio to occur will not be possible.
Currently, a merchant at 1.2% clears ECM in 2027 and 2028. As of 2029, this same merchant would fall within the ECM range if 100 or more chargebacks were to occur. Set internal targets against the 0.9% floor that will be in effect starting 2031.
The decrease in the minimum case value to $10,000 and the decrease in the case period to 30 days increase the number of smaller and newer merchants under QMAP’s purview. The 6-month age limit for cases has been removed. Review onboarding and fraud controls for new accounts and new product lines.
FunnelFox says acquirers need to hit a 0.5% threshold. If an acquirer is near 0.5%, they may look into controls and adjust limits on unrelated merchants with acceptable ratios. Where is your acquirer’s portfolio? Is your ECM, HECM or EFM audit open? How will they change once they’re put into GMAP? According to Solidgate, counts don’t reset when moving into GMAP.
GMAP goes into effect on April 1, 2027, and will replace ACMP. GMAP will merge Fraud and Loss Database reports, as well as non-fraud chargebacks, and will assess a monthly ratio. HDM will apply at 5%, and EDM will apply at 50%, with EDM assessing liability for fraud chargebacks and assessment exposure up to $300,000. Acquirers will have 0.5% and 0.7% thresholds, aligned with Visa’s VAMP, for HDM and EDM, respectively.
ECM will remain, and its floor will drop to 0.9% on January 1, 2031. Monitoring will be at the sub-merchant ID, if available. QMAP will lower the case threshold to $10,000 from $50,000. Since Mastercard has yet to publish GLB 14127.1, acquirers are the most dependable source for assessing the overall impact.
As of April 1, 2027, GMAP will begin. According to Chargebacks911, assessments will begin May 30, 2027.
Solidgate reports, “Open ECM, HECM and EFM audits will be transitioned to GMAP without reset.” Make sure you reach out to your acquirer to confirm.
They are similar, but not the same. The similarities include having a 0.5% and 0.7% threshold for acquirers, a threshold for fraud, and combining fraud and chargeback ratios. However, the exit and entry points for fraud and chargeback ratios differ between the programs.
