Mastercard revealed quietly in a bulletin update to acquirers on July 28, 2026 that it would fold its existing fraud and chargeback monitoring programs for merchants and acquirers into its new Global Merchant Audit Program (GMAP), starting April 1, 2027. GMAP replaces the old Acquirer Chargeback Monitoring Program. While Mastercard has yet to present GMAP in a public forum, many details of the program have reached the market via people sharing information from the bulletin update.
In short, GMAP is the Mastercard equivalent to Visa’s earlier implemented VAMP program. Both programs seek to weed out scam merchants on their networks using a single monthly ratio determined by a combination of the occurrence of fraud, whether it results in a chargeback or not, and non-fraud chargebacks received by a business. The fraud element with the ratio is determined by entries in Mastercard’s Fraud & Loss Database (FLD), which used to be known as the System to Avoid Fraud Effectively (SAFE).
Retaining the Old Programs
Before we get to the new aspects of the program, let’s cover the old ones that are being carried over. The Excessive Fraud Merchant (EFM), Excessive Chargeback Merchant (ECM) and High Excessive Chargeback Merchant (HECM) programs are being folded into GMAP. At least initially, nothing about these programs changes. Moreover, merchants that have entered these programs before the April 1, 2027 GMAP enforcement date will not see their audit month and counts reset. Instead everything will carry over into GMAP.
EFM Thresholds Stay the Same
Excessive Fraud Merchant (EFM) is aimed at curbing card-not-present fraud at the individual merchant ID (MID) level. A MID is flagged for standard EFM when, in a given month, it exceeds all of the following thresholds:
- 1,000+ e-commerce transactions
- $50,000+ in fraud chargebacks (i.e. chargebacks with reason code 4837)
- A fraud-to-transaction ratio of 50 basis points (0.5%) or more (fraud chargebacks with reason code 4837 in the current month divided by prior-month transaction volume)
- 3DS utilization is below the required floor (roughly 10% in the US and Canada, and 50% in Europe). None of this changes under GMAP.
Core Changes Under GMAP
ECM Ratio Thresholds Adjusted
| Category | Year | Ratio |
|---|---|---|
| Excessive Chargeback Merchant (ECM) | 2027-2028 | 150 bps to 299 bps (i.e. 1.5% – 2.99%) |
| 2029 | 130 bps to 299 bps (i.e. 1.3% – 2.99%) | |
| 2030 | 110 bps to 299 bps (i.e. 1.1% – 2.99%) | |
| 2031 | 90 bps to 299 bps (i.e. 0.9% – 2.99%) |
In the Excessive Chargeback Merchant program, monitoring begins when a merchant exceeds the current base threshold of over 100 chargebacks and 150 basis points (1.5%). Basis points are determined by the number of chargebacks in a current month over last month’s Mastercard transactions.
Under GMAP, from 2027 to 2028 the program threshold will stay between 1.5% and 2.99%. However, in 2029, the lower bound for the ECM program will drop 20bps to 1.3%. The following year, in 2030, the lower bound will decline another 20bps to 1.1%. Finally, in 2031, Mastercard’s merchant chargeback monitoring program will reach parity with Visa’s old ratio for VDMP at 0.9% of transactions per month. The minimum threshold requirement of at least 100 chargebacks per month will remain unchanged.
Unlike Visa, Mastercards ratio for ECM (and HECM) is determined by the number of first presentment chargebacks in the current month divided by the number of Mastercard transactions processed in the prior month. Considering that a majority of chargebacks are filed in the first 30 days following a transaction this is less likely to put a merchant in a quandary when there is a seasonal drop in transaction volume accompanied by a normal lag in the drop in chargebacks.
Back to GMAP, the lower bound of the High Excessive Chargeback Merchant (HECM) categorization and the severe penalties it applies to merchants stays unchanged throughout the 2027-2031 period at a minimum threshold of 300 chargebacks per month and a chargeback-to-transaction ratio of 300 basis points (i.e. 3%).
So much for the old programs.
Additional Programs Being Added to GMAP
GMAP also introduces four new programs designed to target combined fraud and chargeback activity. The new programs are the:
- High Dispute Merchant (HDM)
- Excessive Dispute Merchant (EDM)
- High Dispute Acquirer (HDA)
- Excessive Dispute Acquirer (EDA)
On the merchant level, both new categories use the same three-part test — a merchant must meet or exceed all three thresholds in a given month:
| Category | Minimum activity | Combined dollar amount | Ratio |
|---|---|---|---|
| High Dispute Merchant (HDM) | 5+ cleared transactions | ≥ $5,000 in fraud reports (FLDs) + non-fraud chargebacks | 500+ bps (i.e. 5%) |
| Excessive Dispute Merchant (EDM) | 5+ cleared transactions | ≥ $10,000 in fraud reports (FLDs) + non-fraud chargebacks | 5,000+ bps (i.e. 50%) |
The consequences for merchants who breach the thresholds are significant. For HDM, after two months above threshold, Mastercard may alert issuers directly to the merchant’s noncompliance, which may reduce the merchant’s approval rates. For EDM, after two months above the threshold, the merchant loses the automatic fraud liability shift benefit from using 3DS, both retroactively for the three months before identification, and for six months of fraudulent transactions moving forward.
There are also significant financial penalties for non-compliant merchants both for HDM and EDM.
For HDM merchants:
| Months exceeding the HDM threshold | Monthly assessment |
| 1-6 | $0 |
| 7-11 | $5,000 |
| 12-18 | $10,000 |
| 19+ | $25,000 |
For EDM merchants:
| Months exceeding the EDM threshold | Monthly assessment |
| 1 | $5,000 |
| 2 | $25,000 |
| 3-11 | $100,000 |
| 12-18 | $200,000 |
| 19+ | $300,000 |
Merchant Monitoring Changes
Moreover, monitoring of merchants no longer rests on the merchant ID (MID) level. Rather, the level of focus has increased to the submerchant ID, wherever it exists. This change is noteworthy for payment facilitators/aggregators. Now, a single problematic sub-merchant can no longer hide inside an aggregator’s overall volume, diluting the problem away. Mastercard now assesses submerchants on their own record.
HDA/EDA Additions
On the acquirer level, there are two new programs. Both apply only to acquirers with at least 1,500 cleared transactions and at least 1,500 transactions reported as fraud or non-fraud chargebacks in the month. The programs are:
- High Dispute Acquirer (HDA): Combined fraud and non-fraud chargebacks over total Mastercard transactions ≥ 50 bps (i.e. 0.5%) based on prior month’s transactions.
- Excessive Dispute Acquirer (EDA): Combined fraud and non-fraud chargebacks over total Mastercard transactions ≥ 70 bps (i.e. 0.7%) of prior month’s transactions.
What are the Financial Penalties for Violating HDA and EDA Thresholds?
| Months exceeding the HDA threshold | Monthly assessment |
| 1 through 11 | $0 |
| 12 through 18 | $25,000 |
| 19+ | $10,000 |
| Months exceeding the EDA threshold | Monthly assessment |
| 1-2 | $0 |
| 3-6 | $10,000 |
| 7-11 | $25,000 |
| 12-18 | $50,000 |
| 19+ | $100,000 |
For all the four new programs, a merchant or acquirer exits monitoring by staying below both thresholds for three consecutive months. Once that’s achieved, the audit closes and the counter resets.
Mastercard’s GMAP vs. Visa’s VAMP
Naturally, merchants will compare Mastercard’s upcoming GMAP with Visa’s already implemented VAMP. The two are broadly similar in that they seek to improve cardholder experience by putting a strict 0.5% threshold on acquirers, seeking to incentivize them to make the decisions necessary to clean up their merchant portfolios and get rid of merchants with too much fraud and chargebacks. However, Mastercard is much more lenient on merchants, putting a threshold of 5% as compared to Visa’s threshold of 1.5%. Mastercard is also different from Visa inasmuch as for its joint fraud and chargeback ratio it is counting fraud reports (FLDs for Mastercard and TC-40s for Visa) for its fraud figures and non-fraud chargebacks. Visa in VAMP, on the other hand, double-counts cases of fraud by including its VAMP ratio both TC-40s and total chargebacks.
More to the point, GMAP vs. VAMP reveals a difference in enforcement philosophy between Mastercard and Visa. First and foremost, Visa has jettisoned its various monitoring ratios and replaced them with one: VAMP. It’s relatively stricter than GMAP, but it’s also easier to keep track of and comply with than all the various ratios kept by Mastercard as part of an expansive GMAP. Second and lastly, VAMP enforces actions by merchants and acquirers primarily via fees. GMAP relies on fees as well, but also on issuer visibility and 3DS fraud liability. Visa makes things clear to merchants and acquirers by directly penalizing their bottom line. Mastercard takes away from their bottom-line but also changes ecosystem incentives that merchants face as part of their day-to-day card processing.
| Category | Mastercard GMAP | Visa VAMP |
|---|---|---|
| Merchant threshold | 5% | 1.5% |
| Acquirer threshold | 0.5% | 0.5% |
| Fraud ratio counting | Fraud reports (FLDs) counted separately from non-fraud chargebacks | TC-40s counted in both fraud and total chargeback figures (double-counted) |
| Number of monitoring ratios | Multiple ratios across a broader program | Single consolidated ratio |
| Enforcement mechanism | Fees, issuer visibility, and 3DS fraud liability shift | Primarily fees |
Parallel Changes to Mastercard QMAP Planned for 2027
Mastercard also announced at the same time as GMAP, that starting April 1, 2027 it would beef up its Questionable Merchant Audit Program (QMAP). The QMAP program is for merchants engaged with highly questionable behavior that may suggest collusion in criminal activity such as bust-out fraud. This program easily warrants its own article. Here we will just mention the pertinent policy changes.
As of April 2027, the transaction volume threshold for a QMAP case will drop from $50,000 to $10,000, and the standard case window shrinks from 120 days to 30 days (extendable to 60 days if needed). The tightening of the case window makes it more difficult for businesses to average out activity over a longer period of time to stay compliant. Established merchant accounts more than six months old are also no longer exempt from program monitoring.
Frequently Asked Questions About GMAP
When does Mastercard’s GMAP take effect?
GMAP enters effect on April 1, 2027.
Is Mastercard’s GMAP similar to Visa’s VAMP program?
To some extent. Both card networks have/are introducing programs that count fraud and chargebacks together in a single ratio to incentivize acquirers and merchants to improve cardholder experience. Nevertheless, there are some significant differences between the two programs. VAMP replaces the Visa Dispute Monitoring Program (VDMP) and Visa Fraud Monitoring Program (VFMP), GMAP folds in yet retains the Excessive Chargeback Program (ECP) and the Excessive Fraud Merchant Program (EFM). The underlying enforcement mechanism and philosophy between GMAP and VAMP is also different. The former impacts issuer approval rates and fraud liability. The latter largely relies on fines.
Will ECP and EFM monitoring reset with the implementation of GMAP in 2027?
No, merchants that are in ECM or HECM and EFM programs will stay in the programs when April 1, 2027 arrives.
Can payfacs serve high-risk merchants on submerchant IDs under GMAP?
This will become much more difficult for payfacs to do. Under the new monitoring regime, Mastercard will be examining the ratio of submerchant ID and not only the overall MID. This means payfacs can no longer balance out high-risk submerchants with low-risk ones to stay compliant.
