Mastercard Global Merchant Audit Program Explained

What the Mastercard Global Merchant Audit Program Changes

Speculation has been circulating since the bulletin dropped, and much of it combines separate changes. So it helps to start with what the document says rather than what the industry has been repeating.

Mastercard is retiring the Acquirer Chargeback Monitoring Program in its current form. GMAP takes its place. Three existing categories migrate into the new framework: Excessive Fraud Merchant (EFM), Excessive Chargeback Merchant (ECM), and High Excessive Chargeback Merchant (HECM). They are not being eliminated, and their criteria continue to operate alongside the new categories layered on top.

That layering is the structural point most early coverage has missed. GMAP builds on the existing framework by addition. A merchant in your portfolio could be evaluated against ECM criteria and one of the new categories in the same month, because the two measure different inputs across different windows.

Mastercard will administer GMAP through the Data Integrity application within My Company Performance on Mastercard Connect, and the program will be established in the Security Rules and Procedures manual. That is the same administrative path acquirers use for ACMP today, so the reporting surface should be familiar even as the underlying measurements change.

Four New Monitoring Categories

GMAP introduces four categories built on a combined measurement. Mastercard names them using “Dispute,” so we use those names exactly as published. The underlying calculation counts transactions reported as fraud to the Fraud and Loss Database, including fraud that never produced a chargeback, plus chargebacks filed for non-fraud reasons. That combined count is then compared against the previous month’s sales count. Basis points here reflect transaction counts rather than dollar values, which is a distinction that trips up a lot of ratio modeling.

High Dispute Merchant (HDM)

A merchant meets HDM when all three conditions occur in the same month: at least five cleared transactions, $5,000 or more in reported fraud plus non-fraud chargebacks, and 500 or more basis points. Assessments start at $0 for months one through six, then rise to $5,000, $10,000, and $25,000 monthly at month nineteen and beyond. Mastercard may also notify issuers when a merchant exceeds the HDM threshold for two or more consecutive months, which can invite additional scrutiny of that merchant’s transactions before any financial penalty applies.

Excessive Dispute Merchant (EDM)

EDM uses the same five-transaction floor with $10,000 or more in combined fraud and non-fraud chargebacks and 5,000 or more basis points. Assessments begin immediately at $5,000 in month one and escalate to $25,000, $100,000, $200,000, and $300,000 monthly from month nineteen. EDM carries the sharpest consequence in the entire bulletin. A merchant exceeding the threshold for two months becomes liable for all fraud-related chargebacks tied to transactions in the three months preceding identification, plus fraudulent transactions during the following six months. Mastercard will publish a list of EDM merchants with the applicable timeframes, and issuers may use reason code 4849 to recover the full transaction amount within those windows.

High Dispute Acquirer (HDA)

At the ICA level, HDA applies to acquirers with at least 1,500 cleared transactions and 1,500 or more transactions reported as fraud or charged back for non-fraud reasons, at 50 or more basis points. Assessments sit at $0 through month eleven, then $25,000 for months twelve through eighteen, then $50,000 monthly. This is the threshold most likely to catch providers whose portfolios skew toward higher-risk verticals.

Excessive Dispute Acquirer (EDA)

EDA shares the HDA activity floors and triggers at 70 or more basis points. Assessments run $0 for the first two months, then $10,000, $25,000, $50,000, and $100,000 monthly from month nineteen. Beyond the fines, an acquirer remaining noncompliant for twelve or more months may be required to complete a Franchise Management Program review at its own expense. At nineteen or more months, Mastercard cites potential restrictions, suspension, or termination of the license.

The audit mechanics are identical at both levels and deserve attention. Breaching either threshold opens an audit and starts a monthly counter. Closing that audit requires compliance with both thresholds for three consecutive months. A portfolio that oscillates in and out of breach keeps the counter advancing and re-enters at the escalated assessment rate rather than the starting one.

The cost of that remediation window deserves modeling. The bulletin ties each month’s assessment to how long the audit has been open rather than to whether a threshold was exceeded that month, which suggests assessments could continue across the three compliant months required to close it. For a merchant that reaches month nineteen under EDM, that would mean roughly $900,000 across the closing period alone. Mastercard has not addressed this point directly, so acquirers may want to seek clarification before April 2027. Either way, the arithmetic favors early intervention heavily, since the counter tier at the moment remediation begins determines what the exit costs.

Sharing a Merchant ID Will No Longer Offer Cover

For ECM, HECM, and EFM, Mastercard is changing how it decides who the merchant is. Today it looks at the merchant ID your acquirer assigned. Going forward, where the transaction data carries a submerchant identifier, Mastercard will use that instead.

This matters most for marketplaces, platforms, and any acquiring arrangement where many submerchants process beneath a shared MID. Under the current structure, a submerchant generating disproportionate chargeback activity can be diluted by the aggregate volume of everyone else under that MID. Monitoring at the submerchant level removes that dilution and gives Mastercard plus acquirers a clearer view of which specific business is generating the activity.

The practical consequence is that portfolio aggregation stops functioning as a buffer. Submerchants that have sat comfortably below identification thresholds on a blended basis may surface individually once the change takes effect on 1 April 2027.

The Phased ECM Tightening

Mastercard is also reducing the ECM basis point threshold over five years, while leaving the chargeback count criterion at 100 or more throughout:

• Years 1 and 2 (2027 and 2028): no change, 150 to 299 basis points
• Year 3 (2029): 130 to 299 basis points
• Year 4 (2030): 110 to 299 basis points
• Year 5 (2031): 90 to 299 basis points

The HECM tier above it currently identifies merchants at 300 or more chargebacks combined with 300 or more basis points. Since the bulletin does not revise HECM criteria, the practical effect of lowering the ECM floor is a widening identification band rather than a shifted one. More merchants fall inside it each phase.

Worth noting for portfolio planning. By 2031, a merchant sustaining 0.9 percent will sit inside ECM criteria that it clears comfortably today.

What MSPs Should Be Doing Now

The interval between now and April 2027 is the useful part of this announcement. Three areas deserve early attention.

Reporting comes first. The new categories draw on Fraud and Loss Database submissions, non-fraud chargebacks, and prior-month sales counts. Providers tracking conventional chargeback ratios alone will not see these thresholds approaching. Building Mastercard-specific visibility into that combined measurement is the foundation everything else rests on.

Internal thresholds come second. Given that HDA identification begins at 50 basis points across an entire portfolio, some providers may find it prudent to set merchant-level limits below Mastercard’s published figures. That decision depends heavily on portfolio composition and risk appetite.

Merchant agreements come third. Assessment pass-through, remediation obligations, and termination rights may need revisiting, particularly where submerchant-level identification introduces exposure that did not previously exist at that granularity.

Mastercard is also revising the Questionable Merchant Audit Program on the same effective date, lowering the minimum case volume from $50,000 to $10,000, shortening the standard case scope period from 120 days to 30, and removing the merchant age limitation on non-bustout identification.

Build Your GMAP Readiness Plan

Preparing for the Mastercard Global Merchant Audit Program is fundamentally a data and workflow problem before it becomes a compliance problem. If your portfolio reporting cannot currently surface combined fraud and non-fraud chargeback performance against prior-month sales counts at the submerchant level, that gap is the place to start. ChargebackHelp works with merchant service providers to build that visibility and to automate the resolution and recovery workflows that keep merchant performance well below identification thresholds. Contact our GMAP team if you would like help assessing your portfolio against the new GMAP categories and mapping a remediation approach before April 2027.

GMAP Is Still Taking Shape

Mastercard has signaled that the Chargeback Guide and Security Rules will be updated ahead of the April 2027 effective date, and further clarification is likely as acquirers work through implementation. We will revise this piece as those details land, so check back periodically to make sure you are working from current information.

Why ChargebackHelp?

ChargebackHelp gives merchant service providers a single environment for managing chargeback performance across an entire portfolio. DEFLECT resolves transaction confusion at the point of inquiry through Verifi Order Insight and Ethoca Consumer Clarity, reducing the disputes that eventually become chargebacks. RESOLVE consolidates alerts from Verifi CDRN, Ethoca Alerts, and Visa RDR so eligible cases are refunded before they escalate. RECOVER automates representment where recovery is warranted. Together these solutions reduce systemic portfolio risk, keep merchant ratios aligned with card network enforcement expectations, and give providers an automation offering they can extend to their own merchant customers as a competitive advantage.