Navigating Visa’s New VAMP Rules: A Merchant’s Comprehensive Guide

1. What’s Changing? The Shift to a Unified Monitoring Program

• VDMP and VFMP are retired as of March 31, 2025; they are replaced by an enhanced, consolidated Visa Acquirer Monitoring Program (VAMP) starting April 1, 2025.

• VAMP consolidates fraud (TC40) and non‑fraud disputes (TC15), including chargebacks across dispute reason codes, into a single VAMP ratio metric.

• A second new metric—the enumeration ratio—tracks card‑testing (enumeration) attacks, providing a more holistic fraud risk picture.

2. Key Metrics & Thresholds for Merchants

VAMP Ratio

• Definition: The VAMP ratio is calculated by taking the total number of fraud cases (TC40) plus the total number of disputes (TC15), and dividing that by the total number of settled card-not-present transactions (TC05).

• Initial threshold (2025): Merchants are flagged as “excessive” if the VAMP ratio is 2.2% or higher (220 basis points) and they have at least 1,500 fraud/dispute cases in a month. For merchants in the Middle East, Africa, and Latin America, the threshold is 150 disputes and at least $75,000 in disputed volume.

• Phase-down (April 1, 2026): In North America, Europe, and Asia-Pacific, the “excessive” threshold reduces to 1.5%. LATAM and Caribbean merchants are already held to 1.5% starting in 2025.

• Other reports: Some industry sources note that thresholds may be lower (for example, 1.5% in 2025 dropping to 0.9% in 2026). These may reflect regional variations or updated Visa guidance, so merchants should confirm with their acquirer.

Enumeration Ratio

• Definition: The enumeration ratio is calculated by taking the total number of authorization attempts that were part of a card-testing (enumeration) attack—both approved and declined—and dividing that by the total number of authorizations.

• Threshold: If 20% or more of transactions are enumeration attempts and there are at least 300,000 such attempts, the merchant is flagged as “excessive,” regardless of their VAMP ratio.

3. Timeline & Enforcement

• April 1–September 30, 2025: Visa’s Advisory Period—exceeding thresholds triggers notifications, but no fees are applied

• October 1, 2025 onwards: Enforcement begins—merchants flagged as “excessive” face $10 per fraudulent or dispute transaction fees

• Additional grace: merchants new to the program or with 12 consecutive clean months receive an extra 3-month grace—fees apply only if no clean month occurs during that window

4. What Merchants Should Watch For

• TC40 & TC15 double-counting: A single transaction may appear in both metrics—and thus be counted twice in your VAMP ratio

• Exclusions: Disputes resolved through pre‑dispute tools (e.g., RDR, CDRN, CE 3.0) may be excluded if timing lines up with data extract cutoffs

• Acquirer variability: Acquirers will likely enforce even stricter thresholds (some target merchant VAMP < 0.5%) to protect their own portfolios, and pass fees along to merchants

• Multi‑acquirer complexity: Merchants working with multiple acquirers must navigate potentially differing expectations, thresholds, and fees across portfolios.

5. Proactive Merchant Guide: Staying Compliant

• Monitoring: Obtain TC40/TC15 and enumeration data from your PSP or acquirer every month. Calculate your VAMP and enumeration ratios across all card-not-present transactions.

• Use Fraud & Dispute Tools: Implement tools like RDR, CDRN (Verifi/Ethoca), CE 3.0, and Order Insight to reduce disputes and potentially exclude resolved cases from VAMP counts.

• Prevent Enumeration: Deploy anti-card-testing measures, including Visa’s VAAI or third-party fraud prevention, to detect and block enumeration attempts.

• Engage Acquirers: Clarify thresholds, dispute definitions, and what counts toward the VAMP ratios. Understand what penalties they may pass on to you.

• Strengthen Processes: Improve customer service to reduce non-fraud disputes—clear messaging, fast issue resolution, and simple returns/refunds policies.

• Test Scenarios: Simulate elevated fraud or chargeback levels to ensure your systems and escalations trigger proactively.

• Policy Alignment: Stay informed on regional changes (such as PSD2/PSD3 requirements in the EU) that align with Visa’s tighter standards.

  
  

Visa’s revamped VAMP program, effective April 1, 2025, marks a substantial overhaul—both simplifying and tightening fraud and dispute monitoring. Merchants must now track a unified VAMP ratio and enumeration metric, adhere to stricter thresholds, and face real financial consequences for exceeding them. The grace and advisory periods offer breathing room—but only if merchants take swift, proactive action.

Ultimately, staying under VAMP thresholds isn’t about avoiding fines—it’s about fortifying your operation against fraud, protecting your revenue and reputation, and retaining flexibility in a rapidly evolving payment ecosystem.