Visa VAMP 2026: Mastering the New Dispute Thresholds

The Consolidation of Visa Dispute Monitoring

Visa used to run two separate programs. The Visa Dispute Monitoring Program (VDMP) tracked chargebacks, while the Visa Fraud Monitoring Program (VFMP) tracked fraud reports on its own. Visa merged both into a single Visa Acquirer Monitoring Program, and the shift changes far more than terminology.

The new Visa dispute monitoring system counts transactions, not dollars, so a high-volume, low-ticket merchant now carries the same exposure as a business processing far larger average tickets. Card-not-present (CNP) transactions face the sharpest scrutiny, since TC05 settled transactions form the baseline every ratio measures against.

How April 2026 Regional Thresholds Dropped

Most regions absorbed the same cut, but one major exception kept its older, looser limit. The table below compares where thresholds stood before April 2026 against where they sit today:

A lower headline number does not mean CEMEA escapes the update entirely. Visa paired that region's unchanged ratio with a far smaller monthly transaction count needed to trigger monitoring, so exposure still tightened in practice.

The VAMP Ratio Formula and Double-Counting Risk

The VAMP ratio itself is simple to write down: (TC40 fraud reports + TC15 disputes) divided by TC05 settled transactions. However, that simplicity hides a real problem for merchants who don't track both metrics from the same event forward.

A single case of friendly fraud can trigger both a TC40 fraud report and a TC15 dispute for the exact same transaction, and each one counts separately against the merchant. Visa's own data suggests roughly three-quarters of disputes start as friendly fraud, which means this double-counting mechanism inflates the numerator for most cases flowing through the ratio.

The False Decline Trap: Why Over-Blocking Fails

Risk directors trained on older fraud models often respond to rising ratios by blocking more transactions. Under VAMP, that instinct backfires: declining a legitimate transaction removes it from TC05, the ratio's denominator, without touching the numerator at all. Aggressive blocking shrinks the denominator faster than it reduces fraud, which pushes the VAMP ratio higher even as the block rate climbs. Furthermore, false declines cost real revenue on top of the compliance damage. The math now rewards approving more good transactions, not rejecting more of everything.

The Enumeration Ratio: Stopping Automated Card Testing

Visa tracks a second, separate metric built entirely around automated card-testing attacks. A merchant crosses into the excessive enumeration category once these attempts pass 300,000 monthly, requiring layered technical defenses to protect the ratio:

• Velocity checks that flag rapid, repeated card attempts from a single session or device
• Bot mitigation tools that block scripted, non-human traffic at the checkout gateway
• Device fingerprinting that spots the same fraud infrastructure reused across multiple attempts
• Step-up authentication triggered specifically on suspicious authorization patterns

None of these tools work in isolation. Layering them together catches enumeration attempts that any single defense would miss on its own.

Acquirer Portfolio Pressure and MATCH List Threats

Acquirers carry their own portfolio-wide thresholds of 50 basis points for Above Standard and 70 basis points for Excessive. When a portfolio drifts toward those limits, acquirers typically respond through severe escalating stages:

• Tightened processing limits or added reserve requirements on high-risk merchant accounts
• Settlement pauses that freeze incoming funds for days before formal notice arrives
• Merchant offboarding to protect the acquirer's overall portfolio ratio
• MATCH list placement, which can end the merchant's ability to accept Visa payments through any acquirer

Each stage tends to arrive with less warning than the one before it. Therefore, waiting for a formal notice from Visa is not a viable compliance strategy.

Best Technical Defenses: CE 3.0 and RDR

Not every dispute has to count against the ratio. Visa allows specific resolution channels to remove qualifying transactions from the VAMP numerator entirely, provided the merchant integrates the right systems ahead of time.

Rapid Dispute Resolution (RDR) settles a dispute automatically before it becomes a formal chargeback, pulling it out of the count. 3D Secure shifts liability to the issuer at the authorization stage, which keeps many disputes from being generated in the first place. Compelling Evidence 3.0 (CE 3.0) works differently: it excludes fraud claims after the fact, but only when the merchant already holds the right supporting data.

Strict Prerequisites for Compelling Evidence 3.0

CE 3.0 exclusions carry real value, but Visa sets a high bar for qualifying. Three requirements determine whether a merchant can use this channel at all:

1. Device ID and IP address captured on the transaction before any dispute occurs
2. At least 120 days of matching historical transaction data for that specific cardholder
3. Resolution completed within the same calendar month as the original dispute

Merchants that skip device fingerprinting today lose CE 3.0 as an option later, since none of this data can be captured retroactively.

Preparing Card Acceptance for Tighter VAMP Limits

Compliance strategy only goes so far without the processing infrastructure to back it up. Businesses adapting fastest to the new thresholds are the ones routing transactions through acquirers built for CNP risk management, rather than treating card acceptance as a single point of failure.

Smart routing spreads authorization attempts across multiple acquiring relationships, which limits how much any one merchant's activity affects a single portfolio's VAMP ratio. Reliable acquiring, paired with strong fraud tooling at the authorization stage, keeps both the numerator and the denominator working in the merchant's favor. TODA Pay's Card Payment Solutions give online businesses that infrastructure directly, combining resilient card acceptance with the routing flexibility VAMP compliance now demands.

Achieving Long-Term Stability in VAMP 2026

Adapting to the tighter Visa VAMP limits in 2026 demands continuous technical optimization and proactive risk management. By deploying robust fraud tools and diversifying your acquiring infrastructure, your business can maintain stable card acceptance and long-term financial growth.