The Visa Integrity Risk Program (VIRP): What It Means If You Are a High-Risk Merchant

What is the Visa Integrity Risk Program?

VIRP is the framework Visa uses to govern which acquiring banks are permitted to serve legal but sensitive business types, and what those banks must do before and after they take one on. It replaced the older Global Brand Protection Program, and Visa's own description of the objective is to keep illegal activity out of its payment system while still allowing lawful businesses in these categories to operate.

The term the program uses is high integrity risk merchant, which replaced the older phrase "high brand risk." The wording change is worth noticing, because it captures what the program is actually about. These are business types that are entirely legal, but where the absence of proper controls creates a heightened risk that some transactions will not be. Visa's response is not to ban the categories. It is to be extremely selective about who is allowed to bank them.

Nearly everything published about VIRP is written for acquirers, payment facilitators and compliance teams, because that is who the program obligates. Very little of it is written for the merchant on the other side of the process, which is a shame, because the merchant is the one living with the consequences.

Am I a high integrity risk merchant?

If you are in one of these categories and selling card-absent, then yes, whatever your own compliance record looks like. The classification attaches to the business type, not to your conduct.

Diligence obligations scale with the tier, so a Tier 1 business faces a materially heavier process than a Tier 3 one. Categories and their assignments are set by Visa and revised periodically, so treat the table above as the shape of the thing rather than a current legal reference, and confirm your own classification with your acquirer.

One detail catches people out: negative-option subscription billing appears here in its own right. A perfectly ordinary continuity business, nothing adult or regulated about it, can be inside this framework purely because of how it bills. That is worth knowing before you assume none of this applies to you, and it connects directly to how recurring billing gets underwritten.

Why can only a few banks take my business?

This is the part that explains more merchant frustration than anything else in payments, and it is the single most useful thing to understand about the program.

An acquirer cannot simply decide to serve these categories. It must apply to Visa for high integrity risk registration before it solicits, contracts with, or processes for a single merchant in scope. For the most sensitive categories the approval is granted per category, so a bank cleared for one Tier 1 business type has to go back to Visa for another. On top of that, the bank undergoes an assessment of its own controls, faces re-assessment periodically, and must be in good standing across Visa's other risk programmes to qualify at all.

That is an expensive, ongoing commitment, and most banks look at the economics and decline to make it. The result is a very short list of institutions able to acquire any given sensitive category in the United States.

So when an application is declined, the likeliest explanation is not that a bank assessed your business and found it wanting. It is that the bank was never registered to take your category and could not have said yes to anyone. Merchants collect six or ten of these rejections and reasonably conclude that something is wrong with their company. Usually nothing is. They are simply knocking on doors that are structurally shut, which is the argument for going through someone who knows which doors are open. That is what a deliberate setup is for.

Why do I get registered with Visa by name?

Because the program requires it. Merchants in scope are registered with Visa by their acquirer before transactions are submitted, and the acquirer attests that it has performed the required diligence and will keep monitoring. That attestation is renewed, and registrations are expected to be kept current as your business changes.

Two practical consequences follow, and both surprise merchants:

First, your registration is specific. URLs and business activity form part of what the acquirer registers and maintains. Quietly launching a new site or a materially different product line is not a neutral act. It can put you outside what was registered and reviewed, which is a compliance problem rather than a commercial one. Tell your processor before you launch, not after.

Second, your bank has put its own name behind you. When an acquirer attests to Visa about your controls, it takes on your exposure. That is why underwriting in these categories asks about your processes in far more depth than your financials seem to justify. The bank is not being obstructive. It is being asked to vouch for you in writing to Visa, annually.

What does it cost?

There is an annual registration fee per acquirer you are registered with, and it went up when the program took effect. Widely reported figures put it at $950 a year, raised from $500, with per-transaction and volume-based components applied to certain categories on top. Mastercard runs a parallel registration with its own annual fee.

Because the networks set and revise these amounts, and because what reaches you depends on how your acquirer passes them through, confirm current numbers with your processor rather than budgeting from any published figure, including this one.

The useful point is not the exact number. It is that a quote which ignores registration entirely is not the real cost of your account. If a provider has not raised it with you, they either do not work in your category often or they are content for you to discover it on your first statement.

Why does approval take longer than it used to?

Because there are now more steps between your application and your first transaction, and several of them are not happening at your processor at all. The acquirer performs enhanced diligence, documents it, registers you with Visa, and attests to the review. For the more sensitive tiers, that diligence is genuinely substantial.

Knowing that changes how you should prepare. The bottleneck is documentation, not persuasion, so the merchants who move fastest are the ones who arrive with the file already assembled: corporate records, processing history, refund and dispute policies, the compliance controls specific to their category, and a clear, accurate description of what they actually sell. Every item you cannot produce on request is another round trip.

It also explains why a vague application performs so badly. An underwriter who has to attest to Visa about your controls cannot do so from an approximate understanding of your business. Precision helps you.

What happens if my acquirer gets it wrong?

The program defines non-compliance and remediation at the acquirer level, and assessments can follow. That sounds like somebody else's problem, and structurally it is, but it lands on merchants in a way worth planning for.

An acquirer under pressure in a category tends to reduce its exposure there, and that can mean offboarding merchants who have done nothing wrong. This is the mechanism behind those episodes where a whole category is dropped at once and every merchant in it receives the same letter on the same day. Your own conduct did not cause it and your own conduct cannot prevent it.

The only real protection is not to have all your volume in one place. Redundancy in processing relationships is unglamorous and it is the difference between a bad week and being offline, which is the entire argument behind stopping payment processing problems before they start.

What should I actually do about it?

Four things, in order.

Find out your tier. Ask your processor which category and tier you are registered under. It determines your diligence burden and your cost, and a surprising number of merchants have never asked.

Keep your registration accurate. New URLs, new products, new billing models go to your processor first. This is the cheapest compliance habit available to you and the one most often skipped.

Stop reading declines as verdicts. Most are a category mismatch, not an assessment of your business. Target banks that are registered for what you do rather than applying widely and hoping. You can see how the rest of your file reads with the Merchant Risk Profiler.

Build redundancy. One acquiring relationship in a registered category is a single point of failure you do not control.

This is a general explanation of a card-network programme and not legal or compliance advice. Programme rules change, and your acquirer is the authority on how they apply to your account. Visa publishes current information through its merchant resources, and the trade press, including The Green Sheet, has covered the programme since it was introduced.