The Visa Integrity Risk Program (VIRP): What It Means If You Are a High-Risk Merchant

What is the Visa Integrity Risk Program?

VIRP decides which banks are allowed to serve certain business types, and what those banks have to do before and after they take one on. It replaced an older programme that did a similar job under a different name.

The label it applies is high integrity risk merchant. The businesses in scope are lawful. What puts them on the list is that if a company in one of these categories runs loosely, some of what passes through it may not be lawful, and the card network ends up connected to that. Visa's answer is not to close the categories. It is to be very selective about which banks may serve them.

Nearly all published material on the programme is written for banks, payment facilitators and compliance teams, because they are the ones it obligates. Very little is written for the merchant living with the results.

Which businesses are covered?

If you sell in one of these categories without the card present, you are in scope, whatever your own record looks like. The label follows the business type, not your behaviour.

The workload on your bank rises with the tier, so a Tier 1 business goes through considerably more than a Tier 3 one. Visa sets these lists and revises them, so treat the table as the shape of the thing and confirm your own position with your acquirer.

Note the last row. Negative-option subscription billing earns its own place, which means a plain continuity business with nothing adult or regulated about it can be inside this framework purely because of how it charges. Worth knowing before you assume none of this touches you, and it connects straight to how recurring billing gets underwritten.

Why can only a few banks take my business?

This explains more merchant frustration than anything else in payments.

A bank cannot simply decide to serve these categories. It has to be approved first, and that approval has to be in place before it goes looking for merchants like you, signs one, or runs a single transaction. For the most sensitive categories the permission is granted one category at a time, so a bank cleared for one of them has to go back and ask again for the next. It also submits to a review of its own controls, gets reviewed again periodically, and has to be in good standing across the network's other risk programmes to qualify at all.

That is a real, ongoing commitment, and most banks look at the economics and pass. What is left is a very short list of institutions able to serve any given sensitive category in the United States.

So a decline usually means something different from what merchants assume. It is rarely a bank reading your file and finding it wanting. It is far more often a bank that was never permitted to serve your category and could not have said yes to anyone. Merchants collect six or ten rejections and conclude something is wrong with their company. Usually nothing is. They are knocking on doors that were never open, which is the argument for going through someone who knows which ones are. That is what a deliberate setup is for.

Why am I registered with Visa by name?

Because the programme requires your bank to register you before you send transactions, and to confirm to Visa that it has done the homework and will keep watching. That confirmation gets renewed, and your registration is supposed to stay current as your business moves.

Two consequences, and both catch people out.

Your registration is specific. The websites and the activity you were registered for are part of the record. Quietly launching a new site or a materially different product line is not a neutral act, because it can put you outside what was actually reviewed. Tell your processor before you launch, not after.

Your bank has put its own name behind you. It has told Visa, in writing and annually, that you are running properly. That is why underwriting in these categories digs into your processes far more than your financials seem to justify. The bank is not being difficult. It is being asked to vouch for you.

What does it cost?

There is an annual registration fee for every bank you are registered with, and it rose when the programme took effect. Reported figures put it at $950 a year, up from $500, with per-transaction and volume-based charges applied to some categories on top. Mastercard runs its own parallel registration with a separate annual fee.

The networks set and revise these amounts, and what actually reaches you depends on how your bank passes them through, so get current numbers from your processor rather than budgeting from any published figure, this one included.

The point is not the exact number. It is that a quote which leaves registration out is not the real cost of your account. A provider who never raises it either does not work in your category often or is happy for you to find out on your first statement.

Why does approval take so long now?

Because there are more steps between your application and your first transaction, and several happen somewhere other than your processor. Your bank does the background work, writes it up, registers you, and confirms the review to Visa. In the heavier tiers that is substantial.

Knowing that changes how you prepare. The bottleneck is paperwork, not persuasion. Merchants who move fastest turn up with the file already built: corporate records, processing history, refund and dispute policies, the compliance controls specific to their category, and a precise description of what they sell. Anything you cannot produce on request is another round trip.

It also explains why a vague application does so badly. Someone who has to vouch for you to Visa cannot do it from a rough idea of your business. Being precise helps you.

What should I do about it?

Find out your tier. Ask your processor which category and tier you sit in. It drives your paperwork and your cost, and a surprising number of merchants have never asked.

Keep your registration current. New sites, new products and new billing models go to your processor first. Cheapest compliance habit there is, and the one most often skipped.

Stop reading declines as verdicts. Most are a category mismatch. Target banks permitted to serve what you do instead of applying widely and hoping. The Merchant Risk Profiler shows you how the rest of your file reads.

Build redundancy. Banks under pressure in a category reduce their exposure to it, and that can mean offboarding merchants who have done nothing wrong. It is the mechanism behind those episodes where an entire category gets the same letter on the same day. Your conduct did not cause it and your conduct cannot prevent it. One relationship in a registered category is a single point of failure you do not control, which is the whole argument for stopping payment processing problems before they start.

This is a general explanation of a card-network programme, not legal or compliance advice. Rules change, and your acquirer is the authority on how they apply to your account. Visa publishes current information through its merchant resources, and the trade press, including The Green Sheet, has covered the programme since it launched.