Plain-English answers to the questions merchants ask after receiving a Visa VIRP notice, a compliance fine, or a reserve hold. If a payment processor flagged your business, start here.
A VIRP (Visa Integrity Risk Program) notice is issued when Visa believes a merchant is processing prohibited or brand-damaging transactions — for example, illegal pharmaceuticals or counterfeit goods. The program took effect on May 1, 2023, replacing Visa's earlier Global Brand Protection Program.
The notice typically carries a Non-Compliance Assessment (NCA) fine of $50,000 on a first offense, which can rise to as much as $250,000 for repeat violations. Visa sends the notice to the acquiring bank, who passes it down through the payment processor to the merchant — often stripped of the original Visa case number and appeal information.
A Visa VIRP Non-Compliance Assessment is typically $50,000 for a first offense and can escalate up to $250,000 for repeat violations. Mastercard's equivalent program (BRAM) carries fines ranging from $5,000 to $200,000 per violation.
Yes. Under Visa Rule ID #0025975, a merchant may appeal a Non-Compliance Assessment by providing new evidence that the violation did not occur. A $5,000 appeal fee applies and is refunded if the appeal is granted.
Importantly, many processors do not disclose this appeal right when they pass a fine down to the merchant. If your notice did not mention an appeal process, that does not mean one doesn't exist.
A legitimate VIRP case has a Visa-assigned TLD ID or Case Number recorded in the VIRPCM system, and the original notice is on Visa letterhead, addressed to the acquiring bank.
Red flags worth verifying: the document is only on the processor's letterhead, there is no case number, no specific products or transactions are cited, appeal rights are not mentioned, and there is no confirmation the fine was actually remitted to Visa.
An NCA is the financial penalty Visa assesses against an acquiring bank when one of its merchants is found non-compliant under VIRP. The acquirer typically passes this cost down to the merchant. The assessment is governed by Visa Rules Section ID #0026387.
BRAM (Business Risk Assessment and Mitigation) is Mastercard's program to protect its network from illegal or brand-damaging transactions — the Mastercard equivalent of Visa's VIRP. It cites Mastercard Rules 3.7 and 5.12.7, uses "secret shopping" test purchases to confirm prohibited sales, and carries fines from $5,000 to $200,000.
MATCH (Member Alert to Control High-risk merchants) is a Mastercard-maintained database of merchants whose accounts were terminated for cause, including card network rule violations. Being listed makes it very difficult to open new merchant accounts for up to five years. Acquirers check MATCH during onboarding.
If a card network issues a fine, the acquiring bank or processor may debit it directly from your settlement account. However, they are generally expected to provide supporting documentation.
You can request, in writing: the original network notice, the case number, the specific violation and products involved, and confirmation that the fine was actually remitted to the network rather than retained by the processor.
Common triggers include illegal or unapproved pharmaceuticals, prescription drugs sold without a prescription, controlled substances, cannabis products, supplements making illegal drug claims (such as SARMs or research chemicals), counterfeit or trademark-infringing goods, unapproved adult content, and illegal gambling.
Beyond products, aggressive or misleading marketing, hidden subscription or continuity billing, missing policies, and a mismatch between your registered business category (MCC) and what you actually sell can all raise your risk profile.
No. VIRPCM (Visa Integrity Risk Program Case Management) lives inside Visa Online and is only accessible to Visa members — that is, acquiring banks. Merchants cannot log in directly and must request case information through their acquirer or the acquirer's sponsoring bank.
Scan your website for VIRP risks, or upload your notice to see if it's even legitimate. Free, no card required.
VerifyMID provides compliance intelligence and document analysis, not legal advice. For decisions about your specific situation, consult a qualified attorney.