If you sell supplements, OTC health products, subscriptions, or anything Visa considers high-risk, this checklist helps you find and fix compliance gaps before a VIRP notice — and a $50,000 fine — ever lands.
Visa's Integrity Risk Program (VIRP) can assess a $50,000 fine on a first offense, rising to $250,000 for repeat violations — often with little warning. The good news: most violations are preventable. Work through the checklist below.
Once a VIRP notice reaches your acquiring bank, you're on defense: reserves, fines, and possible placement on the MATCH list that makes opening new merchant accounts difficult for up to five years. Fixing issues before they're flagged is faster, cheaper, and keeps your processing uninterrupted. Everything below maps to what Visa and Mastercard actually look for.
Review your catalog against Visa VIRP and Mastercard BRAM prohibited-goods lists. Watch especially for prescription drugs sold without prescription, foreign/unapproved OTC medicines, SARMs, peptides, kratom and 7-OH, and anything requiring FDA approval you don't have.
The Merchant Category Code is how card networks classify you. A mismatch — for example, selling OTC drugs under a generic retail MCC — is itself a violation. Confirm your assigned MCC with your acquirer.
A clearly linked, plain-language refund/return policy is a baseline transparency requirement. Missing or buried policies are a top chargeback and VIRP trigger.
Both should be linked in your footer on every page and cover data handling, cancellation rights, and the terms of sale.
Display your legal entity name, a physical or registered address, and a support email — not just a phone number. Networks assess merchant legitimacy from these signals.
Remove "miracle cure" language, guaranteed-results promises, disease-treatment claims on supplements, and any implication of FDA approval you don't hold.
If you use auto-renewal or continuity billing, disclose the amount, frequency, renewal date, and cancellation steps clearly at checkout. Negative-option billing is under heavy scrutiny in 2026.
If your store serves one country but sells products sourced or labeled for another (a common cross-border pharmaceutical flag), state clearly which products ship where and confirm they're approved in the destination market.
Rising chargebacks are a leading VIRP trigger. Clear product descriptions, accurate billing descriptors, and responsive support reduce disputes.
Branded replicas, unlicensed streaming, and trademark-infringing items are fast-track violations, often caught by "secret shopping" test purchases.
Adult, gambling, and certain regulated categories need age verification and content moderation. Confirm you meet the requirements for your vertical.
Under 2026 Mastercard monitoring rules, password-protected and members-only sections are in scope. Make sure nothing behind a login violates the rules your public pages follow.
Run a free automated scan and see your VIRP risk level, suggested MCC, and specific fixes in about 30 seconds.
🛡️ Scan My Website FreeDon't panic — most items above are fixable in an afternoon. Prioritize anything in the product and claims categories (items 1, 6, 8, 10), since those carry the highest risk. Publish missing policies, correct your MCC with your acquirer, and remove non-compliant products or claims.
Already received a VIRP notice or a fine? That's a different situation. Upload it to VerifyMID's notice analyzer to check whether it's even legitimate and understand your appeal rights before you pay anything.
Compliance isn't one-and-done. Your catalog changes, you add promotions, and the rules themselves evolve — Mastercard's monitoring program expanded in 2026. Re-scan whenever you add products, change your billing model, or at least quarterly.
Scan your store now, and analyze any notice you receive — both free, no card required.
🛡️ Start Free ScanVerifyMID provides compliance intelligence and document analysis, not legal advice. For decisions about your specific situation, consult a qualified attorney.