Visa Integrity Risk Program (VIRP): What It Monitors

Visa runs two separate risk programs, and merchants routinely confuse them. One watches your dispute and fraud ratios. The other doesn't care about your ratios at all.

The Visa Integrity Risk Program is the second one. Visa's glossary describes it as a global program that monitors acquirers, merchants, marketplaces, payment facilitators, sponsored merchants, and digital wallet operators to make sure they don't process illegal transactions, engage in potentially deceptive marketing practices, or process transactions that may adversely affect the goodwill of the Visa system (ID# 0030983, Visa Core Rules and Visa Product and Service Rules, 18 April 2026).

Read that list again. Legality. Marketing claims. Brand damage. Not one word about chargebacks.

You can run a spotless 0.2% dispute rate and still land in VIRP. You can also have an ugly dispute rate and never come near it. They measure different things, which is why monitoring your chargeback ratio tells you nothing about your VIRP exposure.

It Can Reach You Without Going Through Your Acquirer#

Most network enforcement travels through your acquirer. VIRP doesn't have to.

Section 1.9.1.4 (ID# 0007120) lets Visa permanently prohibit a merchant, or one or more of its principals, from participating in the Visa program for reasons it deems appropriate. Non-compliance with the Visa Integrity Risk Program is on the list, described as "entering illegal or brand-damaging Transaction activity into the Visa payment system."

Two details in that rule matter more than the headline.

The first is "one or more of its principals." The prohibition attaches to people, not just to the company. Closing the entity and opening a new one doesn't reset it, and the same section separately names entering a merchant agreement under a new name with intent to circumvent the rules as its own ground for permanent prohibition.

The second is the line at the end of the section: Visa may contact a merchant, a marketplace and its retailers, a sponsored merchant, a payment facilitator, or a digital wallet operator directly, if warranted. Your acquirer is not always the messenger.

Seven Business Days#

This is the deadline nobody tells merchants about until it's running.

Under section 1.9.2.2 (ID# 0026384), an acquirer must provide information relating to any request for information presented by Visa, its designees, or any regulatory agency, as required under VIRP. The response has to be in writing, as soon as possible, and no later than 7 business days after the request is received.

Your acquirer owns that clock, but you're the one who has the documents. If a VIRP request for information lands and you take a week to find your product substantiation, your marketing archive, or your licensing paperwork, your acquirer misses a network deadline because of you. That's the kind of thing that ends a relationship even when the underlying answer would have been fine.

Keep the file current before anyone asks for it. That's the whole lesson.

Your First 30 Days Set the Baseline#

Section 10.4.5.2 (ID# 0008137) tells your acquirer exactly how to watch a high-integrity risk merchant or payment facilitator. It has to retain daily gross sales volume, average transaction amount, number of transaction receipts, and number of disputes. It collects that for at least one month starting after your first deposit, uses it to establish your normal daily activity, and then begins daily monitoring on the 31st calendar day from that first deposit.

So your opening month isn't a grace period. It's the measurement that everything afterward gets compared against.

A merchant who soft launches at low volume and then scales hard in month two looks like an anomaly against its own baseline, even though nothing is wrong. If you know a launch or a campaign is coming, tell your acquirer before it happens rather than after the monitoring flags it.

A VIRP Report Is a Named Reason for Termination Listing#

Section 10.10.1.1 lists the reasons an acquirer must add a terminated merchant to the Terminated Merchant File. "The Merchant was identified by the Visa Integrity Risk Program (VIRP) reports" is one of them, sitting alongside card fraud convictions, transaction laundering, and excessive unauthorized transactions.

The listing is fast. The acquirer must add a terminated merchant no later than close of business on the day following the date the merchant is notified of the intent to terminate. Not the termination date. The notification date.

The same section requires the termination file to contain all Visa Integrity Risk Program reports relating to the merchant, along with the merchant agreement, deposit history, dispute details, correspondence, and the names and identification of the principals.

If you end up on that list, getting off it is a documented process, but it's much harder than staying off.

Being Named Closes the Cross-Border Door#

Here's a consequence most merchants discover at the worst possible moment.

The rules on cross-border acquiring carry a footnote (ID# 0008552) stating that the acquirer, payment facilitator, and sponsored merchant must not be identified in any Visa risk program, naming VAMP and VIRP as examples, or have had excessive risk program violations in the 3 years before entering into a merchant agreement or payment facilitator agreement.

The common plan after a domestic account fails is to look at international acquiring. If you were named in a VIRP report, that route is closed for three years, and it closes at exactly the point you were counting on it.

Don't Try to Look Like a Different Merchant#

Section 12.5.3.2 (ID# 0030702) is short and expensive. If Visa determines that an acquirer, a merchant, a sponsored merchant, or a third party agent changed, modified, or altered the merchant name, merchant data, or merchant performance in any way to circumvent VAMP or VIRP, Visa may impose a non-compliance assessment of USD 25,000 per merchant per month on the acquirer, and permanently disqualify the merchant and its principals from the Visa system.

That rule is why a consultant offering to "clean up how your account looks" is offering to end your acquirer relationship. Splitting volume across multiple MIDs for legitimate operational reasons is normal. Doing it to change what a monitoring report sees is not, and the difference is intent, which your acquirer will be asked about.

What Actually Lowers VIRP Exposure#

None of this is about your dispute rate, so none of the usual chargeback advice helps. What does help:

Match your marketing to what you can prove. Deceptive marketing practices are named in the program definition itself. Income claims, health claims, and free trial terms are where this usually bites.

Keep your MCC honest. Visa classifies high-integrity risk merchants by the MCCs they're required to use. A code chosen to look softer than the business is the manipulation the rules above describe.

Keep licensing and substantiation filed and current, so a 7 business day request is a forwarding job rather than a research project.

Tell your acquirer about changes in what you sell before they show up in the data. A new product line inside an existing account is the most common way a clean merchant drifts into a category it was never underwritten for.