On 1 April 2027 Mastercard replaces its Acquirer Chargeback Monitoring Program with a Global Merchant Audit Program, and moves the existing Excessive Chargeback and Excessive Fraud Merchant categories inside it. The change was announced on 28 July 2026 in bulletin GLB 14127.1. The new program adds a ratio that counts reported fraud and non-fraud chargebacks together, sets thresholds for acquirer portfolios as well as for merchants, measures a payment facilitator's sub-merchants one by one where the clearing record identifies them, and tightens the Excessive Chargeback Merchant threshold each year from 2029 to 2031.
Mastercard has not published the bulletin, which went to members through Mastercard Connect. The figures below are those on which several independent industry summaries of it agree, and we say where they disagree. For the rules as they stand today we use Mastercard's public Security Rules and Procedures manual, 4 August 2026 edition. This piece is current as of 1 October 2026.
The Name Is Old. The Program Is Not.
Mastercard has used the GMAP name before. The earlier program monitored fraud only and sorted merchants into tiers by fraud count, fraud amount and fraud-to-sales ratio. Section 8.2 of the August 2026 Security Rules and Procedures manual says only that the Global Merchant Audit Program "has been suspended until further notice". Anything you find online about GMAP tiers describes that older program, not the one starting in April.
Today, chargeback monitoring runs through the Excessive Chargeback Program in section 8.3 of the same manual. That section points to the Acquirer Chargeback Monitoring Program chapter of Mastercard's Data Integrity Monitoring Program manual, which members can read and the public cannot. The manual identifies a merchant by the acquirer-assigned merchant ID in the clearing record. It calculates basis points as one month's chargebacks divided by the previous month's Mastercard transactions for that merchant, multiplied by 10,000.
What the New Ratio Counts
The summaries agree on the main change. The four new categories score a merchant or an acquirer on one combined number: transactions reported as fraud to Mastercard's Fraud and Loss Database plus non-fraud chargebacks, divided by the previous month's sales count. Like the existing ratio, it counts transactions, not dollars.
Fraud counts once an issuer reports it, whether or not a chargeback follows, and that is the change that matters most for a risk team. Today's Excessive Chargeback ratio never saw fraud that was reported but not charged back. The new ratio does. A merchant whose chargeback numbers look healthy can still score badly if issuers are reporting fraud against it.
The Merchant Categories
Two new categories apply at merchant level. A merchant has to meet every condition in a category to be identified.
- High Dispute Merchant (HDM): at least 5 cleared transactions, at least US$5,000 in combined reported fraud and non-fraud chargebacks, and a combined ratio of 500 basis points (5%) or more.
- Excessive Dispute Merchant (EDM): at least 5 cleared transactions, at least US$10,000 in combined reported fraud and non-fraud chargebacks, and a combined ratio of 5,000 basis points (50%) or more.
The ratios look loose next to the 1.5% Excessive Chargeback threshold, but the floors are what matter: five transactions and a few thousand dollars will catch a small or new merchant whose sales are mostly fraud or disputes long before it reaches 100 chargebacks a month.
The summaries report the same monthly assessment schedules, which rise the longer a merchant stays identified:
- HDM: no assessment in months 1 to 6, US$5,000 a month in months 7 to 11, US$10,000 in months 12 to 18, and US$25,000 from month 19.
- EDM: US$5,000 in month 1, US$25,000 in month 2, US$100,000 a month in months 3 to 11, US$200,000 in months 12 to 18, and US$300,000 from month 19.
EDM can also shift liability. The summaries report that a merchant identified as EDM for two consecutive months becomes liable for fraud-related chargebacks on its transactions from the three months before identification and the six months after. Several of them say issuers recover these under reason code 4849, which the current rules name Questionable Merchant Activity, but one notes that sources disagree on whether the bulletin ties 4849 to GMAP or to the Questionable Merchant Audit Program. Confirm the mechanism with your acquirer before telling a merchant about it. The summaries do agree that an audit closes once the merchant has stayed below both the HDM and EDM thresholds for three consecutive months.
The Acquirer Categories
Two categories apply to the acquirer's whole portfolio. Most of the summaries describe the same activity floor for both: at least 1,500 cleared transactions, and at least 1,500 transactions reported as fraud or charged back in the month.
- High Dispute Acquirer (HDA): a combined ratio of 50 basis points (0.5%) or more. No assessment in months 1 to 11, then US$25,000 a month in months 12 to 18 and US$50,000 from month 19.
- Excessive Dispute Acquirer (EDA): a combined ratio of 70 basis points (0.7%) or more. No assessment in months 1 and 2, then US$10,000 a month in months 3 to 6, US$25,000 in months 7 to 11, US$50,000 in months 12 to 18 and US$100,000 from month 19. The summaries also describe a Franchise Management Program review once an acquirer has been identified for 12 months, and possible restrictions on its licence after that.
Two caveats. One summary gives US$10,000, not US$50,000, as the HDA assessment from month 19, out of line with the others. Two summaries say acquirer performance is measured separately for card-present and card-not-present activity, and the rest do not mention it either way.
If you run Visa volume too, the acquirer numbers will look familiar. Visa's Acquirer Monitoring Program identifies an acquirer at 50 and 70 basis points, with the same minimum of 1,500 fraud and dispute transactions a month. Visa's ratio covers card-not-present transactions only, so the two are not one measurement, but both networks now score the portfolio as a whole, and score it more tightly than they score any single merchant.
Existing Programs Move In, and Get Tighter
The Excessive Chargeback Merchant, High Excessive Chargeback Merchant and Excessive Fraud Merchant categories are not abolished. They move inside GMAP and keep running. A merchant enters ECM at 100 or more chargebacks in a month with a ratio of 150 to 299 basis points, and HECM at 300 or more chargebacks with a ratio of 300 basis points or more. The summaries agree that the ECM ratio band then narrows each year while the 100-chargeback minimum stays the same:
- 1 April 2027 through 2028: 150 to 299 basis points.
- From 1 January 2029: 130 to 299 basis points.
- From 1 January 2030: 110 to 299 basis points.
- From 1 January 2031: 90 to 299 basis points.
By 2031 the ECM floor of 0.9% will sit below the 1.5% merchant threshold Visa applies today. A merchant with 100 or more chargebacks a month at a 1.2% ratio is clear of ECM now and will be inside it from 2030.
Payment Facilitators Lose the Blended Number
Today an Excessive Chargeback Merchant is identified by the merchant ID in the clearing record, and for a payment facilitator that ID often covers the whole sub-merchant book. From 1 April 2027, according to the summaries, ECM, HECM and EFM measure each sub-merchant separately wherever the clearing record carries a sub-merchant identifier. Some summaries describe the new categories working the same way; others limit the change to the three existing ones.
Until now, a sub-merchant with a bad dispute rate has been averaged into the facilitator's blended figure. From April that one seller can be identified by itself, which is worse news for a facilitator with no view of performance by sub-merchant than for one that already tracks it.
QMAP Gets Faster and Lower
The same bulletin revises the Questionable Merchant Audit Program, under which issuers obtain partial recovery of fraud losses at a merchant Mastercard finds collusive or fraudulent. Section 8.4 of the August 2026 manual requires at least US$50,000 in volume over a 120-day case scope period, and one of its two qualifying tests needs three of four conditions, one being that the merchant has processed for under six months.
From 1 April 2027, the summaries report, the volume floor falls to US$10,000, the case scope period shortens to 30 days (extendable to 60), and the six-month condition is removed, leaving two of three conditions to meet. An established merchant used to have to meet all three of the others. Now two are enough.
What This Changes for Your Team
Risk and monitoring
Build the combined ratio now, for every merchant and for the portfolio as a whole. A view that tracks chargebacks alone will miss fraud that issuers report without charging back, the half of the number most likely to surprise you, and the half support will need in front of it when a merchant asks why it is under review. Add the five-transaction and US$5,000 floors as alerts, so that a new merchant whose volume is mostly fraud shows up in its first month and does not wait for the 100-chargeback mark.
Underwriting
The ECM schedule is known through 2031, so price for it. A merchant you write today at 1.2%, with enough volume to reach 100 chargebacks a month, will be inside ECM from 2030 unless its chargeback rate falls. For card-not-present merchants, the acquirer thresholds of 0.5% and 0.7% mean every merchant you approve uses up part of the portfolio's room under them.
Payment facilitators and ISOs
Check that sub-merchant identifiers are filled in consistently, and get dispute and fraud reporting by sub-merchant from your platform before April. If your sponsor bank or acquirer passes Mastercard assessments through to you, ask now how it will pass through HDM, EDM, HDA and EDA assessments, and what notice it will give you.
What We Could Not Verify
We have not read the bulletin itself. The open questions are the HDA assessment from month 19, whether acquirer performance is split between card-present and card-not-present, and how the EDM liability window links to reason code 4849. Your acquirer has the bulletin and should be able to confirm each in writing before April.
Tags
About the author
Kyle Hall
Founder
Kyle Hall is a fintech entrepreneur, software engineer, and marketing strategist with over a decade of experience in high-risk payment processing and SaaS development. He is the CEO of PayKings, a leader in high-risk merchant services, and the founder of PulseCRM, a purpose-built CRM platform for the payments industry. Kyle specializes in building custom payment processing systems and growth strategies that empower merchant services providers to scale and succeed in the digital marketplace.