Last week's piece on Mastercard's specialty merchant registration fees said that Visa runs a parallel program, the Visa Integrity Risk Program, whose fee structure is not published in the same way, so we were not quoting figures from it. That is still true of the fees. It is not true of the obligations. The Visa Core Rules and Visa Product and Service Rules are public, and the 18 April 2026 edition carries the acquirer's VIRP duties, the monitoring standard, the response clocks and the non-compliance assessments in plain text. What it does not carry is the tier table and the price list, which live in the Visa Integrity Risk Program Guide, a member document.
What follows is drawn from the public rules as of September 2026, with the member-only parts marked. If your book includes an online pharmacy, a dating site, a gaming operator, a crypto on-ramp or a negative-option subscription seller, this is the part of Visa's rulebook that decides whether you can board them and what you owe Visa once you have.
What VIRP Is, in Visa's Own Words
Visa's Network Integrity page describes the program as one that works to prevent, identify and remove illegal activity across the ecosystem. Merchants in higher-risk categories such as adult content or gambling go through an enhanced registration process and are subject to closer performance monitoring, and acquirers are expected to investigate potentially illegal activity and terminate Visa acceptance for merchants that cannot comply with applicable law. Visa says acquirer remediation and terminations for merchant non-compliance increased fivefold between 2020 and 2024.
The program replaced the Global Brand Protection Program. LegitScript, which certifies pharmacy and healthcare merchants for card acceptance, dated the change to 1 May 2023 in a note published a month later; some vendor guides date it to 1 April 2024, which is the date most third-party reports give for a later pricing change. We have taken the contemporaneous date. The rulebook's vocabulary followed: it now speaks of a High-Integrity Risk Merchant, Payment Facilitator, Sponsored Merchant and, since 2024, a High-Integrity Risk Ramp Provider for crypto conversion.
Who Is in Scope, and Where the Public Rules Stop
Rule 10.4.5.1 is a single sentence: Visa classifies a merchant required to use MCCs for a High-Integrity Risk Merchant as specified in the Visa Integrity Risk Program Guide. The list of codes is in the guide, not the rules. The tiers that circulate online come from that guide as relayed by vendors. As LegitScript reported it in June 2023, and as two high-risk processors' guides updated this year repeat it where they give codes at all: Tier 1 covers adult content (5967), dating and escort services (7273), gambling (7995) and pharmacies (5122 and 5912); Tier 2 covers cryptocurrency (6051, and 6012 with special condition code 7), cyberlockers and file-sharing (4816) and card-absent games of skill (5816); Tier 3 covers card-absent financial trading platforms (6211), outbound telemarketing (5966), negative-option billing (5968) and cross-border card-absent tobacco (5993). Treat that as attributed reporting, not rule text; one of the processors' guides omits 5967 and gives no Tier 3 codes, and the trading-platform code rests on LegitScript alone.
The rules do settle three scope questions themselves. A footnote to the registration rule exempts a merchant assigned MCC 5122 or 5912 from registration if it is accredited by the National Association of Boards of Pharmacy or another regulatory body recognized by Visa. The MCC assignment rule requires an acquirer to give a merchant outlet two or more codes when separate lines of business share a location and one of them is designated high-integrity risk, so the high-integrity risk line cannot ride under the outlet's general code. And for crypto, the coding table says that if any transaction relates to a High-Integrity Risk Merchant the applicable high-integrity risk MCC must be used, while the ramp provider rules require a ramp provider that supports a conversion affiliate Visa classifies as high-integrity risk to be registered as a High-Integrity Risk Ramp Provider, with the affiliate registered as a merchant, before submitting transactions.
The reach extends past merchants: a digital wallet operator whose wallet can be used at a retailer Visa classifies as high-integrity risk must itself be registered as one, and ensure the retailers it pays are registered too.
Before the First Transaction
Rule 1.9.5.1 lists what an acquirer must do before submitting a single transaction from a high-integrity risk merchant, payment facilitator, sponsored merchant or ramp provider. It must submit a High-Integrity Risk Acquiring Registration Application and be approved by Visa; undergo a financial review and have the required equity capital, be investment-grade, or commit to compensating controls such as collateral as Visa determines; conduct due diligence against the Visa Acceptance Risk Standards and, if required, complete and fully remediate an on-site VARS review; be in good standing in every Visa risk management program; and register each merchant through Visa's Program Request Management application, along with each high-integrity risk payment facilitator and its sponsored merchants, each ramp provider and its conversion affiliates, and any agent that solicits high-integrity risk merchants.
The item that catches payment facilitators is in the contracting rule: a facilitator that becomes high-integrity risk must be registered as a High-Integrity Risk Payment Facilitator even if it was already registered with Visa as an ordinary one. Its agreement then needs two clauses under rule 10.4.6.1: every high-integrity risk sponsored merchant agreement must be signed by a senior officer of the facilitator, and the facilitator must report to the acquirer both the acquisition of each new high-integrity risk sponsored merchant and monthly transaction activity for all of them. For a merchant assigned MCC 5967, the merchant agreement must also include the provisions in section 3.1.1 of the guide, which we cannot quote.
After Boarding: The Monitoring Standard Is Specific
Rule 10.4.5.2 is the operational core of the program, and it is more prescriptive than most acquirer monitoring policies. For each high-integrity risk merchant or payment facilitator the acquirer must retain at least four daily figures: gross sales volume, average transaction amount, number of transaction receipts and number of disputes. It must collect that data for at least one month from the merchant's first deposit, use it to establish the merchant's normal daily activity in each category, and begin daily monitoring on the 31st calendar day after the first deposit. From then on it must compare current activity to the baseline at least daily, review the baseline at least weekly using the previous week's activity, and adjust it at least monthly using the previous month's.
The proof requirement sits alongside. On request, the acquirer must produce within seven calendar days the original merchant underwriting package, copies of the actual reports or records used to monitor the merchant's deposits, and any other data Visa asks for. Separately, rule 1.9.2.2 gives seven business days to answer any request for information presented by Visa, its designees or a regulator under the program. And the general record rule requires a complete, well-documented merchant file, including anything connected to an investigation, for at least two years after the merchant agreement ends.
A daily baseline reviewed weekly and rebuilt monthly, with the reports kept, is a system requirement rather than a policy statement. If monitoring lives in a spreadsheet someone opens on Fridays, the rule is not met on the days in between, and the seven-day production request is where that shows.
What the Rules Prohibit Outright
Rule 1.9.2.1 makes the acquirer responsible for ensuring that no merchant, marketplace, payment facilitator, ramp provider, sponsored merchant or digital wallet operator accepts cards for, or displays a Visa mark on a site used for, three things: the purchase or trade of imagery or media involving the activities listed in the marks rule, which include child sexual abuse material, incest, bestiality, rape and non-consensual mutilation; adult content under MCC 5967 where the merchant does not comply with section 3.1.1 of the guide; and products that claim or imply a similar efficacy to prescription drugs, controlled substances or street drugs, irrespective of claims of legality. That last phrase is the one to read twice. A product's legality in the merchant's state is not a defence if it is marketed as working like a controlled substance.
The same list appears in the e-commerce rules, where violation may result in termination of the merchant, payment facilitator or sponsored merchant, and non-compliance with VIRP is among the grounds on which Visa may prohibit an acquirer from acquiring for a merchant at all.
What It Costs to Get Wrong
The assessments are the part of the program that is fully public, and they are the numbers we could not give for the fees. Under rule 12.5.5.1, if Visa determines an acquirer has failed to meet the registration requirements in 1.9.5.1, it may impose USD 100,000 per calendar month of non-compliance for Tier 1 and Tier 2 merchants, or USD 25,000 for Tier 3, plus USD 2,000 per unregistered high-integrity risk merchant or sponsored merchant per month, and continued non-compliance may end in Visa prohibiting the acquirer from acquiring high-integrity risk merchants at all. Failing the registration requirements for a high-integrity risk payment facilitator is USD 25,000 per month per facilitator under rule 12.3.1.1, rising after three violations in a calendar year to USD 100,000 for each 30-day period.
The data-quality rule is the one that reaches the merchant's principals. If an acquirer, merchant, sponsored merchant or agent changed the merchant name, merchant data or merchant performance in any way to circumvent VAMP or VIRP, Visa may impose USD 25,000 per merchant per month on the acquirer and permanently disqualify the merchant and its principals from the Visa system. A descriptor edit or an MCC change made to move a merchant out of a monitored category sits squarely inside that wording.
Disqualification of a merchant has its own procedure. Visa may disqualify a high-integrity risk merchant that meets or exceeds a critical level of dispute activity, acts with intent to circumvent Visa programs, or causes harm to the system; the notice to the acquirer states the date it must stop submitting the merchant's transactions, the reasons and the right to appeal. The appeal must be a letter received by Visa within 15 days of the acquirer's receipt of the notice, with a non-refundable fee, containing all the evidence and arguments, and no oral presentation is permitted. Fifteen days is short enough that the underwriting file has to be already assembled to meet it.
There is a longer shadow too. Among the conditions for cross-border acquiring, the acquirer, payment facilitator and sponsored merchant must not be identified in any Visa risk program, VAMP and VIRP given as the examples, or have had excessive risk program violations in the three years before the agreement. A VIRP identification follows a portfolio for three years.
The Fees, and Why We Still Are Not Quoting Them
The registration and transaction fees are not in the public rules, and the third-party reports of them do not agree. Two US high-risk processors' guides, updated in January and May 2026, both say the registration fee rose from USD 500 to USD 950 in April 2024 and that transactions in the affected categories carry USD 0.10 per transaction plus ten basis points of volume. A monitoring vendor's October 2023 note on the same April 2024 pricing change, covering the AP, CEMEA and LAC regions, describes something different: acquirer application fees of USD 100,000, USD 25,000 and USD 950 by tier, an annual acquirer renewal of USD 50,000, and a transaction fee of USD 0.02 plus ten basis points on card-absent volume in MCCs 5967 and 7273. Those may both be right for different regions and payers, or one may be wrong, and nothing public lets us tell which. The figure that applies to your book is on your acquirer's fee notice, and that is the only place to take it from.
The public rulebook is also getting thinner on risk, not thicker. The April 2026 edition removed a set of acquirer, merchant and agent risk rules as obsolete or already covered by the Visa Acceptance Risk Standards, another member document. A team that reads only the public rules will be reading less of the standard each edition.
What to Put in the File
- Before boarding: confirm the acquirer holds an approved High-Integrity Risk Acquiring Registration, and that the merchant, the payment facilitator and any soliciting agent are each registered under it. A pharmacy needs NABP or other Visa-recognized accreditation on file if it is to rely on the exemption.
- In the agreement: a senior officer's signature on every high-integrity risk sponsored merchant agreement, the new-merchant and monthly reporting clauses, and for MCC 5967 the section 3.1.1 provisions from the guide.
- From the first deposit: capture the four daily figures, build the baseline over 30 days, start daily comparison on day 31, review weekly, rebuild monthly, and keep the reports. Be able to produce the underwriting package and the monitoring records within seven calendar days.
- On the website: no imagery in the prohibited list, no product marketed as working like a prescription or controlled drug whatever its legal status, and a separate MCC for any high-integrity risk line of business.
- Never fix a monitoring problem by editing the descriptor, the MCC or the merchant data. The rules name that as circumvention, and the penalty reaches the merchant's principals for good.
Tags
About the author
Kyle Hall
Founder
Kyle Hall is a fintech entrepreneur, software engineer, and marketing strategist with over a decade of experience in high-risk payment processing and SaaS development. He is the CEO of PayKings, a leader in high-risk merchant services, and the founder of PulseCRM, a purpose-built CRM platform for the payments industry. Kyle specializes in building custom payment processing systems and growth strategies that empower merchant services providers to scale and succeed in the digital marketplace.