Card scheme standards

Visa and Mastercard are card schemes. Their members are banks that provide merchant accounts (acquirers). The schemes set the standards, and acquirers must enforce them with their merchants. Merchants often do not hear about these requirements until their account is at risk of termination.

Use this checklist to align your business with card scheme standards and support a stable, long-term processing relationship with your bank.

1. Qualification — your business location

Card schemes require your registered place of business to match where you actually operate. This affects which laws and consumer protections apply to your customers and whether your acquirer can legally process your payments.

🚧

Area of use

If your "area of use" does not match where your customers are, your merchant account may be terminated. A common trigger is being registered in the UK while selling mainly to US customers.

• Your registered business address is a real, staffed location (PO boxes, virtual offices, and your law firm's address do not count)
• The people responsible for sales work from that address (the location must be where employees or agents responsible for the sale operate)
• The country where you are registered matches where most of your customers are (if most buyers are in a different country, you may have a jurisdiction mismatch)
• Your business is subject to the local laws that protect your customers (consumer protections, taxes, and legal processes must apply where your buyers are)

2. Website disclosures — what your site must show

Acquirers treat your website as part of the customer contract. If a customer cannot find key information before paying, the transaction may be considered deceptive even if your product is legitimate.

• Legal business name is displayed (usually in the footer)
• Company registration number and registered country are shown
• Physical registered address is visible on the site
• A working contact email address or phone number is easy to find
• Links to Terms & Conditions and Privacy Policy are clearly visible
• The total charge (including all fees and surcharges) is shown in the customer's currency immediately before the final "Pay" button
• Shipping policy states delivery timelines, methods, and any geographic restrictions
• Cancellation policy states the exact timeframe and procedure to cancel
• Returns and refunds policy explains step-by-step how to return goods and the conditions for a refund
• Governing law clause specifies the legal jurisdiction for dispute resolution

Subscriptions — extra requirements if you use recurring billing

If you charge customers on a recurring basis, the rules are stricter. Failing to follow them can trigger fraud flags and lead to an immediate investigation.

• Trial length is clearly stated (exact number of days, not vague language)
• The exact amount and date of every subsequent charge is disclosed upfront
• Customers are proactively notified before each rebill
• A one-click (or equivalent simple) cancellation option is available (customers must be able to cancel easily — a multi-step or hidden cancellation flow is non-compliant)

3. Behavioural monitoring

Card schemes now monitor refunds, chargebacks, and fraud in real time. If you breach a threshold, your acquirer may terminate you before issuing a warning to protect its own risk position.

Visa (VAMP): Monitors your combined fraud and chargeback rate continuously. Because your acquirer is judged on the performance of its whole portfolio, it may terminate your merchant account before you reach the formal limit.

Mastercard (Scam Merchant rules, effective July 2026): If a new merchant reaches a 5% combined refund and chargeback ratio, a 72-hour investigation is triggered. If deceptive practices are confirmed, processing is blocked immediately.

Credibility and avoiding acquirer red flags

Underwriters build a "credibility map" of your business during onboarding and while you are live. Red flags are the issues most likely to make them view your business as risky or deceptive. If an underwriter finds red flags, they may reject your application or terminate your merchant account. To reduce that risk, make sure the following are true:

• All company information is complete and verifiable (name, registration number, address, contact) (missing details signal an unvetted operation)
• Your brand story and founder narrative are accurate and not embellished (fictional origin stories or manufactured community claims are a common red flag)
• Product origin claims are truthful (e.g. do not claim "Made in UK" if shipping from elsewhere) (you do not need to highlight your supply chain, but you cannot misrepresent it)
• Social proof (reviews, customer counts) is verifiable and proportionate to your business age ("thousands of satisfied customers" on a newly registered domain is an immediate red flag)