Table of Contents
1 | From “Brand-Risk” to “Integrity-Risk”
Visa’s first attempt to police problematic commerce was a checklist called the High-Brand-Risk Program. In 2022 the network replaced that document with a broader, data-driven framework: the Visa Integrity Risk Program, or VIRP. The name change signals a shift in scope.
Where the old rules focused on bad press, the new program chases anything that can erode the integrity of Visa’s payment rails—fraud, money-laundering, illegal product sales, transaction laundering, even systematic chargeback abuse. VIRP now sits inside a four-part ecosystem that also includes Visa Acceptance Risk Standards (VARS), Visa Monitoring Programs and the long-standing Account-Information-Security rules
2 | What VIRP Is Designed to Do
At its core, VIRP forces acquiring banks to prove that every merchant—direct or sub-merchant—has been underwritten, classified, and monitored with far more rigor than the standard “know-your-customer” file. Visa is blunt: acquirers, their ISOs and their payment facilitators are on the hook for preventing illegal activity from entering the network. To make the point stick, Visa attaches a menu of financial penalties that start in the four- to five-figure range and escalate toward six figures for repeat or willful violations
3 | High-Integrity-Risk Categories
VIRP designates certain business models as High-Integrity-Risk. The label doesn’t mean the activity is illegal; it means Visa believes the vertical, if poorly controlled, can spawn fraud, chargebacks, or regulatory heat.
Examples of High-Integrity-Risk categories include:
Online pharmacies and supplement sellers that could dispense unapproved drugs
Adult-content platforms and cam sites, where age‐verification failures create legal exposure
CBD, hemp-derived THC, vaping and other “emerging-legality” products
Ticket brokers, timeshare resellers and other future-delivery merchants
Technical-support and debt-relief services, which historically show high dispute ratios
Acquirers who board merchants in these niches must perform enhanced due diligence and install extra monitoring controls.
Effects of High Risk Classification on Merchants:
For legitimate businesses, VIRP doesn’t have to be a brick wall, but it does change the processing landscape:
Longer onboarding. Expect more questions, more paperwork and, often, a request for a third-party certification (e.g., LegitScript for online pharmacies).
Tighter contract terms. Rolling reserves, volume caps and higher discount rates are common until a track record is proven.
Zero-tolerance violations. One FDA warning letter about an unapproved ingredient or a single age-verification failure can freeze funds instantly.
MATCH exposure. If Visa directs the acquirer to terminate, your business and principals will likely land in the MATCH database, making mainstream processing hard to replace.
4 | How VIRP Works Day-to-Day
Registration and Archetype Assignment
When an acquirer signs merchants that fall into “Acquirer Processing for High-Integrity-Risk Transaction Merchants (AHIR),” it must register that status with Visa Online (VOL). The registration triggers stricter control requirements laid out in VARS Section 4.3
Mandatory Control Stack
Once flagged as AHIR, the acquirer must adopt—and prove it has adopted—a series of mandatory controls. These include enhanced beneficial-owner due diligence, automated website crawling to detect illegal products, velocity monitoring for enumeration attacks, exception-reporting workflows for abrupt volume spikes, and documented procedures to quarantine settlement funds when fraud is suspected
Continuous Portfolio Oversight
VIRP treats onboarding as only the beginning. Visa expects acquirers to maintain daily data baselines for volume, ticket size, authorization-to-settlement lag and dispute counts; deviations generate exception reports that must be investigated and, when necessary, escalated to Visa within tight timelines
Key-Performance Indicators (KPIs)
Appendix J of the Ecosystem Guide lists hard KPIs. For example, an acquirer’s monthly VIRP “identification” count (illegal or miscoded activity detected) must stay below thresholds published privately on Visa Online. Exceeding that benchmark triggers a Visa review and potential monetary assessments
How VIRP Protects the Network
Visa can fine an acquiring bank that ignores VIRP rules—fees start in the tens of thousands and escalate for repeat offenses. To avoid that outcome, acquirers are required to:
Underwrite deeply. Collect corporate documents, marketing screenshots, product labels, lab reports, age-verification logs—whatever proves the business is legal and transparent.
Code correctly. Use the right Merchant Category Code (MCC); mis-coding an online dispensary as generic retail is a violation in itself.
Monitor continuously. Employ crawlers (often via partners like LegitScript) to scan merchant websites and ads for policy drift.
React fast. If a merchant violates network or local-law rules, the bank must cure the breach or terminate the MID, sometimes within 24–48 hours.
Failure on any point exposes the bank—and by contract, the merchant—to fines and forced shutdowns.
5 | What Happens When a Merchant Trips VIRP
If Visa, an issuing bank or an acquirer’s own tools spot a violation—say, a SARMs SKU uploaded overnight, or an adult site without effective age verification—the acquirer receives a “VIRP alert.” The bank must investigate immediately, document findings and either cure the breach or terminate the merchant, sometimes inside a 24- to 48-hour window. Funds already in the pipeline can be frozen, and if illegal activity is confirmed the MID will be reported to the MATCH database under Code 12 (“Violations of Visa Rules”), making mainstream processing difficult to regain.
Repeat failures push the acquirer itself into a remediation plan. Visa can demand third-party audits, heightened reserves across the acquirer’s entire HIR portfolio, or, in severe cases, restrict the bank’s ability to board new merchants until controls improve.
6 | Why Durango Merchant Services Pays Such Close Attention
Durango Merchant Services (DMS) often operates in verticals Visa labels High-Integrity-Risk—nutraceuticals, subscription e-commerce, specialty CBD, coaching and information products. Because of this, VIRP functions as our north star: every underwriting checklist, every gateway filter and every ongoing monitoring script is mapped back to Visa’s control language.
How that benefits our merchants
Pre-boarding clarity. We mirror Visa’s website-scan and ingredient check before the application hits the bank, so you know early if a SKU or marketing claim will block approval.
Embedded controls. Our gateway can soft-decline transactions tied to forbidden SKUs or shipping geographies, meeting Visa’s “prevent illegal activity” mandate without manual intervention.
Real-time alerts. When our monitoring engine detects velocity spikes or a sudden change in dispute ratio, risk analysts review the data against VIRP thresholds and help you correct course before Visa knocks on the acquirer’s door.
Multi-bank redundancy. If a product is legal in Europe but stuck in U.S. gray space, we route volume to partner acquirers in the Netherlands or Lithuania that satisfy both local regulators and Visa’s cross-border HIR rules, maintaining uninterrupted processing.
7 | Program Nuances Merchants Often Miss
Future-Delivery Hazard
Selling concert tickets or furniture that ships six months out is not illegal, but Visa classifies it as high-risk because consumers dispute charges if the event or delivery falls through. Merchants must show strong escrow or refund policies to pass VIRP due diligence.
Transaction Laundering Surveillance
Visa requires acquirers to stop hidden-website processing. If you host a secondary domain that sells banned goods but funnels its checkout through the “clean” main site, website-crawling bots will eventually flag the mismatch, and VIRP penalties will follow.
Negative-Option Billing Scrutiny
Subscription merchants must now align with Visa CE 3.0 dispute thresholds and demonstrate FTC-style one-click cancellation. A confusing cancel path can trigger both chargeback program violations and a VIRP “illegal business practice” finding.
8 | Preparing for a Smooth VIRP Review
Merchants can position themselves for success by maintaining a due-diligence folder that mirrors Visa’s own audit list: corporate registration docs, ownership charts, state or federal licenses, third-party lab reports, full content copies of every landing page, affiliate offer and social campaign, plus a year of dispute data with remediation notes. Having this package ready accelerates underwriting and shortens any investigation window if an alert fires.
Looking Ahead—VIRP and the 2025-26 Risk Horizon
Visa updates its ecosystem guide twice a year. Early drafts of the 2025 edition expand HIR coverage to AI-generated personalized supplement blends, synthetic minor cannabinoids like THCP-O, and telemedicine models that prescribe GLP-1 agonists across state lines. DMS is already adjusting its checklists, and we encourage merchants to engage us early when developing new product lines so the road to approval stays clear.
Integrity as Competitive Advantage with Durango Merchant Services
Visa’s Integrity Risk Program is not just another hurdle; it is a blueprint for building a payment-ready business in niches where rules evolve monthly. Merchants who internalize VIRP’s demands—transparent ingredients, truthful marketing, airtight age and identity checks, real-time risk analytics—discover that the very controls Visa mandates also reduce fraud losses and customer churn. Partnering with Durango Merchant Services ensures those controls are woven into your stack from day one, so you can scale confidently while Visa sees a merchant—and an acquirer—fully aligned with the integrity of the global payment system.
