Payments13 min readUpdated October 14, 2026

High-Risk Ecommerce: How to Keep Payments Running When Processors Say No

What makes a merchant high-risk, what a high-risk gateway costs, and how to keep selling through reviews, reserves and closures within card network rules.

Nick Bonnassies, CMO at Tagada · checked against 15 sources

Article summary

TL;DR

A high-risk merchant is a business its processor expects to generate more disputes, fraud or refunds than average. Payment resilience means your sales survive that label: a backup processor opened in advance, saved cards you can move, cascading only on technical failures, and cash set aside for reserves. It never means splitting volume to hide from card network monitoring.

"High-risk" has two sources: Visa's list of 13 registered MCCs, and each processor's own criteria, such as dispute rate, refund rate and industry.
A high-risk merchant account costs more because the acquirer carries more risk: Visa requires its own approval, a financial review and sometimes collateral before it can take high-integrity risk merchants.
Resilience is built before the problem: a second processor live on a share of traffic, card data you can export, and a cash plan that survives a reserve.
Only technical failures cascade freely to another processor. Never retry a Visa Category 1 decline anywhere.
Spreading volume over several accounts to stay under VAMP or VIRP monitoring is circumvention: Visa can fine the acquirer $25,000 a month and disqualify you and your owners for good.

Want to go further? Ask

On this page

Being "high-risk" rarely means you did something wrong. It means your processor expects more disputes, refunds or fraud from your type of business, and it can review, hold or close your account to protect itself. This guide covers what puts a merchant in that category, what a high-risk gateway and merchant account give you and cost, and how to keep selling when one processor stops. For the merchant's side, step by step: merchant account closed and funds held and multiple merchant accounts: what is allowed.

What makes a merchant high-risk?

There's no single definition. Two sources decide, and they don't use the same criteria. For supplement and skincare brands: Stripe account closures for supplement brands and Stripe account closures for skincare brands.

Who decides	On what basis	What follows
Visa	Your merchant category code. 13 codes in three tiers form the High-Integrity Risk group	Your acquirer must be approved by Visa and register you before your first card-absent sale
Mastercard	Its own registration program for overlapping categories	Registration and fees, set by Mastercard and your acquirer
Your processor	Its own prohibited and restricted lists, plus your account's history	Refusal, review, reserve, slower payouts or closure

Sources: Visa Integrity Risk Program9 and Visa Core Rules, section 10.4.5.1.7 The full Visa list, tier by tier, is in our guide to high-risk MCC codes.

Most merchants who call themselves high-risk aren't on Visa's list at all. They're high-risk for their processor. Stripe states what it weighs when it sizes a reserve: "industry conditions, payment activity, dispute rate, refund rate, and financial stability."1 In practice, these patterns raise a file's risk:

Payment long before deliveryDisputes can arrive months after the saleShow delivery dates, send tracking, keep proof of delivery
Subscriptions and trialsCustomers forget they signed up, then disputeTerms shown at sign-up, reminders before renewal, online cancellation
A sudden jump in volumeFraud and bust-out schemes look like growth at firstTell your processor before a launch or a big promotion
Rising refunds or disputesLosses the processor may have to coverRefund fast, answer alerts, fix the product page behind the complaints
Product claims a regulator could challengeRegulatory and refund exposureProduct pages without medical or income claims

A high-risk line of business must also run on its own MCC, separate from the rest of your sales, under Visa's April 2026 manual.8 If you sell two kinds of products and one is higher risk, expect two codes, sometimes two accounts.

How ecommerce payment processing works, and where it can stop

Ecommerce payment processing is the chain that turns a card entered at checkout into money in your bank account. Each link can say no, and only one of them is the customer's bank.

Fig. 1Five parties between the click and the payout

approved declined or closed routing step

CheckoutCustomer pays
encryptsGatewaySends the payment
routes toProcessor and acquirerHolds your merchant account
passes toCard networkVisa, Mastercard
asksIssuerApproves or declinesApproved

For a high-risk merchant, the acquirer and the processor are the links that break.

Simplified path of a card-absent payment.

The issuer decides each payment. A decline is about one card, one time.
The acquirer and processor decide whether you can take payments at all, and when you get the money. That's where reviews, reserves and closures happen.
The card network sets the rules both must follow, and watches your dispute and fraud ratios every month.

The difference between a payment gateway and a payment processor matters here: a gateway is software and can usually be swapped; the merchant account is the relationship that underwriters approve or end. More on the parties in our guide to payment service providers.

What a high-risk payment gateway and merchant account give you

A "high-risk payment gateway" is usually a package: a gateway connected to one or more acquirers that accept businesses mainstream processors turn down. What you're really buying is the high-risk merchant account behind it.

An acquirer that takes your category
For the 13 Visa codes, the acquirer must be approved for your tier. Ask directly which tiers it's approved for. A no means it can't register you.
Underwriting that knows your model
A specialist reads subscriptions, pre-orders or long delivery times as normal for your business, and prices them, rather than closing the account when it notices them.
Dispute and fraud tools
3-D Secure, fraud screening, and alerts that let you refund before a dispute is filed. These keep your ratios under the network thresholds.
An exit you can use
The right to export your customers' saved cards to another PCI DSS compliant processor if the relationship ends. Ask for it before you sign.

Check the processor's public list before anything else. Stripe, for example, prohibits gambling, adult content and negative-option marketing, and reviews online pharmacies, dating and tobacco before accepting them.10 No gateway feature fixes a business the processor won't take.

What a high-risk merchant account costs

Card networks and regulators don't publish a "high-risk rate". Brokers publish ranges, but your price comes from your file. What the rules do explain is why it costs more.

Before an acquirer can process for high-integrity risk merchants, Visa requires it to apply and be approved, pass a financial review, hold the required equity capital and, where Visa decides, commit to compensating controls such as collateral.7 It then has to monitor each of those merchants daily, from the 31st day after the first deposit, on gross volume, average ticket, number of sales and disputes.7 That's why fewer acquirers serve these merchants, why they price higher, and why a volume spike triggers a call fast.

Line item	What to ask	Where the published facts are
Processing rate	Rate per transaction, by card type and country, plus any fixed fee	Your quote only
Reserve	Fixed or rolling, what share, how long, how it's released, when it's reviewed	Stripe reserves FAQ1
Dispute fee	Per dispute, and per response if you contest	See below
Monitoring program fees	Whether network fines are passed on to you	Stripe monitoring programs4
Registration	Visa or Mastercard registration fees for your category, one-time or yearly	Your acquirer
Exit terms	Notice period, how long funds are held after closure, card data export	Your agreement

Dispute fees are public for the large processors, and they show how a high dispute rate adds up:

$15 + $15

Stripe, US: fee per dispute, plus a fee to contest that's returned if you win, for disputes opened after June 17, 2025

$15

Shopify Payments, US: chargeback fee, returned if you win

$20

PayPal, US: card chargeback fee

Sources: Stripe,12 Shopify,13 PayPal.14 The full comparison is in our guide to chargeback fees.

A reserve isn't a fee, but it costs you

The held money is still yours. You just can't pay suppliers or ad platforms with it. For a growing brand, a reserve can hurt more than a higher rate. Compare quotes on cash held, not only on price per transaction.

Can merchants block high-risk transactions automatically?

Yes. Fraud tools score every payment and apply rules you set. In Stripe Radar, scores run from 0 to 99, and by default payments scored 75 or more are blocked.15 You can add rules that block, send to review, or request 3-D Secure based on amount, country, card type or past behavior.

Two limits matter for a higher-risk account. Every good order you block is lost revenue that no dispute report shows. And blocking fraud protects your ratios, but it doesn't protect you from a processor decision. The method, with the rules to start with, is in our guide to ecommerce fraud prevention.

What payment resilience means for a higher-risk merchant

Resilience isn't avoiding every review. Processors review accounts as part of normal business. It means a review, a hold or a closure doesn't stop your sales or your cash.

Fig. 2How an account problem escalates

ReviewDocuments requested, payouts may pause
ReservePart of your balance held for a set period
ClosureNew payments stop. Stripe typically restricts payouts for 120 days
ListingMATCH or VMSS for 5 years, if criteria are met

Each step has its own fix. The backup must exist before step 1.

Illustrative sequence. Timing varies by processor and account; the 120 days and 5 years come from Stripe's published policies.

Your contract decides how much warning you get. Stripe's agreement says it may close an account "at any time", with 30 days' notice only in the UK, Switzerland, Gibraltar and Australia.3 When Stripe decides an account has become an unacceptable risk, it "will typically restrict or pause payouts" for 120 days, then runs a formal review of the balance.2

The last step is the one you can't undo. A closure for excessive chargebacks can put you on Mastercard MATCH or Visa VMSS, listings stay 5 years, and only the acquirer that listed you can remove the entry, mainly if it was an error.6 The thresholds behind each step, and how to read your processor's agreement, are in our guide to payment risk management.

Resilience rests on four things, all set up while your account is in good standing:

A backup processor already live.
Saved cards you can move.
Routing that knows which failures may cascade.
Cash that survives a reserve.

Set up a backup processor before you need it

A backup opened after a closure is an application with a closure on file. Underwriters look at your recent dispute history, and a recent termination is the first thing they ask about.

Apply while your record is clean. Same business, same products, same MCC, disclosed openly. Tell the second processor you already process elsewhere and why you want a second account.
Send it real volume from day one. An account that has never processed tells the underwriter nothing. A small, steady share of traffic builds a history.
Write down which traffic goes where. By country, card type or product, with a reason for each rule. If a processor asks why its share changed, you have the answer.
Test refunds, webhooks and reconciliation. A backup that takes payments but can't refund them creates disputes.
Track each account separately. Approval rate, dispute rate, refund rate and reserve, per processor, every month.

Run the switch once on real traffic, then keep the backup live.

How the rules engine decides which processor gets each payment is covered in dynamic payment routing, and the layer that ties several processors together in what is payment orchestration.

Keep saved cards portable

For a subscription business, the saved cards are the business. If they sit in one processor's vault and that account closes, every renewal stops until customers type their card again, and many won't.

Fig. 3Same closure, two vaults

Cards locked in one processor

Renewal dueMonthly plan
charges onProcessor AAccount closedDeclined

Renewals stop, customers asked to re-enter cards

Cards exported or held independently

Renewal dueMonthly plan
charges onProcessor AAccount closedDeclined
moves toProcessor BCard already on fileApproved

Renewals continue on the new account

The card number is what moves. Payment history and subscription objects don't.

Illustrative path.

Two ways to get there. Either your processor exports card data to the next one: Stripe does it on request, to another PCI DSS Level 1 compliant processor, but the export doesn't include payment history, subscriptions or cards saved with Link.11 Or the cards sit in a token vault that isn't tied to a single processor, so moving a customer is a routing change. Ask your current processor how its export works now, and how long it takes, not on the day you need it. More on the mechanics in token vault migration.

Cascade only when the issuer never answered

Cascading sends a failed payment to the next processor. It's what keeps checkout working during an outage. It's also where resilience turns into a rule violation if it's set up blindly.

Timeout, processor error, issuer unavailableNobody. The issuer never answeredYes, after checking the first attempt didn't go through
Generic decline, such as 05 do not honorThe issuer said no, without a reasonOnce at most, within Visa's limit of 20 attempts in 30 days
Lost card, stolen card, closed accountVisa Category 1: the issuer will never approveNever, on any processor. Ask for another payment method
Your fraud tool blocked the paymentA screen judged it fraudNo. A second screen won't make it a good order

Limits from Visa Core Rules, section 1.7.2.1 and table 7-2;7 the "once at most" on generic declines is our recommendation, not a Visa rule. When you do retry a declined payment, section 1.7.2.1 also forbids changing data elements of the original request, such as the MCC, the merchant country or the e-commerce indicator, to get a different answer. The full decision table is in dynamic payment routing, and retry limits in payment acceptance rate.

Plan cash for a reserve

The most common failure isn't the closure. It's a reserve that lands the same month as a big ad bill and a stock order. A reserve holds part of your funds for a period set in advance; Stripe reviews it a few days before it ends and can remove, reduce, increase or extend it.1

Fig. 4What a reserve takes, and when it comes back

Held from three months of sales, $10,000 a month

$30,000

Still held by the processor Paid back to you

$10,000Held until month 4Paid back month 4
$10,000Held until month 5Paid back month 5
$10,000Held until month 6Paid back month 6

Model this before you scale, not after.

Illustrative example. Reserve share and length are set per account by the processor.

Model one bad quarter. A share of sales held, disputes taken from the balance as they arrive, ad spend and inventory still due. If payroll doesn't survive it, fix that before adding volume.
Keep a buffer outside the processor. Your processor balance isn't your cash.
Spread the risk across accounts. A reserve on one of two live accounts slows you down. A reserve on your only account can stop you.
Ask for the release terms in writing. Stripe says some reserves can be appealed from the Balances page, and that "in some rare cases, a reserve may be required indefinitely."1

The line not to cross

Several processors is resilience. Several accounts used to hide from the card networks is circumvention, and the networks treat it more harshly than the high dispute rate it was meant to hide.

If Visa determines that an Acquirer, a Merchant, a Sponsored Merchant, or a Third Party Agent changed, modified, or altered the Merchant name, Merchant data, or Merchant performance in any way to circumvent the Visa Acquirer Monitoring Program (VAMP) or the Visa Integrity Risk Program (VIRP), Visa may do either or both: Impose a non-compliance assessment of USD 25,000 per Merchant or Sponsored Merchant, per month to the Acquirer. Permanently disqualify the Merchant, or Sponsored Merchant, and its principals from participating in the Visa system.

Visa Core Rules and Visa Product and Service Rules, April 18, 2026, section 12.5.3.2, p. 808

Spreading sales over several merchant accounts so each one stays under the VAMP ratio is the textbook case: it alters merchant performance to avoid monitoring.

The other line is transaction laundering: running sales that aren't yours through your account, or yours through someone else's. Visa may permanently prohibit a merchant and its principals for presenting transactions that don't result from a sale between that merchant and the cardholder, or for opening a merchant agreement under a new name to circumvent the rules (section 1.9.1.4, p. 133).7 Laundering is a listing reason on both terminated merchant files: MATCH code 3 and VMSS code 23, which covers misrepresenting where transactions come from or submitting them on behalf of another merchant.6

Practice	Status	Why
Two or three processors, each underwritten for your real business	Allowed	Each account is declared and processes your own sales
Routing traffic by country, card type or cost, with written rules	Allowed	Routing on business criteria, not to avoid monitoring
A separate MCC for a higher-risk product line	Allowed	Required by Visa's manual for a high-risk line8
Splitting volume so each account stays under VAMP thresholds	Prohibited	Visa section 12.5.3.2: altering merchant performance to circumvent VAMP
Selling a product under a lower-risk MCC or a different website	Prohibited	Misrepresents the business; each site must carry the MCC of what it sells8
Processing another merchant's sales through your account	Prohibited	Laundering: Visa 1.9.1.4, MATCH code 3, VMSS code 23
Reapplying under a new company name after a termination	Prohibited	Visa 1.9.1.4: new agreement under a new name to circumvent the rules
Splitting one order into several card charges	Prohibited	Visa section 5.7.3.1, except listed cases such as split shipments and installments

Sources: Visa Core Rules7 and Merchant Data Standards Manual.8

Practical rule

Every account you open should be one you'd be comfortable describing to the others. If a routing rule only makes sense as a way to keep a ratio low, it's the wrong rule. Lower the ratio instead: our guide to chargeback prevention covers how.

Where Tagada fits

TagadaPay is Tagada's own processor. Each file is still underwritten, with enhanced review on regulated verticals, and its prohibited list excludes merchants on MATCH and practices designed to get around chargebacks. Whatever you use, the rules above are the ones that keep an account open: declared accounts, portable cards, cascades only where the issuer never answered, and cash planned for a reserve.

Tagada follows Visa and Mastercard rules and the laws that apply to payments.

Updated on October 14, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

What is a high-risk merchant?

A business that its acquirer or processor expects to cause more losses than average, through disputes, fraud or refunds. Visa defines a formal group, High-Integrity Risk Merchants, by 13 merchant category codes that need registration. Processors add their own criteria: Stripe sizes reserves on industry conditions, payment activity, dispute rate, refund rate and financial stability.

What is a payment gateway for high-risk merchants?

It's the software that sends card payments from your checkout to an acquirer willing to take your business. The gateway alone doesn't approve you: the merchant account behind it does. Look for one that connects to more than one acquirer, supports 3-D Secure and dispute alerts, and lets you export saved cards if you leave.

Can merchants block high-risk transactions automatically?

Yes. Fraud tools score each payment and act on the score with rules you set. In Stripe Radar, scores run from 0 to 99 and payments scored 75 or more are blocked by default. You can add rules to block, review or request 3-D Secure. Our fraud prevention guide covers how to set them without blocking good customers.

Why are high-risk merchant accounts more expensive?

The acquirer carries the losses you can't cover, and Visa makes it pay for that risk up front: before taking high-integrity risk merchants, an acquirer needs Visa's approval, a financial review and sometimes collateral, then must monitor each merchant daily. That cost shows up as higher rates, reserves and per-dispute fees. Ask for every line item in writing.

Is it legal to use several merchant accounts?

Yes, if each account is declared, carries the right MCC and processes your own sales. What's prohibited is using accounts to hide: changing merchant names, data or performance to stay under Visa's monitoring programs, or running another business's sales through your account. Visa can fine the acquirer and disqualify the merchant and its owners.

What are the risks of ecommerce payments?

Fraud and disputes are the visible ones. For a merchant the processor sees as higher risk, the bigger ones are account-level: a review that pauses payouts, a reserve on your balance, a closure that stops checkout and subscription renewals at once, and a MATCH or VMSS listing that follows you for 5 years.