Payments11 min readUpdated October 14, 2026

High-Risk MCC Codes: The Visa and Mastercard List

Which MCC codes Visa classes as high-risk in 2026, tier by tier, what Stripe allows for each, and what registration changes for your account.

Nick Bonnassies, CMO at Tagada · checked against 7 sources

Article summary

TL;DR

Visa lists 13 high-risk MCC codes in three tiers: adult content, dating, gambling and pharmacies in Tier 1; crypto, cyberlockers and skill games with wagering in Tier 2; trading platforms, outbound telemarketing, negative-option subscriptions and tobacco in Tier 3. For card-absent sales, your acquirer must be approved for the tier and register you with Visa before you process.

The list comes from Visa's Integrity Risk Program, in force since May 1, 2023, and is repeated in Visa's April 2026 MCC manual.
13 codes, three tiers, all for card-absent sales. Outside the US, pharmacies and tobacco count only on cross-border sales.
Your acquirer must be approved by Visa for your tier, then register you before your first transaction.
A high-risk line of business must run on its own MCC, separate from the rest of your sales.
Processors add their own rules: Stripe prohibits gambling, adult content and negative-option marketing outright.

Want to go further? Ask

On this page

"High-risk" sounds like a judgement call. For Visa it's a list: 13 merchant category codes, sorted into three tiers, that an acquirer must register before it processes a single online payment. Here is the 2026 list, what each processor does with it, and what it changes for your account.

Visa tier check

Is your MCC on Visa's high-risk list?

Visa High Integrity Risk

5968Tier 3 Subscription "negative option" merchants

Your acquirer must be registered for Tier 3 and must register you with Visa before you process.

Applies to card-absent sales.

Sources: Visa Integrity Risk Program guide (2023), Visa Merchant Data Standards Manual (April 2026).

Which MCC codes are high-risk?

Visa calls them High Integrity Risk merchants: businesses that are legal, but that could process illegal transactions without the right controls.1 Every business type below is card-absent, meaning sold online or by phone.

Tier 1: risk of harm to health, safety or wellbeing

MCC	Business type	Condition
5967	Adult content and services	All card-absent sales
7273	Dating and escort services	All card-absent sales
7995	Gambling	All card-absent sales
5122, 5912	Pharmacies	5912: outside the US, only sales that aren't domestic

Pharmacies accredited by the National Association of Boards of Pharmacy (NABP), or another body Visa recognizes, don't need to be registered under 5122 or 5912.7 For a telehealth brand, see telehealth payment processing.

Tier 2: risk of financial harm

MCC	Business type	Condition
6051, 6012	Crypto exchanges, wallets and on-ramps	Transactions must carry Special Condition Code 7
4816	Cyberlockers and remote file sharing	Only for selling access to those services
5816	Games of skill with wagering	For example daily fantasy sports

Tier 3: risk of regulatory breach or deceptive marketing

MCC	Business type	Condition
6211	High-risk financial trading platforms	Card-absent
5966	Outbound telemarketing	All card-absent sales
5968	Subscription "negative option" merchants	Card-absent
5993	Tobacco	Outside the US, only sales that aren't domestic

Verdict

If your code is in these tables and the conditions apply, your acquirer has to register you with Visa first. If it isn't, Visa doesn't require registration, but your processor may still apply its own rules.

The program has been in force since May 1, 2023, when it replaced Visa's Global Brand Protection Program.6 Visa's April 2026 MCC manual repeats the same codes, with the conditions above.2

Three rules most lists leave out

The codes are the easy part. Visa's manual adds three rules that decide whether they apply to you.2

A high-risk line gets its own code
If one line of your business is high-risk and the others aren't, the high-risk line must run on its own MCC. It can't hide under your main code.
Domestic sales can be exempt
Outside the US, pharmacies (5912) and tobacco (5993) count as high-risk only on sales that aren't domestic. A pharmacy selling only in its own country isn't in scope.
Online gambling is always 7995
A merchant taking online gambling payments must use 7995 for all of them, even if gambling isn't its main business.

Who decides: Visa, Mastercard or your processor

Three layers decide whether your code counts as high-risk, and only the first one is public.

Fig. 1Three layers, three lists

Your MCCSet by your provider from what you sell

Visa13 codes in three tiers, registration required
MastercardIts own registration program for overlapping categories
Your processorIts own prohibited and restricted lists

the strictest one wins

Visa publishes the tiers above and sets what acquirers must check for each one.
Mastercard runs its own registration program for high-risk categories. The categories overlap with Visa's, but the list and the fees are set separately and change over time: ask your acquirer for the current version.
Your processor decides what it accepts at all, and that list is often stricter than Visa's.

Your MCC isn't your choice

Your provider assigns your code from what you sell. A subscription brand can end up on 5968 even if it never asked for it. See how to find your MCC code on Stripe, Adyen, Shopify and PayPal, and when 5968 is the wrong code.

Visa's list against Stripe's rules

A Visa registration doesn't mean every processor will take you. Here is what Stripe's own list says about each Visa category.4

Visa category	Visa tier	At Stripe
Gambling	Tier 1	Prohibited
Adult content and services	Tier 1	Prohibited
Dating	Tier 1	RestrictedNeeds review (prohibited in some countries)
Online pharmacies	Tier 1	RestrictedNeeds review
Crypto exchanges and wallets	Tier 2	RestrictedNeeds review; mining and deposits prohibited
Cyberlockers, file sharing	Tier 2	RestrictedNeeds review
Subscriptions that bill until cancelled	Tier 3	ProhibitedAs are discounted trials with hidden or unclear pricing
Tobacco, e-cigarettes	Tier 3	RestrictedNeeds review; in the US, only FDA-authorized vape products

Verdict

On Stripe, a Tier 1 business is usually a no. Tier 2 and 3 businesses go through a review, except negative-option subscriptions, which are prohibited.

What each tier changes for your account

The tier sets how much checking your acquirer has to do, on itself and on you.1

Tier 1. The acquirer needs a separate Visa approval for each Tier 1 category, an initial control assessment and a yearly self-assessment. It runs enhanced due diligence on you, attests to Visa that you passed, and registers you before you process.
Tier 2. One approval covers all Tier 2 categories, with an initial control assessment and a yearly self-assessment. Same enhanced due diligence and registration for you.
Tier 3. The acquirer registers for Tier 3 and completes a self-assessment when Visa asks. You still have to be registered before your first transaction.

Source: Visa Integrity Risk Program guide. An acquirer approved for Tier 1 can also take Tier 2 and 3 merchants; one approved for Tier 3 can't take a Tier 1 or 2 merchant.

That cascade is why fewer acquirers serve Tier 1 businesses: each Tier 1 category needs its own approval from Visa.

Codes processors treat as high-risk anyway

Outside Visa's 13 codes, processors build their own lists. They look at dispute rates, refund patterns and how a product is sold, not only at the code.

Subscriptions and free trialsCustomers forget to cancel, and disputes followClear terms at checkout, a reminder before renewal, easy cancellation
Health and wellness productsProduct claims draw regulators and refund requestsProduct pages without medical claims, a visible refund policy
Travel and event ticketsPayment long before delivery, so disputes arrive lateProof of delivery, a cancellation policy
Digital goodsEasy to resell stolen cards onFraud screening, 3-D Secure, delivery logs

None of these is on Visa's list by default. Supplements, for example, usually sit on 5499, which Visa defines as specialty food stores including vitamin stores, and which isn't high-risk for Visa.2 Each one can still get you a no, a reserve or a closure from a processor that doesn't want the risk.

Reserves and account reviews

When a processor sees more risk, it doesn't always say no. It can hold part of your money instead.

Sometimes, Stripe might create a reserve balance on your behalf to ensure that your Stripe account can cover any expected incoming refunds or disputes. The reserve balance holds funds that you can't pay out or transfer until the reserve hold period is complete.

Stripe Docs, Balances and settlement time

The size and length of a reserve depend on the processor and on your account. Ask before you sign: what triggers a reserve, how much, for how long, and how it's released. A chargeback also takes the disputed amount from your balance the day it's filed, so high-risk accounts need cash set aside for both.

Dispute thresholds you must stay under

A registered code doesn't change Visa's dispute limits, but high-risk businesses hit them faster. Visa's Acquirer Monitoring Program (VAMP) counts fraud reports and disputes against settled card-absent transactions.3

1.5%

VAMP 'Excessive' merchant ratio in the US, Canada, EU and Asia-Pacific since April 1, 2026, down from 2.2%

1,500

Fraud reports plus disputes per month before a merchant can be flagged in those regions

Disputes resolved through a pre-dispute service that count in the ratio

Fraud reports covered by Visa's Compelling Evidence 3.0 rules are left out of the ratio too. More on keeping it down in our guide to chargeback prevention.

How to get processed with a high-risk MCC

Confirm your code. Ask your provider which MCC you have and why. If it's wrong, ask for the right one before you apply anywhere.
Check the processor's own list. A Visa registration is useless if the processor prohibits your business. Read its prohibited and restricted list first.
Find an acquirer approved for your tier. Ask directly: "Are you approved by Visa for Tier 1, 2 or 3?" A no means they can't take you on.
Prepare your file. Website with clear terms, refund and cancellation policy, product list, who you sell to and where, past processing statements and dispute history.
Plan for a second processor. A registered account can still be reviewed, put on reserve or closed. Keep a backup account ready so orders don't stop.

Visa requires acquirers to check your controls before they register you. The better your file, the faster that check goes.

Practical rule

Apply where your tier is already served. A processor that has never registered a Tier 1 merchant is unlikely to start with you.

How Tagada helps

Payments that follow the card network rules

Tagada follows Visa and Mastercard rules and the laws that apply to payments. TagadaPay runs native 3DS2, device intelligence and a rules engine, and payments route across Stripe, Adyen and TagadaPay with one logic. See pricing for plans.

Updated on October 14, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

Which MCC codes are high-risk?

For Visa, 13 codes: 5967, 7273, 7995, 5122 and 5912 in Tier 1; 6051, 6012, 4816 and 5816 in Tier 2; 6211, 5966, 5968 and 5993 in Tier 3, all for card-absent sales. Some only count in specific cases, such as 4816 for cyberlockers. Processors add their own lists on top.

Is MCC 5968 high-risk?

Yes, for subscription merchants that bill on a negative option, meaning the customer keeps paying until they cancel. Visa lists 5968 in Tier 3 for card-absent sales. Stripe goes further: it prohibits marketing and membership clubs that bill until cancelled.

Is MCC 5967 high-risk?

Yes. Visa uses 5967 for card-absent adult content and lists it in Tier 1, its highest level. The acquirer needs a specific Visa approval for that category, runs enhanced due diligence on you and registers you before your first transaction. Stripe prohibits adult content.

Is MCC 5499 high-risk?

Not for Visa. 5499 covers specialty food stores, including vitamin and health food stores, and isn't on Visa's high-risk list. Processors can still treat supplement sellers as higher risk under their own policies, based on product claims and dispute history.

What is the difference between VIRP and GBPP?

The Visa Integrity Risk Program replaced the Global Brand Protection Program on May 1, 2023. It sorts high-risk businesses into three tiers, with checks that scale with the tier, and requires acquirers to be approved by Visa for each tier they serve.

Can Stripe process a high-risk MCC?

It depends on the business. Stripe prohibits gambling, adult content and negative-option marketing. It reviews dating, online pharmacies, crypto exchanges and wallets, file storage and tobacco before accepting them. Check Stripe's list of prohibited and restricted businesses before you apply.