Most brands find out they are "high risk" the hard way. A payment provider approves the account in minutes, the brand launches a subscription offer or a supplement line, sales take off, and a few weeks later the payouts stop while a risk team asks for invoices, lab reports and screenshots of the checkout.
I have watched this happen to operators who did nothing wrong. They had simply ended up in a category the card networks or the acquirer treat differently, and nobody told them before they launched. A high-risk merchant account is not a punishment. It is a different type of agreement, with its own registration steps, pricing, reserve and monitoring, and it is much easier to get when you know what the underwriter is going to ask.
This guide covers what qualifies as high risk in 2026, what the label costs you, and how to put together an application that gets approved. If you need the general merchant-account checklist (ID, bank statements, website basics), start with our guide to getting approved for a merchant account. This article picks up where that one stops.
Key takeaways
- "High risk" comes from two places: card-network registration programmes (Visa's Integrity Risk Program and Mastercard's Specialty Merchant Registration) and each acquirer's own risk policy. You can be high risk under one and not the other.
- Visa's programme has three tiers that include adult content, dating, gambling, pharmacies, crypto and negative-option subscriptions (MCC 5968). Mastercard requires brands that offer free trials of physical products to register and use MCC 5968.
- Registration costs real money: $950 a year for Visa, and $1,000 a year per merchant for Mastercard since May 2026, plus new Mastercard per-transaction and volume fees from June 2026.
- Expect a higher rate, a rolling reserve of around 5–10% held for 90–180 days, and a monthly volume cap. A 10% reserve on $100,000 a month peaks at $60,000 held.
- Applications get approved faster when the offer is compliant before you apply: clear trial terms, reminders, online cancellation, a recognisable descriptor and a product file the underwriter can check.
- Multiple merchant accounts are for redundancy and approval rates. Using them to spread disputes and stay under monitoring thresholds breaks card-network rules.
What "high risk" means for a merchant account
An acquirer that gives you a merchant account is taking on your liabilities. If customers dispute charges or you stop shipping and cannot refund, the acquirer pays first and tries to recover the money from you afterwards. "High risk" describes businesses where that exposure is larger or harder to predict.
Two separate systems decide whether you land in that bucket:
- Card-network registration. Visa and Mastercard keep lists of merchant categories that acquirers must register with them before processing. These lists are fixed by the networks, and the acquirer pays registration and programme fees for each merchant (and usually passes them on).
- Acquirer risk appetite. Every acquirer and payment facilitator also has its own policy. A supplement brand may not be on a network list, yet one acquirer will price it as high risk and another will decline it outright.
Categories the card networks register
Visa Integrity Risk Program (VIRP)
Visa replaced its Global Brand Protection Program with the Visa Integrity Risk Program on 1 May 2023. VIRP sorts "high-integrity-risk" merchants into three tiers by the type of harm Visa is worried about. Acquirers with Tier 1 and Tier 2 merchants have to pass Visa control assessments; Tier 3 acquirers can be assessed on request.
Source: LegitScript's summary of Visa's VIRP guide (April 2023). Visa notes the lists are "not limited to" these MCCs. Registration costs $950 a year per merchant, according to Helcim's May 2025 fee notice.
Mastercard Specialty Merchant Registration
Mastercard runs the equivalent programme under the name Specialty Merchant Registration. According to Helcim and PaymentCloud, it covers similar categories (adult content, gambling, pharmacies, tobacco, crypto and high-risk securities, among others), and Mastercard changed its pricing in 2026:
- The annual registration fee doubled from $500 to $1,000 per merchant on 1 May 2026.
- From 3 June 2026, specialty merchants also carry a $0.02 per-transaction fee and a 10 basis point volume fee.
- Acquirers that board these merchants pay a new $50,000 annual high-risk acquirer licence, which narrows the number of acquirers willing to do it.
For subscription brands, the rule that matters most dates back to April 2019. Mastercard requires brands that offer a free trial of a physical product to register, to process those transactions under MCC 5968 (direct marketing, continuity and subscription merchants), and to show an online cancellation link and a customer service phone number on the website. Mastercard's announcement focused on nutraceuticals, but the registration requirement is written for free trials of physical products in general.
What acquirers treat as high risk without a network list
Most DTC brands that get labelled high risk are not on a Visa or Mastercard list at all. They get there because of the acquirer's own policy. The usual triggers:
Payment facilitators publish their limits. Stripe's restricted businesses list (updated 22 September 2026) prohibits negative-option marketing and "reduced-price trials with unclear or hidden pricing", and restricts CBD, e-cigarettes, online pharmacies and telehealth. If your model sits near those lines, an aggregator account is a short-term option at best.
The subscription rules underwriters check first
For subscription brands, the offer itself decides most of the underwriting outcome. Both networks have written rules for trials and recurring billing, and an underwriter will compare your checkout against them.
Sources: Stripe's and Qualpay's Visa trial guides, Chargebee's Mastercard rules page and J.P. Morgan's Mastercard notice (all linked below). A checkout that meets all six rows answers half of the underwriter's questions before they ask them.
US law points the same way. The FTC's 2024 "click-to-cancel" rule was vacated by the Eighth Circuit on 8 July 2025, but the FTC restarted rulemaking with an advance notice published on 13 March 2026, and the Restore Online Shoppers' Confidence Act (ROSCA) still requires clear disclosure, express consent and a simple way to cancel. Treat the card-network rules as the minimum, not the target.
What a high-risk account costs
Pricing is less standard than in low-risk processing, so read every line of the offer. As of July 2026, PaymentCloud lists these typical ranges for US high-risk accounts:
- Processing rate: about 3.49% to 3.95% per transaction plus around $0.25, roughly 0.5 to 1 percentage point above low-risk pricing.
- Rolling reserve: usually 5% to 10% of volume, "up to 15%+" for the riskiest categories, held for 90 to 180 days.
- Up-front reserve (less common): one to three months of projected volume deposited before you start.
- Monthly fees: account, statement, gateway and PCI fees, often $10 to $50 each.
- Pass-through fees: network registration and programme fees from the section above.
The reserve is the number that changes your cash flow most, because it compounds until releases begin.
Three things to negotiate before you sign, rather than after:
- A review date. Ask for a written reserve review after 6 months of clean processing. PaymentCloud says reviews usually happen after 6 to 12 months of stable, low-dispute volume.
- A cap. A reserve that stops growing at a fixed amount is easier to plan around than an open-ended percentage.
- Termination terms. Check the early termination fee and ask in writing how long the acquirer keeps the reserve after you close the account.
How to get a high-risk merchant account approved
1. Choose the MCC that describes what you sell
Your merchant category code decides which programme applies, so it has to be accurate. Misclassifying a business to avoid registration is a network violation: according to PaymentCloud's summary of VIRP, Visa can assess an acquirer $25,000 per merchant whose details were changed to avoid registration. When an acquirer finds a misclassified account, the usual outcome is termination, not a quiet reclassification. If you run a physical-product trial, expect MCC 5968.
2. Fix the offer before you apply
Go through the subscription rules table above with your checkout open. Add the consent text next to the pay button, set up the trial-end reminder and post-charge receipts, put a cancel link in the customer account, and make sure the descriptor matches the brand name customers know. Screenshots of each step become part of your application.
3. Build the high-risk underwriting file
On top of the standard documents covered in our merchant account approval guide, high-risk underwriters typically ask for:
4. Pick the right type of provider
Ask every provider which acquiring bank stands behind the account, whether that bank holds the network registrations for your category, and who owns the stored card data if you leave. Card portability is what lets you move without asking every subscriber to re-enter their card.
5. Plan the first 90 days
New high-risk accounts usually start with a monthly volume cap. Ramp up in line with it rather than launching your biggest campaign on day one; our MID capacity planning guide covers how to size launches against processing limits. Watch your dispute and fraud ratios weekly against the Visa VAMP and Mastercard ECM thresholds, refund quickly when a customer asks, and send your acquirer a short monthly update. A clean track record is the only argument that reliably lowers a reserve.
Why applications stall
- The website and the application disagree. Different prices, product names or company details between the application and the live checkout.
- Hidden trial terms. Renewal price below the fold, pre-ticked boxes, or no cancellation path in the customer account.
- Claims the documents don't support. "Clinically proven" without a study, or labels that don't match the certificates of analysis.
- Volume projections with no history. Asking for $500,000 a month on a brand-new entity invites a decline or a very small cap.
- Undisclosed history. A previous termination or MATCH listing that the underwriter finds on their own.
A note on multiple merchant accounts
Many high-risk brands run more than one MID, and there are good reasons to: a second acquirer keeps you selling if one has an outage or puts a hold on the account, and routing by card type or region can raise approval rates. What the networks prohibit is splitting sales across accounts to keep each one under a dispute or fraud threshold (often called load balancing). Acquirers look for it, and it is a common reason for termination and MATCH listings. Each MID should be able to stand on its own numbers.
Where Paysight fits
Paysight is not a payment processor or an acquirer, and it does not underwrite, approve or hold funds. A high-risk account still comes from an acquirer that accepts your category. What Paysight does is give you one place to launch and manage subscriptions on the gateways and merchant accounts you connect, such as Stripe, NMI and Finix.
For high-risk subscription brands that means subscription, transaction and customer data in one view across every MID; retries and routing across the gateways you connect, for redundancy and approval rates; a card account updater to keep stored cards current; and customer care portals where subscribers can look up a charge, request a refund or cancel online, which supports the cancellation rules underwriters check. It does not make a prohibited product acceptable or replace the compliance work above.
Sources
- LegitScript: Visa Integrity Risk Program (June 2023, updated Nov 2023): VIRP launch date, tiers and MCCs
- PaymentCloud: Visa Integrity Risk Program guide (updated Jan 2026): acquirer assessments, $25,000 misclassification assessment
- Helcim: High-risk merchant program from Visa and Mastercard (May 2025): Visa $950 registration fee
- PaymentCloud: Mastercard raises high-risk registration fee (May 2026): $1,000 registration, $0.02 and 10 bps fees, $50,000 acquirer licence
- J.P. Morgan: Mastercard high-risk negative option billing changes (effective April 2019): physical-product trials, registration, MCC 5968
- Chargebee: Mastercard rules for subscriptions (effective September 2022): reminder windows, receipts, cancellation
- Stripe: 2020 Visa trial subscription requirement changes FAQ: Visa consent, reminder, cancellation and descriptor rules
- Qualpay: Visa requirements for subscription merchants offering free trials: 7-day reminder, post-sign-up receipt, "end trial" descriptor (April 2021)
- Stripe: Prohibited and restricted businesses (updated 22 September 2026)
- PaymentCloud: High-risk merchant account fees and rates in 2026 (updated July 2026): rates, reserves, monthly fees
- LegitScript: How to get CBD certification (updated September 2026): certification fees
- Legal 500: FTC moves to revive click-to-cancel rule (February 2026): vacatur on 8 July 2025, ROSCA
- Steptoe: FTC reopens negative option rulemaking (March 2026): advance notice published 13 March 2026
Two things. First, card-network registration: Visa's Integrity Risk Program and Mastercard's Specialty Merchant Registration list categories such as adult content, gambling, pharmacies, crypto and negative-option subscriptions that acquirers must register. Second, the acquirer's own policy, which often adds supplements, CBD, vapes, free trials, long delivery times and a history of high dispute ratios.
No. A plain subscription with clear pricing is usually not high risk. It becomes high risk when it uses negative-option billing, such as a free or $1 trial that converts to a paid plan. Visa lists negative-option subscription merchants (MCC 5968) in Tier 3 of its Integrity Risk Program, and Mastercard requires free trials of physical products to be registered and processed under MCC 5968.
Typical high-risk terms are 5% to 10% of card volume held for 90 to 180 days (PaymentCloud, July 2026), and more for the riskiest categories. With $100,000 in monthly sales and a 10% reserve held for 180 days, the balance grows by $10,000 a month and levels off at $60,000 once releases begin in month 7.
Sometimes, but with limits. Payment facilitators publish restricted and prohibited lists. Stripe's list (updated 22 September 2026) prohibits negative-option marketing and unclear trial pricing, and restricts CBD, e-cigarettes, online pharmacies and telehealth. Brands close to those lines usually need a dedicated merchant account with an acquirer that accepts their category.
MCC 5968 is the merchant category code for direct marketing, continuity and subscription merchants. Visa places card-absent negative-option subscription merchants under this code in Tier 3 of its Integrity Risk Program, and since April 2019 Mastercard has required merchants offering free trials of physical products to register and use it.
No. Splitting sales across merchant accounts to keep each one under a dispute or fraud threshold (load balancing) breaks card-network rules and is a common reason for termination. Multiple MIDs are useful for redundancy and approval rates, but each account should stand on its own numbers.
No. Paysight is not a payment processor or acquirer and does not underwrite accounts or hold funds. Brands get their merchant accounts from acquirers, then connect those gateways and MIDs (for example Stripe, NMI or Finix) to Paysight to launch and manage subscriptions, see subscription, transaction and customer data in one place, retry and route across the gateways they connect, and give customers self-service care portals.
.svg){kind=icon}
.png){kind=icon}
Company Reg. No. 760371
VAT No. IE4280069RH
