Mastercard's chargeback monitoring rules are changing. On 1 April 2027, the Acquirer Chargeback Monitoring Program (ACMP) will be retired and replaced by Mastercard’s Global Merchant Audit Program (GMAP). This is a broader framework that tracks both fraud and non-fraud disputes in a single view.
If you’re a merchant who accepts Mastercard payments and your chargeback ratios sit anywhere near the current thresholds, the time to act is now. The changes tighten over five years, with the first deadline being less than eight months away.
What’s changing from ACMP to GMAP
GMAP directly replaces and improves ACMP, with the remit beyond a simple rebrand.
Under GMAP, Mastercard will combine confirmed fraud data (including fraud that doesn't result in a chargeback) with non-fraud dispute activity into one assessment. Where ACMP focused primarily on chargeback counts and ratios, GMAP gives Mastercard and acquirers a single unified view of how a merchant performs across both fraud and disputes.
GMAP introduces multiple new monitoring categories:
- High Dispute Merchant (HDM): Merchants with at least 5 cleared transactions, USD 5,000 or more in combined fraud and non-fraud chargebacks, and a ratio of 500 or more basis points (5% of sales).
- Excessive Dispute Merchant (EDM): Merchants with at least 5 cleared transactions, USD 10,000 or more in combined fraud and non-fraud chargebacks, and a ratio of 5,000 or more basis points (50% of sales).
- High Dispute Acquirer (HDA) and Excessive Dispute Acquirer (EDA): Portfolio-level thresholds for acquirers, with assessments that escalate over time and can ultimately lead to restrictions on a Mastercard licence.
For merchants flagged as an EDM for two or more months, issuers will be able to use chargeback reason ‘code 4849’ to recover 100% of the transaction amount. That entails retroactive liability, covering fraud-related chargebacks from the three months before identification and fraudulent transactions for the six months after.
This creates a window where past transactions you've already settled can generate new chargeback liability, which most merchants won't have priced into future risk models.
Tighter ECM thresholds to be phased in over five years
The Excessive Chargeback Merchant (ECM) criteria remains unchanged for 2027 and 2028: 100 or more chargebacks and between 150 and 299 basis points.
After that, the basis point floor drops steadily:
- 2029: 130 basis points
- 2030: 110 basis points
- 2031: 90 basis points
The chargeback count stays at 100. Only the ratio threshold tightens. For mid-market merchants already operating near the current 150 basis point line, the 40% reduction by 2031 leaves very little margin for error.
Submerchant-level monitoring changes for marketplaces and payment facilitators
One of the most significant structural changes for merchants; ECM, High Excessive Chargeback Merchant (HECM) and Excessive Fraud Merchant (EFM) monitoring will apply at submerchant ID level, not just top-level Merchant ID.
From 1 April 2027, when a submerchant ID is populated in transaction clearing messages, Mastercard will use it as a key identifier. Individual submerchants get monitored on their own performance. If you operate a marketplace or act as a payment facilitator, this is the change to plan around first.
QMAP tightens limits and scopes wider
Mastercard's Questionable Merchant Audit Program (QMAP) — which governs how acquirers are held liable for fraudulent merchant activity — is getting significantly broader scope. Three changes take effect in April 2027:
- 5x lower fraud volume tolerance: the minimum drops from USD 50,000 to USD 10,000
- 4x shorter case scope window: faster identifications for merchants
- no merchant age requirement: MasterCard now scopes everyone, meaning passing the 6 month mark is not a safety net anymore.
Together, these updates mean Mastercard can identify and act on deceptive or fraudulent merchant activity faster and across a much broader population.
The bigger picture: schemes are aligning
GMAP follows Visa's VAMP (Visa Acquirer Monitoring Program) in direction, consolidating fraud and dispute monitoring into a single unified framework. This is the same structural move Visa made from April 2025.
The intent is shared across both networks: unified monitoring, lower thresholds, greater accountability and faster enforcement. But the mechanics differ in ways that matter for compliance teams.
Transaction scope: VAMP applies to card-not-present transactions only. GMAP covers all transaction types; card-present and card-not-present.
Gate structure: VAMP uses a single ratio; fraud reports, fraud chargebacks and non-fraud disputes divided by that month's settled transaction count. A transaction with both a fraud report and a fraud chargeback counts twice in the numerator. GMAP uses a dual-gate model. Merchants must hit both a dollar-value floor and a basis point ratio to be flagged.
For HDM, that means combined fraud volume and non-fraud chargebacks of at least USD 5,000 and a ratio of 5% or higher. For EDM, the thresholds are USD 10,000 and 50%.
Volume floors: VAMP handles volume separately through its enumeration ratio condition, which sets a 20% threshold and includes both approved and declined transactions. GMAP builds the volume threshold directly into the identification criteria. A merchant who hits the ratio but falls below the volume floor won't be flagged.
Ratio denominator: VAMP measures against settled transactions from the same month. GMAP uses settled transactions from the previous month.
These differences mean a merchant can be compliant on one network and exposed on the other. Monitoring both schemes together with a clear view of how each calculates its ratios is the only way to stay ahead of both.
What merchants should do now
Know your current dispute and fraud ratios
Collate Mastercard chargeback data and calculate your basis point ratios. If you're above 100 basis points today, the phased ECM reductions will put you at risk before 2031. Treat 90 basis points as your target to get ahead.
Understand your submerchant exposure
If you're a marketplace or payment facilitator, audit your submerchant population. Identify which submerchants have elevated dispute or fraud rates. Build remediation plans before monitoring shifts to submerchant ID level in April 2027.
Model your retroactive exposure
Under GMAP's EDM rules, liability can back-date three months before identification. Assess your current fraud-to-sales ratios to understand what a retroactive chargeback window would cost you.
Review your chargeback prevention tools
Pre-dispute automation and strong fraud detection reduce the number of chargebacks that apply to GMAP monitoring. Evaluate whether your current setup is keeping pace with lower thresholds ahead.
Talk to your acquirer early
Your acquirer will be subject to their own GMAP thresholds (HDA and EDA), and they have a direct interest in helping you stay compliant. Start the conversation now before you've been flagged.
Monitor both networks together
With Visa VAMP already live and Mastercard GMAP taking effect in 2027, maintain a single view of your dispute performance across both schemes on a solution like payabl.one.
payabl.one gives merchants real-time visibility into dispute and fraud performance across multiple payment networks. Get in touch to see how we can help you prepare for GMAP and stay ahead of tightening scheme thresholds.