High Risk Merchant Account: Why Banks Say No and What a Yes Really Costs in 2026

Over beers, a colleague told me how a small online store never got launched. The plan was Korean cosmetics; the problem was payments. Stripe, Wise and the other mainstream providers said no: there was no company, almost no volume, and some of the products fell under drug rules. The high-risk processors didn't take the call seriously either. It wasn't a casino, and it wasn't going to bring them millions.

The loop is what stuck with me. To earn your first $1, you need to take a card payment. To take card payments, you need a company. To open a company, you need money, which you can't earn without taking payments. Anyone who has tried to cut the network and the advertiser out of the funnel and sell their own product has met some version of it.

Both refusals come from the same place. Behind every checkout sits a chain of companies, and one of them, the acquiring bank, pays for your chargebacks if you can't. A high risk merchant account is an acquirer, or a payment processor working for one, agreeing to carry that risk for a price. Below: who decides you're high risk, who carries what, the numbers that close accounts, why small merchants get ignored and what high risk payment processing really costs.

What makes a business high risk: read the processor's list

Being high risk isn't a feeling an underwriter has about you. It's written down. Stripe's list of prohibited businesses, last updated September 22, 2026, has a section on "unfair, deceptive or abusive acts or practices," and an affiliate will recognize most of it:

Get rich quick, outrageous claims, fake testimonials, "sales of online traffic or engagement" and "reduced price trials with unclear or hidden pricing": the last line is the classic nutra trial with a hidden rebill. A separate line bans "pseudo-pharmaceuticals or nutraceuticals that are not safe or make harmful claims."

Card networks keep their own list. Visa's Integrity Risk Program (VIRP), which replaced the Global Brand Protection Program in May 2023, sorts high-integrity-risk merchants into 3 tiers by merchant category code, or MCC:

• 1 — 5967, 7273, 7995, 5122/5912. Adult and subscription teleservices, dating, betting, prescription drugs
• 2 — 6051/6012, 4816, 5816. Crypto, cyberlockers, skill games
• 3 — 6211, 5966, 5968, 5993. Forex and binary options, outbound telemarketing, negative-option subscriptions, tobacco and vapes

Read as a menu, it's an affiliate network's vertical list. An acquirer has to register each such merchant with Visa before it takes a payment. From April 1, 2024, the registration fee went from $500 to $950, and merchants in 5967, 7273 and 7995 also pay a Visa Integrity Risk Fee of $0.10 per transaction plus 0.10% of its value. That's the first reason high risk payment processing costs more: the networks charge more to let you in.

Who carries your chargebacks: the payment chain in 6 roles

Your customer's money moves through more companies than the checkout shows:

• Issuer — The customer's bank, which issued the card. Approves or declines; returns the money to the cardholder in a dispute
• Card network — Visa, Mastercard. Writes the rules, runs monitoring programs, fines acquirers
• Acquirer — The merchant's bank, a member of the network. Pays the issuer back on a chargeback, even if the merchant can't
• Payment facilitator (PSP) — Stripe, PayPal, Square: onboards you under its own master account. Your chargebacks and network fines, toward the acquirer
• ISO — A sales agent that places merchants with an acquirer. Commissions, and often part of the losses by contract
• Gateway or orchestrator — Software that passes card data and routes each payment. Technical only, unless the contract says more

There's one more role worth knowing: a merchant of record, like Paddle or Lemon Squeezy, becomes the legal seller itself, so the risk is entirely its own.

Liability lands at the acquirer and flows down the contracts. Stripe says it plainly in its reserves FAQ: "As a payment processor, Stripe is responsible for the disputes and refunds that arise when businesses take payments from their customers but are unable to fulfill their orders." Network fines take the same road: "Visa charges these assessments to Stripe, which might be passed on to you."

That explains both halves of the dead zone. A payment facilitator says yes to almost anyone in minutes, because it boards you under its own account and checks you afterward, by software, against the list above. When the software finds a match, the account closes, and that's the story behind most "Stripe closed my account" threads. A dedicated merchant account works the other way round: an underwriter reads your file before you take a single payment. That costs the acquirer real hours, so it wants a business worth the hours.

VAMP, ECM and MATCH: the numbers that close merchant accounts

Card networks don't judge merchants case by case. They count. Visa's Acquirer Monitoring Program, VAMP, replaced its separate dispute and fraud programs in 2025, and since April 1, 2026 its "excessive" line for merchants in most regions sits at 1.5%:

The ratio counts disputes and fraud reports together against settled card-not-present transactions. For performance offers, 2 details matter. Monitoring programs don't consider dispute outcomes, so a dispute you win still counts. And they don't count refunds, so the cheapest dispute is the one a refund stopped before it was filed.

Mastercard's Excessive Chargeback Merchant program (ECM) starts at 100 chargebacks and 1.5% in a month, and the fine grows every month you stay in it:

Above 300 chargebacks and 3%, the High Excessive tier (HECM) runs the same ladder up to $200,000 a month. Stripe also warns that failing a program's requirements "can result in the network refusing to process further payments to you."

The last number outlives the account. When an acquirer terminates a merchant for cause, it reports the business and its owners to Mastercard's MATCH list, and the excessive-chargeback code needs only 1% and $5,000 in a single month:

A MATCH entry stays for 5 years and carries the principal owner's name, address, phone and tax ID along with the business's. Only the acquirer that filed it can remove it, and only in narrow cases such as an error. Stripe says a MATCH or Visa VMSS listing "generally disqualifies a merchant from processing with Stripe."

For an advertiser, these are monthly ratios, and that's where affiliates come in. In my reading, a single month of motivated or stolen-card traffic on a trial offer can push a small MID over 1.5% on its own, and the fines and the MATCH risk land on the advertiser, not on the source. That's why trial and CC-submit advertisers watch dispute rates by source and cut the ones that spike.

Why high-risk processors ignore small merchants

The other half of the dead zone is economics, and it's often overstated. You'll read that high-risk acquirers want $100,000 a month. Some specialists do, but it isn't a rule. PaymentCloud, a US high-risk seller, lists "Startups," "Dropshipping" and "Supplements" among its industries and advertises "Apply Online in Minutes (No credit check)," with most approvals "within 24-48 hours."

What it asks for is "a government-issued ID, business license, bank statements, and processing statements if you have them." Read that again and the loop is back: a business license and bank statements assume the company you don't have yet.

The rest is arithmetic. A store doing $5,000 a month pays roughly $100-250 in discount fees at the 1.95-4.95% rates below, and most of that goes to the issuer and the networks. Against it, the acquirer pays for an underwriter's hours, monitoring and an open-ended chargeback exposure, plus $950 to Visa if the MCC is on the integrity-risk list. A casino doing $500,000 a month pays for the same file 100 times over.

So small high-risk merchants aren't refused for being risky. They're refused, or priced up, because their risk doesn't pay. And the file isn't only about the business: PayPal says its reserve decisions weigh "your business and/or personal credit history," so a founder's own credit sits in the merchant file too.

What a high risk merchant account costs: rates, fees and reserves

Here's a published price range from Durango Merchant Services, one of the US high-risk ISOs:

That's 1.95-4.95% per transaction, $0.15-0.25 per authorization and $15-60 a month, before chargeback fees and, for 5967, 7273 and 7995, Visa's integrity fee. If someone quotes you 10-20% per transaction, that's not a rate from any published high-risk price list we found. Ask what's inside it.

The bigger cost is the money you don't get. A rolling reserve holds a share of each day's sales and releases it later. PayPal describes 3 kinds:

Durango tells applicants that "many merchants can expect a 5–10 % rolling reserve." Here's what that does to cash flow, by our arithmetic, once the reserve reaches steady state:

• $20,000. Reserve: 5%. Hold: 90 days. Cash locked at any time: $3,000.
• $50,000. Reserve: 10%. Hold: 90 days. Cash locked at any time: $15,000.
• $50,000. Reserve: 10%. Hold: 180 days. Cash locked at any time: $30,000.
• $200,000. Reserve: 10%. Hold: 180 days. Cash locked at any time: $120,000.

For an advertiser who buys traffic daily and pays affiliates weekly, that's ad budget sitting at the processor. And reserves can move. In April 2024 a founder on Hacker News wrote that "Stripe has put a 25% reserve on all of my transactions and is currently holding $58,000," and had for nearly 10 months. Stripe's own list of reserve triggers ends with a line every media buyer should read twice:

"An unexplainable sharp increase in processing volume" is what a good week on a new offer looks like from the processor's side. Tell your processor before you scale, not after.

How grey offers keep taking cards anyway

If the rules are this tight, how do trials with hidden rebills keep taking cards? A federal complaint filed on September 8, 2026 shows one way. The FTC says Humboldt Merchant Services, an ISO, opened "more than one thousand accounts" for shell entities between 2021 and 2023, set up for "advertisers" who were mostly "in the nutra space." It processed at least $139 million through them, with chargebacks "almost ten times higher" than the networks' excessive line.

Issuers approved far fewer of these payments on Humboldt's own bank ID: its president reported that a sister company's BIN "approves at 82%" against 47% on Humboldt's, and the accounts moved. Humboldt agreed to pay $12 million without admitting or denying the allegations. We break down the mechanics, and what they mean for affiliates, in Humboldt Merchant Services FTC Case: 1,000 Shell Merchants That Kept Nutra Trials Taking Cards.

Refused? The options that actually exist

Each route out of the dead zone has a price:

• Payment facilitator (Stripe, PayPal, Square) — Products clear of the prohibited lists. Fast yes, later review; closures and months-long fund holds when the software flags you
• High-risk ISO (PaymentCloud, Durango and others) — Real verticals with a company behind them. Business license, bank statements, higher rates, a reserve
• Merchant of record (Paddle, Lemon Squeezy) — Software and digital products. No physical goods: Lemon Squeezy bans "physical goods of any kind"
• Marketplace (Etsy, Amazon, eBay) — Physical goods that pass category rules. The marketplace's fees and rules, and its customer, not yours
• Payment links and invoices — Selling without a website. Still Stripe or PayPal underneath, with the same lists

None of them breaks the loop for free. The honest order is: check your product against the lists first, then pick the route whose catch you can live with. We go deeper on refusals in Merchant Account Declined or Closed and on the no-company routes in Accept Payments Without a Business. Before you pick any provider, run the checks in Is a Payment Processor Legit?