Visa Integrity Risk Program (VIRP)

Key facts (as of 29 October 2026)

• Scope: acquirers, their third-party agents (ISOs, payment facilitators, digital wallet operators) and the high-integrity-risk merchants they sponsor.
• Replaced: the Global Brand Protection Program. The guide FiatDesk read is dated 6 April 2023 and is a supplement to the Visa Rules, which prevail in any conflict.
• Gate: an acquirer must hold High Integrity Risk Acquirer Registration before soliciting, contracting with or processing for any merchant in scope.
• Tier 1 approvals: each Tier 1 category (for example gambling, then pharmacies) needs its own separate Visa approval (VIRP guide).
• Annual attestation: by registering a merchant, the acquirer certifies, and re-certifies every year, that the merchant complies with Visa rules and has effective controls to monitor and block illegal transactions.
• Current coding: Visa's October 2026 Merchant Data Standards Manual still lists the same high-integrity-risk MCCs, with 5816 used for skilled game wagering such as daily fantasy sports (Visa MDSM, October 2026).

Why VIRP exists

Visa says it built VIRP because of "the rapidly expanding payment ecosystem, increasing complexity of local laws and regulations and rising potential for illegal and illicit activities in certain areas". The programme puts the burden on acquirers. Visa does not underwrite merchants itself; it requires acquirers to prove they can, then holds them to their attestations.

The three tiers

Approval cascades downwards. An acquirer approved for any Tier 1 category is also approved for all Tier 2 and Tier 3 categories. Tier 2 approval also covers Tier 3. Tier 3 approval covers Tier 3 only.

Requirements by tier

All applicants must also submit the application and documents, pay a one-time, non-refundable fee that depends on the tier, attest that no in-scope transactions have been or will be processed before approval, pass a financial review with the required equity capital (or accept compensating controls such as collateral), and be in good standing in all Visa risk programmes.

How registration flows

flowchart TD
    A[Acquirer applies for High Integrity Risk registration] --> B[Financial review and control assessment]
    B --> C{Approved for tier?}
    C -- No --> X[Cannot solicit or process in-scope merchants]
    C -- Yes --> D[Register third-party agents: ISOs, PayFacs, wallets]
    D --> E[Enhanced due diligence on each merchant]
    E --> F[Register merchant with Visa, including URLs]
    F --> G[Merchant processes with correct MCC and descriptor]
    G --> H[Ongoing monitoring and annual attestation]
    H -- Activity changes, e.g. new URL --> F

Agent registration

Acquirers that use third-party agents to solicit high-risk merchants must:

• register those agents
• complete due diligence on them under Visa's Global Acquirer Risk Standards (GARS)
• review the agents' own merchant due diligence and monitoring
• attest that the agent due diligence is complete
• oversee the agents' compliance formally, at least once a year

For a payment facilitator serving gambling or crypto merchants, this means its sponsor acquirer will audit its onboarding files. See Payment service providers.

Merchant registration and attestation

All high-integrity-risk merchants must be registered with Visa before they submit transactions. Pharmacies accredited by NABP or LegitScript are an exception. The acquirer must also update the registration when activity changes, for example new URLs. Every merchant agreement must require the merchant to comply with applicable law, follow the Visa Rules, not knowingly submit illegal transactions, and accept Visa's right to limit or terminate the relationship.

NoteFor an operator, this explains why onboarding with a card acquirer asks for licences, URLs, geo-blocking evidence and content or game controls. The acquirer is making a personal attestation to Visa.

WarningVIRP and stablecoin settlement sit side by side. A merchant that takes cards remains in VIRP scope even if it also settles some volume in stablecoins. Adding an unregistered URL or brand to an existing merchant account can look like transaction laundering.

VIRP alongside local rules

Illustrative example: a PSP widening its portfolio

Illustrative example. The PSP and its acquirer are hypothetical.

A payment facilitator holds Tier 2 approval through its acquirer and serves crypto on-ramps. It wins a licensed sportsbook. Because gambling is Tier 1, the acquirer must first obtain separate Visa approval for MCC 7995, pass a control assessment for that category, then run enhanced due diligence on the sportsbook. Only after the sportsbook is registered can it process. If the PSP later wants an online pharmacy, that is another Tier 1 category and another approval. That sequencing is why onboarding a gambling merchant through a new acquirer can take months.

Timeline

Q/A

Does VIRP apply to crypto purchases made with a card?

Yes. Card-absent crypto exchanges, wallet providers and on-ramp providers using MCC 6051 or 6012 with special condition code 7 are Tier 2.

Why do some acquirers accept crypto but not gambling?

Tier 1 gambling needs its own Visa approval and a higher control standard. Many acquirers hold only Tier 2 or Tier 3 approval.

Does VIRP cover Mastercard?

No. Mastercard runs its own registration programmes and standards. Merchants taking both networks satisfy both.

Can a merchant register itself with Visa?

No. Registration is done by the acquirer, which carries the attestation.

What happens if a registered merchant adds a new website?

The acquirer must update the registration with the new URL. Processing for an unregistered site risks breaching Visa rules.

Is VIRP public?

The guide FiatDesk read is marked "Visa Confidential" but has been published online by Visa's Latin America region. Acquirers should rely on their Visa Online copy.

Sources

• Visa, Visa Integrity Risk Program guide (6 April 2023): https://www.visa.cl/content/dam/VCOM/regional/lac/SPA/chile/Documents/visa-integrity-risk-program-chile.pdf
• Visa, Visa Merchant Data Standards Manual (October 2026): https://usa.visa.com/dam/VCOM/download/merchants/visa-merchant-data-standards-manual.pdf
• Visa, VAMP fact sheet (2025): https://corporate.visa.com/content/dam/VCOM/corporate/visa-perspectives/security-and-trust/documents/visa-acquirer-monitoring-program-fact-sheet-2025.pdf
• UK Gambling Commission, credit card ban: https://www.gamblingcommission.gov.uk/news/article/gambling-on-credit-cards-to-be-banned-from-april-2020
• AGCO, Registrar's Standards for Internet Gaming: https://www.agco.ca/en/lottery-and-gaming/registrars-standards-gaming
• Planalto, Medida Provisória 1.394: https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2026/mpv/mpv1394.htm
• BSP Memorandum M-2025-029: https://www.bsp.gov.ph/Regulations/Issuances/2025/M-2025-029.pdf
• UK Gambling Commission, credit card ban (14 January 2020): https://www.gamblingcommission.gov.uk/news/article/gambling-on-credit-cards-to-be-banned-from-april-2020
• AGCO, Registrar's Standards for Internet Gaming: https://www.agco.ca/en/lottery-and-gaming/registrars-standards-gaming
• Planalto, Medida Provisória 1.394 (25 September 2026): https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2026/mpv/mpv1394.htm
• BSP, Memorandum M-2025-029: https://www.bsp.gov.ph/Regulations/Issuances/2025/M-2025-029.pdf