What is a high-risk business

Key facts (as of 29 October 2026)

• Visa's definition: businesses "that are legal, but without proper controls are at heightened risk of processing transactions for activities that may not be legal" (Visa Integrity Risk Program).
• Three Visa tiers: Tier 1 includes gambling and pharmacies. Tier 2 covers crypto, cyberlockers and games of skill. Tier 3 covers trading platforms, outbound telemarketing, negative-option subscriptions and cross-border tobacco.
• Access gap: 56 of the 119 payment providers on Finzil that publish an industry list refuse gambling with no exception for licensed operators. Only 31 of 220 providers on its directory say they serve iGaming (October 2026).
• Reserves: high-risk processors quote rolling reserves of 5–15% of volume, often held for 6–12 months (Finzil).
• Market shocks: Brazil banned fixed-odds betting and online games by Medida Provisória 1.394 on 25 September 2026; 188 authorised sites went dark from 6 October (Brazilian Ministry of Justice).

"High-risk" is a commercial and compliance label, not a legal verdict. A licensed casino, a regulated broker or a registered crypto exchange can be fully lawful and still be high-risk to a bank. The label reflects the chance of loss to the payment provider through chargebacks, fraud, regulatory breaches or reputational damage, and the cost of controlling it.

Why a business is labelled high-risk

How underwriting works

flowchart TD
    A[Merchant applies] --> B[Acquirer or PSP KYB: ownership, licences, website]
    B --> C{Is the activity legal where the customers are?}
    C -- No --> X[Decline]
    C -- Yes --> D{High-integrity-risk category?}
    D -- No --> E[Standard onboarding]
    D -- Yes --> F[Acquirer registers merchant with Visa or Mastercard]
    F --> G[Pricing, reserve and limits set]
    G --> H[Go live with correct MCC and descriptor]
    H --> I[Ongoing monitoring: VAMP, website checks, annual review]
    I -- Breach or excess disputes --> J[Remediation, higher reserve or termination]

Finzil's practical advice for operators is to keep an application pack ready: licence, ownership chart, AML policy and six months of statements. Those documents are what the underwriter in the middle of that chart asks for.

What the label costs

• Fewer providers. Many banks and processors exclude whole sectors.
• Rolling reserves. High-risk processors quote 5–15% of volume, often held for 6–12 months (Finzil). See Rolling reserves.
• Slower settlement. Payouts arrive anywhere from the next day to a week later. T+1 is the most common published window in a directory of 79 iGaming payment providers (15M).
• Scheme registration and audits. Acquirers need Visa's High Integrity Risk registration, and merchants must be registered before they process.
• Scheme fees. 15M reported that Fiserv published two different fixed Visa fees, US$0.02 and US$0.10, for online gambling transactions in Latin America and the Caribbean under Visa's October 2026 fee update.
• Sudden exits. A provider can leave a sector, or lose its own licence, at short notice. After Canada's FINTRAC revoked Gulliver Pay Inc.'s registration on 1 May 2026, Kea, a provider built on its services for iGaming, crypto and forex firms, stopped taking new customers (Finzil).

NoteStablecoin settlement does not make a business low-risk. It changes the rail, not the risk profile. Licensing, KYC, sanctions screening, consumer protection and accurate transaction descriptions all still apply. What stablecoins can change is speed, hours and the number of banks that must say yes.

Market-by-market pressure on payments (2025–2026)

WarningMarket bans are a different category of risk from being high-risk. When Brazil banned fixed-odds betting and online casino on 25 September 2026, with licences ending 30 days later, the right response was to stop serving the market, not to find another payment route. See Brazil.

Timeline

The main high-risk sectors on this wiki

• iGaming operators
• Payment service providers
• Crypto exchanges and OTC desks
• Forex and CFD brokers
• Remittance and money transfer operators

Illustrative example: the true cost of high-risk processing

Illustrative example. All figures are invented.

An operator processes €2m a month in card deposits. Its acquirer charges 3.5% plus a 10% rolling reserve held for 180 days. Processing fees cost €70,000 a month. The reserve builds to about €1.2m after six months and then plateaus, as releases match new holds. That €1.2m is working capital the operator cannot use. If 30% of volume moves to open banking with no reserve, the steady-state reserve falls to about €840,000. That is why operators diversify rails, not just processors.

Q/A

Is "high-risk" the same as "prohibited"?

No. Prohibited businesses cannot be processed at all. High-risk businesses can be processed with extra registration, controls and pricing.

Can a business stop being high-risk?

The sector label usually stays. A merchant's own terms, such as its reserve, pricing and limits, can improve with a clean processing history and strong controls.

Why do some providers refuse even licensed operators?

Cost and appetite. Serving a high-risk sector needs specialist compliance staff, scheme registration and capital for losses. Some providers decide the margin is not worth it.

Does a licence in Malta or Curaçao make a business lower risk?

It helps underwriting, because it shows a supervisor has checked the business. It does not override the law of the markets where customers live.

Is crypto acceptance itself high-risk?

Visa places crypto merchants in Tier 2 of its Integrity Risk Program. Banks and acquirers typically treat crypto flows as higher risk because of AML and sanctions exposure.

How should a business prepare for a market ban?

Map revenue and payment flows by country, keep wind-down and refund procedures ready, and watch regulators' notices. Brazil gave operators ten days to take sites offline.

Sources

• Visa, Visa Integrity Risk Program guide (April 2023): https://www.visa.cl/content/dam/VCOM/regional/lac/SPA/chile/Documents/visa-integrity-risk-program-chile.pdf
• Visa, Acquirer Monitoring Program / VAMP fact sheet (2025): https://corporate.visa.com/content/dam/VCOM/corporate/visa-perspectives/security-and-trust/documents/visa-acquirer-monitoring-program-fact-sheet-2025.pdf
• Finzil, iGaming payment challenges (18 October 2026): https://finzil.com/blog/igaming-payment-challenges
• 15M, payments and fintech news: https://15m.com/news/payments-fintech/
• Planalto, Medida Provisória 1.394 (25 September 2026): https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2026/mpv/mpv1394.htm
• Ministério da Justiça, bets offline (6 October 2026): https://www.gov.br/mj/pt-br/assuntos/noticias/bets-fora-do-ar-plataformas-cumprem-determinacao-e-encerram-apostas-no-brasil
• BSP Memorandum M-2025-029: https://www.bsp.gov.ph/Regulations/Issuances/2025/M-2025-029.pdf
• Philippine Daily Inquirer, Maya to stop access to gaming (August 2025): https://business.inquirer.net/541649/maya-to-stop-access-to-gaming-at-8-pm-users-advised-to-withdraw-funds
• DIAN, Legislative Decree 0240 of 12 March 2026: https://www.dian.gov.co/normatividad/Decretos/Decreto-0240-12032026.pdf
• UK Gambling Commission, credit card ban: https://www.gamblingcommission.gov.uk/news/article/gambling-on-credit-cards-to-be-banned-from-april-2020
• HM Revenue & Customs, gambling duty changes (policy paper): https://www.gov.uk/government/publications/changes-to-gambling-duties/gambling-duty-changes
• UK Gambling Commission, LCCP SR Code 3.4.4 financial vulnerability check: https://www.gamblingcommission.gov.uk/licensees-and-businesses/lccp/condition/3-4-4-financial-vulnerability-check