High-risk · Industry
For years, being a high-risk merchant meant paying a registration fee once a year and absorbing a worse rate. The fee was a fixed annoyance. It did not scale, and once it was paid the network stopped charging you for the label.
That changed on 3 June 2026. Mastercard now bills registered specialty merchants a fee on every transaction and a second fee on every dollar of volume, on top of a registration fee it raised a month earlier. Visa has been billing high-risk merchants the same way for longer. The label is now a rate, and it compounds with everything else on the statement.
The source is a Mastercard bulletin, AP/LAC/MEA/US 12568.1, published on 28 October 2025 and titled "New and Updated Specialty Merchant Registration Program Fees". It covers the United States, Middle East/Africa, and selected countries in Asia/Pacific — excluding Japan and Indonesia — and Latin America and the Caribbean, excluding Brazil, Mexico and Colombia.
It sets four fees, on two dates:
The first billing date was 14 June 2026. If you are a registered specialty merchant, the fees have been running for a quarter, and the first statement that could possibly have shown them was the one covering June.
This is the part that circulating summaries get wrong, so it is worth stating from the bulletin itself. The transaction and volume fees attach to transaction type identifiers, not to merchant category codes:
Within those, the fees apply where the processing code's cardholder transaction type is 00 (purchase of goods or services), 09 (purchase with cash back), 18 (unique transactions) or 20 (credits). Funding transactions carrying a funding transaction TTI are exempt.
Note what the bulletin does not do: it does not enumerate the categories inside P72. Every list you will find online of "the industries Mastercard now charges for" — CBD, firearms, tobacco, vape, nutraceuticals, adult, dating — is somebody's reconstruction, not the bulletin's text. The categories that must register are defined in Mastercard's Specialty Merchant Registration Program standards, published separately as GLB 12564.1, and the TTI itself was introduced in GLB 12516.1. If you want to know whether you are in scope, the question to put to your acquirer is not "am I high risk" but "which TTI are my transactions being submitted with". That has a single, checkable answer.
The credits line is worth a second look too. Refunds carry processing code 20, so a merchant with a high return rate is paying the transaction fee twice on the same sale.
Merchants do not pay the High-Risk Acquirer License Fee. Acquirers do, annually, for the privilege of boarding specialty merchants at all. Mastercard automatically granted a supplemental licence to acquirers already acquiring for specialty merchants before 1 May 2026, and bills them for it regardless. New acquirers must file a High-Risk License Addendum — Form 637 — and be approved before billing begins.
An acquirer that decides the licence is not worth it has one option in the bulletin: unregister and terminate its relationships with every specialty merchant in its portfolio.
That is the part with consequences beyond pricing. A fixed $50,000 a year is trivial for an acquirer with a thousand specialty merchants and prohibitive for one with twenty. The economics push smaller acquirers out of high-risk acquiring entirely and concentrate the remainder — which, for a merchant, means fewer places to go after a termination and a harder landing if you end up on the MATCH list.
Visa's equivalent is the Visa Integrity Risk Program, which took effect on 1 May 2023, replacing the Global Brand Protection Program. VIRP sorts high-integrity-risk merchants into three tiers by the kind of harm the network is worried about, and the tiers are defined by merchant category code:
Visa's own Ecosystem Risk Programs Guide sets what the tier costs an acquirer in work rather than money: a Tier 1 acquirer undergoes an initial control assessment for each specific Tier 1 category it wants to acquire, plus an annual control self-assessment for each approved category. Tier 2 requires one assessment covering Tier 2 acquiring as a whole rather than per category. Tier 3 requires registration, with a self-assessment only if Visa asks. Acquirers must also attest in writing that they have submitted no transactions in a VIRP category before approval, and pay a one-time, non-refundable application fee.
Visa does not publish its merchant-facing fee schedule. Acquirers do, and they report the VIRP registration fee at $950 per merchant initially and annually, up from $500, alongside an integrity risk fee of $0.10 per transaction and 10 basis points on processed volume. Treat those figures as reported by acquirers rather than confirmed by Visa — the program and its tier structure are documented publicly, the prices are not.
Take a merchant doing $100,000 a month of Mastercard volume with a $60 average ticket — about 1,667 transactions. The volume fee is 10 basis points, so $100. The transaction fee is $0.02, so about $33. That is $133 a month, roughly $1,600 a year, plus the $1,000 registration, for about $2,600 annually.
As a rate, the per-transaction pieces come to about 13 basis points of Mastercard volume. If Visa's reported figures are accurate, the same merchant's Visa volume carries about 27 basis points — 10 on volume plus $0.10 on a $60 ticket, which is another 17. Put the two together across a normal card mix and the network's high-risk surcharge alone lands somewhere around 0.2% of Visa and Mastercard volume, before your processor's markup, before the reserve, and before the elevated interchange these categories already attract.
That number is small enough that nobody quotes it in a sales conversation and large enough to matter at scale. On $5 million a year it is roughly $10,000.
Both networks pair a percentage with a flat per-transaction amount, and the flat amount is what does the damage. At a $60 ticket, Mastercard's $0.02 is 3.3 basis points. At a $12 ticket it is 17. Visa's reported $0.10 is 17 basis points at $60 and 83 at $12.
Nutraceutical trials, dating subscriptions, adult content, small crypto purchases and continuity offers are all low-ticket, high-frequency businesses. The fee structure is worst precisely where these programs are aimed, and a merchant whose average order is under $20 should model this as a percentage rather than filing it as a fixed annual cost.
If you are shopping, our guide to high-risk merchant accounts covers the providers the site has reviewed in this space, including eMerchantBroker, PaymentCloud, Soar Payments and Corepay. For the categories the bulletin names directly, the site has reviewed CCBill on the adult and subscription side and BitPay on crypto acceptance.
One last thing worth saying plainly. These fees are not a penalty for doing something wrong. They are the price the networks have set for supervising categories that are legal but expensive to police, and every registered merchant in the category pays them regardless of chargeback rate or conduct. A clean ten-year record does not exempt you, which is exactly why it belongs in your cost model rather than in your compliance file.
