Mastercard Global Merchant Audit Program (GMAP) Explained

On 28 July 2026, Mastercard announced a new strategy for monitoring fraud and chargebacks — including the launch of the Global Merchant Audit Program (GMAP) .

In this article, you’ll find a detailed yet simplified explanation of the announcement and advice on how to respond.

TABLE OF CONTENTS

GMAP is a framework of different subcategories that apply to different audiences: acquirers and merchants.

Acquirer-level subcategories are:

• High Dispute Acquirer (HDA)
• Excessive Dispute Acquirer (EDA)

Merchant-level subcategories are:

• High Dispute Merchant (HDM)
• Excessive Dispute Merchant (EDM)
• Excessive Chargeback Merchant (ECM)
• High Excessive Chargeback Merchant (HECM)
• Excessive Fraud Merchant (EFM)

Each subcategory monitors its own metrics with set thresholds.

If a member — acquirer or merchant — breaches the thresholds outlined in its respective subcategory, a GMAP assessment will be launched and penalties may apply.

Each subcategory has its own thresholds. Let’s take a look at each.

An acquirer is identified as a High Dispute Acquirer when there are elevated fraud and dispute levels across its merchant portfolio.

These are the thresholds. Breaching all of these in a single month triggers an HDA audit.

• 1,500 or more transactions
• 1,500 or more transactions with a corresponding fraud claim (SAFE data) and/or non-fraud chargeback
• 0.5% or higher GMAP ratio (percent of fraud claims plus non-fraud chargebacks received in the current month compared to sales from the previous month)

Fees will be assessed each month the acquirer is in the program.

An acquirer is identified as an Excessive Dispute Acquirer when its portfolio experiences sustained and excessive performance concerns requiring escalated action.

These are the thresholds. Breaching all of these in a single month triggers an EDA audit.

• 1,500 or more transactions
• 1,500 or more transactions with a corresponding fraud claim (SAFE data) and/or non-fraud chargeback
• 0.7% or higher GMAP ratio (percent of fraud claims plus non-fraud chargebacks received in the current month compared to sales from the previous month)

Fees will be assessed each month the acquirer is in the program.

Acquirers that remain non-compliant for 12 or more months may need to complete a Franchise Management Program (FMP) review at their expense and address any identified issues.

Acquirers remaining non-compliant for 19 or more months could receive additional penalties, including potential restrictions, suspension, or termination of their Mastercard license.

A merchant is classified as a High Dispute Merchant (HDM) when there are elevated levels of fraud and chargebacks which could indicate increased cardholder risk or transaction quality concerns.

These are the thresholds. Breaching all of these in a single month triggers an HDM audit.

• 5 or more transactions
• $5,000 USD or more in fraud claims (SAFE data) and/or non-fraud chargebacks
• 5% or higher GMAP ratio (percent of fraud claims plus non-fraud chargebacks received in the current month compared to sales from the previous month)

Fees are assessed each month the merchant is in the program.

If a merchant exceeds HDM thresholds for two or more consecutive months, Mastercard may notify issuers of the merchant’s elevated risk level.

Although not in the official announcement, we can assume this issuer notification may cause the merchant’s authorisation rates to drop.

Another detail that isn’t specified in the announcement is whether or not Mastercard will notify issuers when the merchant exits the program or if the issuer’s perception of the merchant will forever be damaged.

A merchant will be classified as an Excessive Dispute Merchant (EDM) if fraud and chargeback levels are elevated for a sustained period of time.

These are the thresholds. Breaching all of these in a single month triggers an EDM audit.

• 5 or more transactions
• $10,000 USD or more in fraud claims (SAFE data) and/or non-fraud chargebacks
• 50% or higher GMAP ratio (percent of fraud claims plus non-fraud chargebacks received in the current month compared to sales from the previous month)

Fees are assessed each month the merchant is in the program.

When a merchant exceeds EDM thresholds for two consecutive months, liability for fraud-related chargebacks will shift to the merchant. This pertains to any fraud-related chargeback filed during the three months prior to identification and any fraud-related chargebacks occurring during the six months after identification.

When liability shifts, issuers can use chargeback reason code 4849 (Questionable Merchant) instead of a regular fraud reason code. This allows issuers to file chargebacks without any supporting documents and revokes merchant representment rights.

Merchants are classified as an Excessive Chargeback Merchant when chargeback activity starts to escalate.

When the GMAP standards go into effect on 1 April 2027, these will be the thresholds. Breaching all of these in a single month triggers an ECM audit.

• 25 or more transactions
• 100 or more chargebacks
• 1.5% or higher chargeback-to-transaction ratio (percent of chargebacks received in the current month compared to sales from the previous month)

ECM thresholds will be lowered on three future dates.

• 1 January 2029 – The chargeback-to-transaction ratio will be lower to 1.30%
• 1 January 2030 – The chargeback-to-transaction ratio will be lower to 1.10%
• 1 January 2031 – The chargeback-to-transaction ratio will be lower to 0.9%

Fees are assessed each month the merchant is in the program.

A merchant is classified as a High Excessive Chargeback Merchant (HECM) when chargeback levels are elevated for a sustained period of time.

These are the thresholds. Breaching all of these in a single month triggers an HECM audit.

• 25 or more transactions
• 300 or more chargebacks
• 3% or higher chargeback-to-transaction ratio (percent of chargebacks received in the current month compared to sales from the previous month)

Fees are assessed each month the merchant is in the program.

If merchants have open HECM audits for four or more months, they may need to complete a monthly internal review at their expense and address any identified issues.

A merchant is classified as an Excessive Fraud Merchant (EFM) when fraud-related chargebacks start to escalate.

These are the thresholds. Breaching all of these in a single month triggers an EFM audit.

• 1,000 or more ecommerce transactions
• 50 or more fraud-coded chargebacks
• $50,000 USD or more in fraud-coded chargebacks
• 0.5% or higher chargeback-to-transaction ratio (percent of fraud chargebacks received in the current month compared to sales from the previous month)

Fees are assessed each month the merchant is in the program.

Special classifications for PayFacs and PayFac merchants

The GMAP announcement introduces a new monitoring strategy.

Traditionally, all of Mastercard’s merchant monitoring has happened at the MID level. However, GMAP introduces a new option: monitoring at the submerchant ID level.

This means PayFacs can monitor risk and assign liability on a submerchant level.

The hierarchy looks like this:

HDM and EDM remain MID-level subcategories. But ECM, HECM, and EFM can be monitored on the submerchant level.

The thresholds for subcategories monitored at the submerchant level are the same and traditional MID-level monitoring. Check our previous section to learn more.

• Excessive Chargeback Merchant thresholds and fees
• High Excessive Chargeback Merchant thresholds and fees
• Excessive Fraud Merchant thresholds and fees

A hypothetical example of MID monitoring vs. submerchant monitoring

Acme, a popular PayFac, uses submerchant IDs to board individual merchants, but they all roll up under one MID. When the MID breach monitoring program thresholds, the PayFac is liable for corresponding penalties.

So when individual merchants — like Pete’s Pizza Parlor — experience an increase in chargeback activity, Acme will likely terminate Pete to save the health and stability of the overall MID.

But with the latest GMAP update, Acme’s risk management strategy could shift.

When Pete’s Pizza Parlor breaches thresholds, Acme has options. Termination is still possible; but instead, Acme could just fine Pete because Acme will now have the data needed to make that possible.

This could potentially revolutionise how PayFacs manage risk. However, as is the case with all brand updates, actual results won’t be realised until the standard takes effect.

A GMAP audit could trigger fees. Applicable fees are charged to the acquirer who may pass them down to individual merchants — possibly with a markup in price.

As we saw with VAMP, acquirers can and will assess fees however they choose. So the impact on individual merchants will vary.

These are the fees published in the GMAP announcement.

Unfortunately, it is possible for a merchant to be enrolled in multiple GMAP subcategories at once. For example, a single merchant might be audited for both HDM and ECM.

But fortunately, Mastercard will only assess fees on one subcategory — the subcategory with the highest of the potentially applicable fees.

Fee extensions

Sometimes, a good merchant finds themselves in a bad situation — meaning a GMAP audit is opened against a merchant who isn’t typically considered a risk.

In these situations, an acquirer can request an extension. A GMAP extension will pause fees for six months, allowing the merchant and acquirer time to fix the underlying issues that caused the influx in fraud and chargebacks.

There are a couple of caveats though.

• Extensions are only given once. If a merchant breaches thresholds again in the future, another extension won’t be granted.
• Fees are waived temporarily. If the merchant can achieve compliance for three consecutive months during the grace period, the fees will be permanently waived. However, if the merchant is still non-compliant when the extension ends, the fees will be applied retroactively. Fees will also be applied retroactively if the acquirer terminates the MID (or submerchant ID) during the grace period.

Acquirers and merchants are enrolled in GMAP when all the applicable thresholds are breached in a given month. They will remain in the program until fraud and chargeback activity drops below the threshold and stays compliant for three consecutive months.

If thresholds are breached in the future, the acquirer or merchant will be enrolled again.

If a merchant is flagged for more than one subcategory — for example both HDM and ECM — then the merchant will need to become compliant with thresholds for both classifications before the audit is closed.