On 28 July 2026, Mastercard announced a new strategy for monitoring fraud and chargebacks — including the launch of the Global Merchant Audit Program (GMAP) and a revision of the Questionable Merchant Audit Program (QMAP).
In this article, you’ll find a detailed yet simplified explanation of the announcement and advice on how to respond.
NOTE
Mastercard’s latest announcement is long, detailed, and confusing. In fact, it might be the most complex announcement we’ve ever encountered.
We’ve already submitted dozens of questions to Mastercard for clarification. Our understanding and insights on the topic will shift as more information becomes available. Be the first to know about the latest developments by following us on LinkedIn.
TL;DR
A summary of Mastercard’s latest announcement
Here’s a brief summary of what is shared in Mastercard’s most recent update.
Mastercard is making massive changes to its risk management strategy. This is the most detailed and complex announcement we’ve seen in a long time.
The latest announcement does the following:
- Introduces a new monitoring program
- Retires an existing program
- Consolidates several existing programs
- Refines an existing program.
This is a global update, so acquirers and merchants in all regions will be impacted.
Mastercard plans to update its technology platform with required data elements by October 2026. This will give acquirers time to start building their monitoring strategy.
However, the initial GMAP standards won’t take effect until 1 April 2027. The first GMAP billing will take place in May 2027 for April 2027 violations.
Certain thresholds will be further revised on 1 January 2029, 1 January 2030, and 1 January 2031.
An overview of Mastercard’s risk-related monitoring programs
At the highest level possible, here’s a summary of Mastercard’s latest announcement — GLB 14127.1.
There are three key things to note.
KEY COMPONENT #1
A new program has been introduced — the Global Merchant Audit Program (GMAP).
The goals and strategy of Mastercard’s all-new Global Merchant Audit Program (GMAP) are similar — yet slightly different — to the Visa Acquirer Monitoring Program (VAMP) updates.
Here are the main similarities and differences:
- Acquirer and merchant risk will both be monitored from a single program. A legacy program — the Acquirer Chargeback Monitoring Program (ACMP) — is being retired and incorporated into GMAP. Individual merchant monitoring programs are also consolidated into GMAP. But unlike VAMP, they retain their own distinct identities. (There are five different classifications — we’ll go over them in more detail later on.)
- Fraud and chargebacks thresholds will be combined. Mastercard lists a program enhancement as “incorporating both confirmed fraud activity — including fraud not resulting in a chargeback — and non-fraud dispute activity into a unified view of overall performance.”
RELATED READING
KEY COMPONENT #2
A legacy program is being updated — Questionable Merchant Audit Program (QMAP).
QMAP is not a new monitoring program. The announcement simply updates certain elements of the existing program.
Revisions are in three areas:
- Lower thresholds
- Shorter time period for investigation
- Greater risk for enrollment
RELATED READING
KEY COMPONENT #3
The latest updates are in addition to — not a replacement of — the Potential Scam Merchant Monitoring (PSMM).
The GMAP and QMAP announcement came out four days after Mastercard’s scam merchant monitoring program went into effect.
These new programs do not impact or replace what has already been enforced with the scam monitoring.
RELATED READING
Here’s a visual overview of the three monitoring programs.
And here’s an overview of the metrics being monitored by each program.
In a nutshell:
- The scam monitoring program is designed to detect merchant activities that manipulate or mislead cardholders.
- QMAP identifies merchants engaging in collusive, fraudulent, or otherwise illegal behavior.
- GMAP evaluates a merchant’s ability to detect criminal fraud, prevent unauthorised transactions, and ensure a positive cardholder experience.
As you can see, GMAP is very complex. And QMAP has some significant nuances too.
Check out our detailed guide on each topic to learn more.
Need help navigating Mastercard’s newest risk monitoring programs?
Mastercard’s latest update is significant and far-reaching. It is completely understandable if you have questions or concerns. Don’t hesitate to reach out to the AltoPay team if you’d like to chat about how to navigate the new norm.
AUTHOR
Jessica Velasco
For more than a decade, Jessica Velasco has been a thought leader in the payments industry. She aims to provide readers with valuable, easy-to-understand resources.
