How Acquirers Stop Scheme Fines Before They Start
The short answer
BRAM (Mastercard's Business Risk Assessment and Mitigation program) and VIRP (the Visa Integrity Risk Program) hold acquirers responsible for illegal or brand-damaging activity by the merchants they board. Penalties land on the acquirer, not the merchant. The acquirers that avoid them do three things well: they scan every merchant before its first transaction, they monitor the full digital footprint continuously, and they keep timestamped evidence ready for the scheme.
Why 2026 changed the stakes
Scheme compliance used to be an annual review exercise. In 2026 it became a pre-transaction and continuous obligation.
- Pre-first-transaction scanning. Since 1 January 2026, Mastercard's updated Merchant Monitoring Program expects newly boarded merchants to be screened by a registered Merchant Monitoring Service Provider (MMSP) before their first transaction reaches the network.
- Broader content scope. Mastercard Rule 5.12.7 on illegal or brand-damaging transactions was updated in February 2026 to explicitly cover AI-generated, digitally altered and synthetic imagery.
- Higher cost of high-risk acquiring. Mastercard raised its specialty merchant registration fees in 2026. On the Visa side, acquiring high-integrity-risk merchants without VIRP registration can trigger non-compliance assessments of up to USD 100,000 per month, plus USD 2,000 per unregistered merchant per month.
- Six-figure exposure per case. A single confirmed BRAM violation can cost an acquirer six figures in assessments, before counting remediation work, management time and license risk.
The pattern is clear. Schemes now expect acquirers to know what a merchant sells on day zero and every day after.
Where violations actually come from
Most BRAM and VIRP cases do not start with a merchant that looked dangerous at onboarding. They start with a merchant that looked clean and changed later, or one whose real business sat somewhere the onboarding team never looked.
| Risk pattern | How it hides | Control that catches it |
|---|---|---|
| Illegal goods on a clean storefront | Prohibited products appear after approval, often in new categories or subpages | Continuous content classification across the full site, not only the homepage |
| Hidden redirects | Declared URL is legitimate, checkout redirects to an undisclosed site | Redirect chain analysis on every scan |
| Miscoded gambling or pharma | Business declared under a low-risk MCC | MCC detection from site, social and review content, compared with the assigned MCC |
| Gated or members-only content | Prohibited material sits behind a login | Credentialed scanning of gated areas |
| Off-site selling | Merchant sells prohibited items through unlisted social profiles | Social media screening linked to the merchant record |
| Counterfeit and IP abuse | Brand names and logos used without rights | Counterfeit and brand-abuse detection with screenshot evidence |
The seven-control playbook
1. Define your risk appetite by MCC before you board anyone
Write down which MCCs you accept, which need enhanced due diligence and which you never accept. Map Visa's VIRP tiers (for example adult content, dating, gambling and card-absent pharmacy in Tier 1; crypto and cyberlockers in Tier 2; trading platforms and negative-option subscriptions in Tier 3) and Mastercard's specialty registration categories into that matrix. Every later decision depends on it.
2. Scan before the first transaction
Treat the MMSP scan as a gate in the onboarding workflow, not a parallel task. No scan result, no live MID. This is now the scheme expectation and the cheapest point to stop a bad merchant.
3. Look beyond the declared URL
The URL on the application is the merchant's best face. Check redirects, alternate domains, linked social accounts and marketplace stores. Portfolios built over years often contain thousands of merchant records with no URL at all, which means no monitoring coverage at all.
4. Monitor continuously, not quarterly
Merchants change after approval. Set monitoring frequency by risk tier and make sure it covers redirect URLs, new subpages and gated content. Alerts should trigger on product category changes, MCC drift, sudden traffic shifts and sites going inactive.
5. Make evidence a by-product, not a project
When a scheme notification arrives, the clock starts. Every scan should store timestamped screenshots, the redirect chain, the detected products and the decision taken. Keep scan reports unaltered. An acquirer that can show what it checked, when and what it did next is in a far stronger position in any assessment discussion.
6. Run a triage SLA with clear owners
Decide in advance who reviews an alert, how fast, and what the outcomes are: clear, request remediation, suspend or terminate. Updated scheme programs expect findings to be investigated and resolved within tight windows, so an alert queue nobody owns is a liability.
7. Close the loop on termination
When you terminate for cause, report correctly to MATCH or VMSS and feed the case back into your onboarding rules. The same operators often return under new names, new URLs and new legal entities.
The regional layer: schemes are only half the rulebook
Scheme rules are global. Regulators add local obligations on top, and in 2025 and 2026 several of them tightened.
- United Arab Emirates. Merchant acquiring is a licensed retail payment service under the CBUAE Retail Payment Services and Card Schemes Regulation. Federal Decree-Law No. 10 of 2025 replaced the previous AML law and raised maximum fines for legal entities to AED 100 million. The new Central Bank Law (Federal Decree-Law No. 6 of 2025) widened the licensing perimeter, with a compliance deadline of 15 September 2026.
- Saudi Arabia. The Law of Payments and Payment Services and its 2023 Implementing Regulations govern payment providers, and SAMA requires KYC verification before POS devices are activated.
- Türkiye. Under Law No. 6493, the Central Bank of the Republic of Türkiye revoked the licenses of several payment and e-money institutions in 2025 and 2026 over flows linked to illegal betting. The message to every acquirer and PSP is direct: merchant oversight is a license matter, not only a scheme matter.
How Onlayer sets this up with you
Technology alone does not prevent penalties. A working control framework does. Onlayer combines a Mastercard-certified MMSP platform with an implementation and advisory team that configures it around your portfolio, your risk appetite and your regulators.
The tools
- Merchant Onboarding Service with built-in BRAM and VIRP checks, prohibited product detection across 16 categories and MCC risk analysis before approval.
- BRAM / VIRP Checks that scan main domains and redirect URLs continuously, with timestamped evidence for audit trails.
- Merchant Monitoring Service for ongoing portfolio coverage across web, app, social and physical POS, with alerts on behavioral change.
- Online Presence Detection that matches up to 65% of URL-less merchant records to valid domains, closing monitoring blind spots.
- Automated Decision Engine that turns findings into consistent Pass, Pass with Notes or Fail outcomes with a full audit log.
The setup, in 90 days
- Days 1 to 30: Baseline. Our team runs a full portfolio scan, maps findings to BRAM and VIRP categories and agrees your MCC risk matrix with your compliance team.
- Days 31 to 60: Configure. We set monitoring frequency by risk tier, connect the pre-transaction gate to your onboarding flow and define alert routing and triage SLAs.
- Days 61 to 90: Operate. We run the first monitoring cycles with your analysts, tune false positives and hand over an evidence pack structure your team can use in any scheme or regulator review.
Clients using this model see BRAM and VIRP issues detected 70% faster and scheme-reported violations and penalty fines reduced by 60 to 80%.
Key takeaways
- BRAM and VIRP penalties fall on the acquirer, so merchant visibility is an acquirer responsibility.
- Scan before the first transaction, then monitor continuously, including redirects, gated pages and social channels.
- Evidence and triage discipline decide how a scheme notification ends.
- Local regulators in the UAE, Saudi Arabia and Türkiye now treat merchant oversight as a licensing issue.
Frequently asked questions
Who pays a BRAM fine, the merchant or the acquirer?
The scheme assesses the acquirer. Acquirers may pass costs to merchants contractually, but the compliance obligation and license exposure stay with the acquirer.
What is the difference between BRAM and VIRP?
BRAM is Mastercard's program for illegal and brand-damaging transactions. VIRP is Visa's program for high-integrity-risk merchant categories, with registration and control requirements by tier.
Do acquirers need to scan merchants before the first transaction?
Under Mastercard's updated Merchant Monitoring Program effective 1 January 2026, newly boarded merchants are expected to be screened by a registered MMSP before their first transaction.
How often should merchants be monitored?
Continuously, with frequency set by risk tier. Quarterly reviews miss merchants that change products, redirect checkouts or add gated content after approval.
What evidence should an acquirer keep?
Timestamped screenshots, redirect chains, detected products, MCC analysis and the decision taken, stored unaltered for every scan.
