Mastercard is introducing a significant evolution in how merchant fraud and risk are monitored across its payment ecosystem. With the retirement of the Acquirer Chargeback Monitoring Program (ACMP) and the introduction of the Global Merchant Audit Program (GMAP), the focus is shifting toward earlier detection, broader visibility, and greater accountability across the merchant lifecycle.
While the headline change is the transition from ACMP to GMAP, the implications extend far beyond a program name change. For acquirers, payment service providers (PSPs), marketplaces, and payment facilitators, GMAP represents a fundamental shift in how merchant risk is identified, monitored, and managed.
From Chargebacks to Broader Fraud Visibility
Historically, merchant monitoring programs have relied heavily on chargeback activity as a primary indicator of risk. While chargebacks remain an important signal, they often represent the outcome of fraudulent activity rather than the activity itself.
GMAP expands the scope of monitoring by incorporating fraud indicators that may never result in a chargeback. This broader visibility enables earlier identification of suspicious merchant behavior and allows risk teams to take action before fraud patterns become more costly and difficult to manage.
For payment providers, this means that fraud prevention can no longer rely solely on dispute data. Continuous visibility into merchant activity becomes increasingly important for identifying emerging risks before they escalate.
Accountability Extends Beyond Individual Merchants
One of the most notable aspects of GMAP is the expansion of accountability beyond the merchant level.
Under the new framework, monitoring is no longer limited to individual merchants. Acquirers and PSPs are also assessed at the portfolio (ICA) level, increasing the importance of risk governance across the entire merchant portfolio.
This change reflects a broader industry trend: merchant risk is no longer viewed as an isolated merchant issue. It is increasingly considered a portfolio-level responsibility that requires ongoing oversight, remediation processes, and effective merchant monitoring controls.
Lower Thresholds Mean Earlier Intervention
GMAP lowers the monitoring threshold from $50,000 to $10,000.
While this may appear to be a simple numerical adjustment, it significantly increases the ability to identify smaller but systematic fraud operations before they scale.
Fraudulent merchants often begin with relatively low transaction volumes before expanding their activities. By lowering the threshold, Mastercard aims to reduce the amount of time these merchants can operate undetected within the payment ecosystem.
For risk teams, this means that effective monitoring cannot be reserved only for high-volume merchants. Visibility across the entire portfolio becomes increasingly important.
Improved Visibility Through Submerchant Identification
The growing popularity of marketplaces, platforms, and payment facilitators has created new challenges for merchant monitoring.
Many platforms operate with thousands of sellers under a single Merchant ID (MID), making it difficult to identify individual bad actors.
GMAP addresses this challenge by shifting monitoring to the submerchant level when submerchant IDs are available. This approach provides greater transparency and enables more accurate identification of problematic sellers operating within larger ecosystems.
As platform-based business models continue to grow, submerchant-level visibility will play an increasingly important role in fraud prevention and compliance efforts.
Why Onboarding Matters More Than Ever
Perhaps the most important message behind GMAP is that effective merchant monitoring starts long before monitoring programs become involved.
A merchant's risk profile begins to form during onboarding. Hidden ownership structures, misleading business descriptions, unauthorized payment flows, suspicious digital footprints, or transaction laundering indicators can all create risks that may not become visible through transaction monitoring alone.
Organizations that identify these risks early are better positioned to prevent future compliance issues, fraud exposure, and dispute-related losses.
This is why merchant onboarding, website screening, transaction laundering detection, and continuous merchant monitoring are becoming increasingly important components of a comprehensive merchant risk strategy.
Preparing for the Future of Merchant Monitoring
GMAP reflects a broader shift across the payments industry toward proactive risk management.
Rather than focusing solely on the consequences of fraud, payment networks are increasingly emphasizing early detection, continuous oversight, and portfolio-level accountability.
For acquirers, PSPs, marketplaces, and payment facilitators, the organizations that adapt most successfully will be those that build visibility into the merchant lifecycle from day one.
Merchant risk management is no longer a periodic compliance exercise. It is an ongoing process that begins at onboarding, continues through monitoring, and ultimately supports a safer and more transparent payments ecosystem.
How Onlayer Supports GMAP Readiness
As Mastercard places greater emphasis on proactive merchant risk management, organizations need visibility across the entire merchant lifecycle—not just after a merchant begins processing transactions.
Onlayer helps acquirers, PSPs, marketplaces, and payment facilitators strengthen merchant oversight through onboarding risk assessments, continuous merchant monitoring, transaction laundering detection, and website risk intelligence. By identifying potential risks early and monitoring merchants continuously, organizations can improve compliance outcomes while reducing fraud and dispute exposure.
As a Mastercard-approved Merchant Monitoring Service Provider (MMSP), Onlayer supports payment organizations in building the visibility and accountability needed to adapt to evolving monitoring requirements, including those introduced through GMAP.
