What Makes a Business High Risk? How Banks and Card Networks Decide

When you take a card payment, the acquiring bank (the bank that holds your merchant account) is on the hook if things go wrong. If a customer disputes a charge and you can't cover the refund, or you close up shop with orders unshipped, the bank pays. So before it approves you, an underwriter estimates how likely that is.

A high risk merchant is one where that estimate comes out higher than normal. The label isn't a judgment about you or your customers. It's a forecast of losses, and it drives how much review you get, what you pay and whether a reserve is held.

If you're asking "why is my business considered high risk?", the answer almost always falls into one or more of these three buckets:

Every merchant account is assigned a merchant category code (MCC): a four-digit code that tells the card networks what kind of business you are. Some codes carry extra rules. These are the closest thing to an official list of high risk credit card processing industries.

Mastercard: categories that must be registered

Mastercard requires the bank to register merchants in certain categories before it processes for them, and it charges an annual registration fee per merchant. As of Mastercard's Security Rules and Procedures manual dated August 4, 2026 (section 9.1), the categories include:

"Non-face-to-face" means sales made online, by phone or by mail. A registered category isn't banned. It means the bank has told Mastercard it knows what you do and is watching it.

Visa: High-Integrity Risk merchants

Visa has a similar program. Under the Visa Core Rules (April 18, 2026, section 1.9.5.1), a bank must register a High-Integrity Risk merchant with Visa before processing for it. The bank also needs Visa's approval, a financial review and daily monitoring. Visa keeps the list of covered MCCs in a program guide that isn't published for the U.S., so we don't reproduce a tier list here. It overlaps heavily with Mastercard's categories. Your bank can tell you whether your MCC is on it.

Categories banks treat as high risk without a network rule

Many businesses are never registered with Visa or Mastercard but still get flagged, because banks have their own risk policies. Common examples:

• Supplements and nutraceuticals: health claims, free-trial offers and high refund rates.
• CBD: state-by-state rules and changing federal treatment.
• Firearms and ammunition: licensing, age checks and banks' own policy choices.
• Travel: customers pay months before the trip, so a cancellation wave means large refunds.
• Subscriptions and memberships: forgotten renewals turn into disputes.

Every bank draws these lines a little differently. That's why one bank may decline you and another may approve you with no changes to your business.

Two businesses selling the same product can land in different risk tiers because of how they take payment. Underwriters look for:

• Card-not-present sales. Online, phone and mail orders have more fraud because the card isn't in front of you. Visa's chargeback monitoring now counts disputes against card-not-present sales. See how card-not-present fraud works.
• Future delivery. Pre-orders, event tickets, deposits and travel bookings. The longer the gap between charge and delivery, the more the bank has at stake if you can't deliver.
• Recurring or negative-option billing. Subscriptions, auto-renewals and "free trial, then billed" offers. Negative option means the customer is charged unless they cancel. It's a major source of "I didn't authorize this" disputes, and physical-product negative-option sellers are a Mastercard registration category.
• High average tickets. A $3,000 sale means a $3,000 chargeback. Large or sudden jumps in ticket size also look like fraud.
• International buyers. Cross-border sales carry more fraud and more currency disputes.

This is the part you control most. Underwriters check:

• Chargeback and fraud ratios. As of September 2026, Visa flags a merchant as "Excessive" when fraud reports plus disputes reach 1.5% of settled card-not-present transactions and at least 1,500 in a month (U.S., Canada, Europe and Asia Pacific; in effect since April 1, 2026). Mastercard's monitoring starts at 1.5% and 100 chargebacks a month. Our guide to chargeback ratio limits shows how each network does the math.
• Time in business. A new business has no processing statements to show, so the bank can't see how it behaves. Many start new merchants with lower limits or a reserve.
• Owner credit. A personal guarantee is common, so the owner's credit history is part of the file.
• Past terminations. If a bank closed your account for causes like excessive chargebacks, fraud or a PCI (card data security) failure, it may have added you to Mastercard's MATCH list. Listings stay for five years. Banks may still approve a listed merchant under Mastercard's rules, but it's a harder file. Read how the MATCH list works and how to get off it.

A low-risk product with a bad history can be high risk. A high-risk product with years of clean statements can get far better terms than a newcomer in the same category.

High risk means a provider will take you, with more review and different terms. Prohibited means that provider won't take you at all. Some providers also have a middle group, often called restricted: allowed only with extra approval.

There's no single industry-wide list. Each processor and bank writes its own. Stripe's is a good example because it's public. As of its restricted businesses list updated September 22, 2026:

• Prohibited on Stripe include adult content, debt relief, gambling, nutraceuticals and pseudo-pharmaceuticals, some travel (such as airlines, cruises and timeshares), telemarketing, negative-option subscriptions, multi-level marketing, and lending and credit.
• Restricted on Stripe (allowed only with approval) include CBD, cryptocurrency, tobacco and e-cigarettes (in the U.S., FDA-authorized products only), and legal firearms, which Stripe marks "limited availability" through its sales team.

That's Stripe's list only. Square, PayPal and every acquiring bank set their own, and they change often. Check the provider's current terms before you sign up, not after.

Payment apps like Stripe and Square are payment facilitators. They put thousands of small businesses under one master account, and they make sign-up fast by skipping most of the up-front review. You can often take payments within minutes.

The review happens later. Automated systems watch for restricted products, volume spikes and disputes. When one trips, the account can be paused or closed and funds held, even if you've done nothing wrong. Because these platforms serve mostly low-risk sellers, their tolerance for high-risk categories is low.

A dedicated merchant account works the other way round. The bank reviews your business before approval, knowing exactly what you sell, and prices the risk into your terms. It takes days instead of minutes, but you're far less likely to lose processing later when someone finds out what you sell. That's what a high risk merchant account is for. If an app has already closed you, see what to do after Stripe, Square or PayPal shuts you down.

You can't change your industry, but you can make your file easy to approve. These steps also tend to lower your chargebacks after you're live.

1. Publish clear website policies. Refund, shipping, cancellation and privacy policies, plus a phone number and address customers can find. Underwriters read your site. Our website requirements for accepting credit cards list what they look for.
2. Use an accurate billing descriptor. The descriptor is the name that shows on a customer's card statement. If they don't recognize it, they dispute it. Use your store name and, if possible, a phone number or web address.
3. Disclose every product and sales channel. List everything you sell and every way you sell it. A product found later is a common reason accounts get closed. Selling under the wrong MCC also breaks card-network rules and is one of the MATCH reason codes.
4. Bring clean processing statements. Three to six months of statements with low chargebacks is the best evidence you have. Explain any spike in a sentence or two before the underwriter asks. Our guide on how to get approved for a high-risk account has the full document list.
5. Turn on fraud tools. Address and security-code checks, velocity limits and order filters stop bad orders before they become chargebacks. Authorize.Net includes its Advanced Fraud Detection Suite. See our overview of fraud prevention tools.

Expect the risk label to show up in your pricing and possibly a reserve, where the bank holds back a share of sales for a set time. Our guide to high-risk rates, fees and rolling reserves explains what to question before you sign.

We have detailed guides for these industries, covering why each is treated as high risk and what underwriters ask for:

• Firearm merchant accounts
• Vape merchant accounts
• CBD merchant accounts

Don't see your industry? Tell us what you sell and we'll tell you where you stand.