Mastercard GMAP: Launching its own version of VAMP
Industry
Updated 31 Jul 2026
6 min
Valentyna Mahdenko
Risk Analyst, Solidgate
Mastercard is launching GMAP in April 2027. Know the thresholds, what triggers identification, and how to stay clear before enforcement starts.
Mastercard has announced the Global Merchant Audit Program (GMAP) – its answer to Visa's – effective April 1, 2027. GMAP monitors every Mastercard merchant and acquirer for fraud and dispute activity, including fraud that never resulted in a chargeback.
The programs are distinct, but the trend is consistent. Both Visa and Mastercard are tightening fraud and dispute monitoring at the merchant and acquirer level – and placing more accountability on both.
This article covers how Mastercard GMAP measures performance, the new thresholds, what triggers identification, how the legacy programs migrate in, and how to stay clear.
TL;DR
- GMAP replaces Mastercard's Acquirer Chargeback Monitoring Program and folds EFM, ECM, and HECM into one framework that scores fraud and disputes together.
- Mastercard measures performance monthly, comparing combined fraud (as reported to the Fraud & Loss Database) and non-fraud chargebacks against the previous month's sales – including fraud that never resulted in a chargeback.
- New tiers add High and Excessive Dispute Merchant levels for merchants, plus High and Excessive Dispute Acquirer levels for acquirers.
- Acquirers are held accountable at a low 0.5% threshold; merchants face higher thresholds, issuer alerts and fraud-liability shift on top of potential assessments.
- Exit requires staying below both thresholds for three consecutive months.
How Mastercard GMAP measures fraud and disputes
GMAP combines two signals Mastercard used to track separately – confirmed fraud and non-fraud disputes – into one monthly performance score.
The calculation looks like this:
Fraud is now reported to the Fraud and Loss Database (FLD), replacing the SAFE system.
GMAP thresholds for merchants and acquirers
GMAP monitors performance at two levels: the merchant and the acquirer. At the merchant level, Mastercard identifies the account by its merchant ID. At the acquirer level, it monitors the acquirer's ICA.
Mastercard GMAP introduces two new merchant tiers:
- High Dispute Merchant (HDM) – flags merchants with elevated combined fraud and dispute levels.
- Excessive Dispute Merchant (EDM) – flags merchants with sustained, severe levels requiring immediate attention. EDM applies once combined fraud and disputes reach 50% of the prior month's sales.
And two new acquirer tiers:
- High Dispute Acquirer (HDA) – flags acquirers with elevated fraud and dispute levels across their merchant portfolio.
- Excessive Dispute Acquirer (EDA) – flags acquirers with sustained, excessive portfolio-level concerns. Mastercard evaluates card-present and card-not-present activity separately at this level.
Assessments escalate the longer an audit stays open, and each tier carries its own schedule.
Сore insight: Mastercard GMAP introduces four tiers – two for merchants, two for acquirers – with assessments that escalate the longer an audit stays open.
What GMAP identification means, and how to exit
For acquirers, GMAP consequences are primarily assessments – escalating the longer a portfolio stays above the threshold. The entry point is low: acquirers are flagged at 0.5% combined fraud and disputes, while merchants trigger HDM at 5%.
That gap means acquirers feel pressure well before their merchants do – and it's up to each acquirer to decide what controls they extend to their portfolio.
For merchants, assessments are also in place – they depend on the tier and how long an audit remains open. But they may not turn out to be the sharpest consequences.
After two months above the HDM threshold, Mastercard may alert issuers – which can pull down . After two months above the EDM threshold, the merchant becomes liable for all fraud-related chargebacks: transactions from the three months before identification and all fraudulent transactions in the six months that follow.
Unlike VAMP, where Visa focuses on fees, Mastercard's pressure comes from issuer visibility and fraud-liability shift. A merchant identified under EDM doesn't just pay fines – it absorbs fraud losses that otherwise could have been represented.
A merchant or acquirer exits by staying below both thresholds for three consecutive months. Once maintained, the audit closes and the counter resets.
Core insight: Acquirers are flagged at 0.5% – well below the 5% HDM threshold for merchants. That gap puts acquirers under pressure first, and they will pass it down to their portfolios.
How GMAP relates to ACMP, ECM, HECM and EFM
GMAP is the evolution of Mastercard's Acquirer Chargeback Monitoring Program (ACMP). Mastercard is retiring ACMP in its current form and migrating its merchant programs into the new framework.
The three existing programs move in directly. The (EFM), (ECM), and High Excessive Chargeback Merchant (HECM) programs all become part of GMAP. Open EFM, ECM, and HECM audits carry over, and their counts do not reset in the move.
Monitoring shifts to the submerchant ID where one is populated. This changes the exposure for payment facilitators and aggregators. Mastercard assesses individual submerchants on their own record, so an aggregator's volume no longer masks a single problem seller.
The ECM threshold also tightens over time. Starting in 2029, the chargeback rate threshold drops in stages – from 1.5% today to 0.9% by 2031. The chargeback count requirement stays at 100 or more.
Core insight: If you're already in an EFM, ECM, or HECM audit, GMAP doesn't give you a clean slate – your count carries straight over into the new framework.
A quick word on QMAP
Mastercard is also tightening the Questionable Merchant Audit Program (QMAP), which handles issuer-referred investigations into merchants suspected of collusive or deceptive activity.
The changes make it faster and wider – lowering the bar for what triggers an investigation and shortening the window in which Mastercard evaluates merchant activity. The goal is to catch smaller, faster-moving fraud schemes that slipped past the old criteria.
Key updates:
- Minimum transaction volume for a case drops from USD 50,000 to USD 10,000
- Standard case scope period drops from 120 days to 30 days
- Non-bust-out merchant criteria are updated
GMAP provides ongoing monitoring of Merchant and Acquirer performance using fraud and dispute indicators, while QMAP focuses on issuer-referred investigations of Questionable Merchants.
Core insight: Together, the programs help Mastercard identify deceptive activity across a broader range of fraud patterns and timeframes.
How to prepare for Mastercard GMAP
Strong dispute and fraud practices are what keep a merchant clear of GMAP tiers.
Stop disputes before they reach Mastercard
The fastest way to stay clear of GMAP thresholds is to stop disputes before sees them.
Turn on to get notified when a cardholder contacts their bank – and resolve the dispute directly before it becomes a formal chargeback.
For payments you're certain are fraudulent, refund immediately. A fast refund removes both the chargeback and the fraud report before they land on your record.
Keep your fraud metrics clean
GMAP counts confirmed fraud even when it never resulted in a chargeback – so your fraud rate is as important as your dispute rate. The most common source of fraudulent activity that inflates this metric is enumeration attacks, where fraudsters test card details at scale.
blocks enumeration using ML risk models and device fingerprinting with almost no impact on legitimate customers.
Communicate clearly with customers and stay in touch with your acquiring bank
Unclear terms and unrecognized charges are among the most common drivers of avoidable disputes. Keep your refund, cancellation, and subscription policies transparent and easy to find – and make your billing descriptor recognizable so customers don't dispute charges they simply don't recognize.
On the acquirer side, stay in regular contact. Your acquirer sees your fraud and dispute metrics across their portfolio and can flag performance concerns before they become an audit trigger.
For more detail on how Mastercard's monitoring programs work, see our.
Frequently asked questions
GMAP is Mastercard's Global Merchant Audit Program, a monitoring framework that identifies merchants and acquirers with elevated fraud and dispute activity. It combines confirmed fraud and non-fraud disputes into one performance view and takes effect on April 1, 2027, replacing the Acquirer Chargeback Monitoring Program.
GMAP sets tiers for merchants and acquirers. Merchants can be identified as High Dispute Merchant or Excessive Dispute Merchant based on combined fraud and dispute levels against the prior month's sales. Acquirers face High Dispute Acquirer and Excessive Dispute Acquirer tiers, with card-present and card-not-present activity judged separately. The rates for High Dispute tier at Acquirer and Merchant level are 0.5% and 5%, respectively.
The programs remain distinct. Each has its own metrics, thresholds, and implications. What they share is a broader goal: both Visa and Mastercard are moving toward monitoring models that reinforce network integrity and hold merchants and acquirers accountable for fraud and dispute performance.
The Excessive Chargeback Merchant (ECM), High Excessive Chargeback Merchant (HECM), and Excessive Fraud Merchant (EFM) programs migrate into GMAP. Open audits carry over without resetting their counts. Monitoring moves to the submerchant ID where populated, and ECM thresholds tighten in stages from 2029 through 2031.
The revised GMAP and QMAP standards become effective on April 1, 2027. The phased ECM threshold reductions begin later, rolling out across 2029, 2030, and 2031.
