November 2, 2026
On April 1, 2027, Mastercard replaces its chargeback monitoring with a new program called the Global Merchant Audit Program (GMAP). The biggest change is simple to state and hard to manage: fraud that never turns into a chargeback will now count against you. Mastercard will score merchants on reported fraud and disputes together, and merchants that score too high land in a High Dispute or Excessive Dispute group that can carry monthly assessments of up to $300,000.
This guide explains how Mastercard GMAP works, what it replaces, how the combined ratio is calculated, the merchant and acquirer thresholds, the fees and the retroactive liability, and how it compares with Visa VAMP. It also covers what acquirers, payment facilitators and merchants should fix before the first month counts.
| Item | What You Need to Know |
|---|---|
| Program name | Mastercard Global Merchant Audit Program (GMAP) |
| Effective date | April 1, 2027 |
| Basis | Mastercard bulletin GLB 14127.1 (July 28, 2026) |
| Replaces | Acquirer Chargeback Monitoring Program (ACMP) in its current form; ECM, HECM and EFM are carried into GMAP |
| New categories | High Dispute Merchant (HDM), Excessive Dispute Merchant (EDM), High Dispute Acquirer (HDA), Excessive Dispute Acquirer (EDA) |
| Primary metric | (Reported fraud + non-fraud chargebacks in the month) ÷ prior month's transactions |
| Fraud data source | Mastercard Fraud and Loss Database (FLD), replacing SAFE reporting |
| Merchant thresholds | HDM ≥5% and ≥$5,000 · EDM ≥50% and ≥$10,000; both need at least 5 cleared transactions |
| Acquirer thresholds | HDA ≥0.5% · EDA ≥0.7% (portfolio level, with activity floors) |
| Merchant fees | EDM: $5,000 in month 1, $25,000 in month 2, $100,000 a month from month 3, rising to $300,000 from month 19 |
| Retroactive liability | After 2 months as EDM: fraud chargebacks from the 3 months before identification and the 6 months after |
| Scope | Card-present and card-not-present; monitored at merchant ID or submerchant ID where populated |
| Exit | Three consecutive months below threshold |
| Runs alongside | Visa VAMP and Mastercard SMMP (scam merchants, in effect since July 24, 2026) |
GMAP scores reported fraud and disputes together. Fraudio flags fraudulent merchants weeks before the reports pile up, so the ratio never catches you off guard.
No setup fees · No contracts · ROI from day one
The Mastercard Global Merchant Audit Program (GMAP) is Mastercard's new framework for monitoring merchants and acquirers on fraud and disputes together. From April 1, 2027, it measures each merchant on a single combined count: transactions reported as fraud plus non-fraud chargebacks, compared with the previous month's sales. Merchants and acquirers that cross the thresholds are placed in a monitored group, pay escalating monthly assessments and can take on extra chargeback liability.
The name is not new. Mastercard ran an earlier Global Merchant Audit Program focused on fraud, and suspended it in October 2020. The 2027 version keeps the name but works very differently: it looks at fraud and disputes in one score, covers acquirers as well as merchants, and applies much heavier fees.
Under the old setup, fraud and chargebacks were measured in separate programs with separate thresholds. A merchant could have a high level of reported fraud that never became chargebacks and still stay out of the chargeback programs. GMAP closes that gap. It treats a fraud report as a signal in its own right, so the full picture of a merchant's risk shows up in one number.
The shift mirrors what Visa did with VAMP in 2025, when it combined fraud reports and disputes into a single ratio. For acquirers and payment facilitators that process both card brands, it means two scheme programs now judge their portfolios on combined fraud and dispute data.
GMAP replaces the Acquirer Chargeback Monitoring Program (ACMP) in its current form. The existing programs inside it do not disappear; they are carried into GMAP and sit alongside the new categories:
| Program | What It Covers | Status Under GMAP |
|---|---|---|
| ECM | Excessive Chargeback Merchant: chargeback count and ratio | Carried forward, with a ratio that tightens from 2029 |
| HECM | High Excessive Chargeback Merchant: the higher ECM tier, from 300 basis points | Carried forward |
| EFM | Excessive Fraud Merchant: fraud levels on card-not-present activity | Carried forward |
| HDM / EDM | New merchant tiers on combined fraud and non-fraud disputes | New from April 1, 2027 |
| HDA / EDA | New acquirer tiers on portfolio-level fraud and disputes | New from April 1, 2027 |
Two technical changes come with it. Fraud reporting moves from Mastercard's SAFE system to the Fraud and Loss Database (FLD), and monitoring moves down to the submerchant ID wherever one is populated in clearing messages. For payment facilitators, that second change matters: a single risky sub-merchant can now be identified on its own instead of being averaged into the master merchant's numbers.
The GMAP ratio for HDM and EDM is calculated monthly as:
(Transactions reported as fraud this month + non-fraud chargebacks this month) ÷ transactions in the previous month
Three details change how this behaves in practice:
A merchant has to meet all of the criteria for a tier at the same time: the transaction floor, the dollar floor and the ratio. A merchant with very low volume will not be identified on the ratio alone.
| Category | Cleared Transactions | Combined Fraud + Disputes | Ratio |
|---|---|---|---|
| High Dispute Merchant (HDM) | 5 or more | $5,000 or more | ≥500 bps (5%) |
| Excessive Dispute Merchant (EDM) | 5 or more | $10,000 or more | ≥5,000 bps (50%) |
After two months above the HDM threshold, Mastercard may alert issuers about the merchant. That alone can lower approval rates, because issuers become more cautious with transactions from a merchant they have been warned about.
Acquirers are measured across their whole Mastercard portfolio, identified by ICA. The thresholds are:
| Category | Activity Floor | Ratio |
|---|---|---|
| High Dispute Acquirer (HDA) | At least 1,500 cleared transactions and 1,500 fraud reports or chargebacks | ≥50 bps (0.5%) |
| Excessive Dispute Acquirer (EDA) | Same floors as HDA; card-present and card-not-present assessed separately | ≥70 bps (0.7%) |
These are the same levels Visa uses for acquirers under VAMP, which tells acquirers where both schemes now expect portfolio fraud and disputes to sit.
The Excessive Chargeback Merchant program keeps its 100-chargeback minimum, but the ratio floor comes down in steps:
| Year | Chargeback Count | ECM Ratio Floor |
|---|---|---|
| 2027 | 100 or more | 150 bps (1.5%) |
| 2028 | 100 or more | 150 bps (1.5%) |
| 2029 | 100 or more | 130 bps (1.3%) |
| 2030 | 100 or more | 110 bps (1.1%) |
| 2031 | 100 or more | 90 bps (0.9%) |
That is a 40% reduction by 2031. Merchants planning their chargeback controls should treat 90 basis points as the long-term target, not 150.
Mastercard bills its licensed customers, so assessments land on the acquirer first and are usually passed through to the merchant. The monthly schedule, by month of identification, is:
| Month Identified | High Dispute Merchant | Excessive Dispute Merchant |
|---|---|---|
| 1 | $0 | $5,000 |
| 2 | $0 | $25,000 |
| 3–6 | $0 | $100,000 |
| 7–11 | $5,000 | $100,000 |
| 12–18 | $10,000 | $200,000 |
| 19 onward | $25,000 | $300,000 |
These assessments are separate from per-case costs such as dispute administration fees.
HDA and EDA have their own escalating schedules. EDA assessments start at $0 for the first two months and then rise in steps, from $10,000 a month to $100,000 a month for long-running cases. Prolonged non-compliance can lead to a Franchise Management Program review and restrictions on the acquirer's Mastercard license.
This is the part of GMAP that can cost more than the fees. Once a merchant has been in the Excessive Dispute group for two months, issuers can use reason code 4849 to charge back fraud on transactions from the three months before identification, and on fraudulent transactions for the six months after. A merchant that ignores the first warnings can end up paying for fraud it thought was already closed.
A merchant or acquirer leaves the program after three consecutive months below the thresholds. The audit then closes and the counter resets.
Fraud reports and disputes now land in one ratio. Fraudio scores every transaction and tracks merchant behavior in real time, before either number moves against you.
No setup fees · No contracts · ROI from day one
The headline thresholds look generous. A 5% ratio for HDM and 50% for EDM seem far from where most merchants operate. In practice, several features of GMAP push merchants closer to the line than they expect.
Many low-value fraud cases are reported by issuers but never charged back. Until now, they barely affected a merchant's standing. Under GMAP, every one of them counts in the ratio and toward the dollar floor.
A combined score is only as good as the data behind it. Most teams keep fraud reports and chargebacks in different systems, often across different processors. If you cannot calculate a combined fraud and dispute figure today, across every processor you use, you will find out your position only when your acquirer tells you.
Because the ratio uses the previous month's transactions, a drop in volume raises the ratio on its own. Seasonal businesses, merchants that pause campaigns and merchants that lose a large customer can cross a threshold without any change in fraud.
Unlike Visa VAMP, which covers only card-not-present transactions, GMAP includes card-present activity. Omnichannel merchants and acquirers with large in-store portfolios cannot ignore it.
Acquirers carry portfolio-level thresholds of 0.5% and 0.7%, plus the fees and license risk that come with them. Many will set stricter limits for individual merchants than Mastercard does, and will act earlier.
GMAP and Visa VAMP follow the same idea: fraud and disputes in one number. The details differ in ways that matter for anyone processing both brands.
| Mastercard GMAP | Visa VAMP | |
|---|---|---|
| Start | April 1, 2027 | April 1, 2025 (enforced from October 1, 2025) |
| What counts | Reported fraud (FLD) + non-fraud chargebacks | TC40 fraud reports + TC15 disputes |
| Denominator | Previous month's transactions | Same month's settled CNP transactions |
| Channels | Card present and card not present | Card not present only |
| Merchant thresholds | HDM 5% and $5,000; EDM 50% and $10,000 | Excessive 1.5% in NA, EU, AP; 2.2% elsewhere |
| Acquirer thresholds | HDA 0.5%; EDA 0.7% | Above Standard 0.5%; Excessive 0.7% |
| Fees | Flat monthly assessments, up to $300,000 for EDM | Per transaction: $4 to $8 |
| Extra liability | Retroactive fraud chargebacks after 2 months as EDM | Fees and remediation; no retroactive window |
For acquirers, the practical lesson is that portfolio fraud and dispute levels around 0.5% to 0.7% are now the line for both schemes. Mastercard's separate Scam Merchant Monitoring Program (SMMP), in effect since July 24, 2026, adds a third layer focused on scam merchants, with a 72-hour investigation window.
GMAP puts acquirers on the hook for portfolio performance in the same way VAMP does. One high-risk merchant can push an acquirer toward HDA or EDA, and the fees and license risk then sit with the acquirer.
Mastercard is also tightening its Questionable Merchant Audit Program (QMAP) on the same date: the minimum transaction volume for a case drops from $50,000 to $10,000, the standard case scope period falls from 120 days to 30 days, and the rule that limited non-bust-out cases to merchants under six months old is removed, so established merchants are now in scope. Together with GMAP, that makes fraudulent merchants much easier for Mastercard to catch, and much more expensive for the acquirers that board them.
April 1 is about five months away. The cheapest time to fix the data is before the first month counts.
Pull reported fraud and chargebacks from every processor into one view and calculate the GMAP ratio yourself, against the previous month's volume. If you cannot do that today, that is the first gap to close.
Monthly reports tell you where you were, not where you are heading. Acquirers and PayFacs need merchant-level monitoring that flags a change in behavior as it happens. Fraudio's merchant-initiated fraud detection flags fraudulent merchants weeks before chargebacks arrive, which gives you time to act before a merchant reaches HDM or EDM.
Every fraudulent transaction that clears becomes a potential fraud report. Real-time payment fraud scoring at authorization reduces the number of reports in the first place, the only lever that lowers the fraud half of the numerator directly. See how Fraudio approaches payment fraud prevention.
Clear descriptors, refund policies, order confirmations and pre-dispute alerts reduce non-fraud chargebacks, the other half of the GMAP numerator.
Because the denominator is last month's sales, model what happens to your ratio when volume drops. Merchants with seasonal peaks should know their safe margin before the quiet months.
Your acquirer may apply stricter thresholds than Mastercard. Get its numbers, and its escalation process, in writing before April.
Fraudio gives acquirers, payment facilitators and PSPs real-time transaction scoring and merchant-level monitoring in one platform. Our centralized AI learns from data across the whole network, flags fraudulent merchants weeks before chargebacks arrive and integrates in 3 to 14 days, with no setup fees.
If you want to know where your portfolio would sit under GMAP, request a Proof of Results test on your own historical data.
Both schemes now judge your portfolio on fraud and disputes together. Fraudio gives you that view in real time, across every merchant.
No setup fees · No contracts · ROI from day one
Mastercard GMAP, the Global Merchant Audit Program, is Mastercard's new fraud and dispute monitoring program for merchants and acquirers, taking effect on April 1, 2027. It combines transactions reported as fraud with non-fraud chargebacks in one ratio against the previous month's sales. Merchants and acquirers above the thresholds pay escalating monthly assessments and can face extra chargeback liability.
Mastercard GMAP starts on April 1, 2027. On that date it replaces the Acquirer Chargeback Monitoring Program (ACMP) in its current form, carries the ECM, HECM and EFM programs forward, and adds the new High Dispute and Excessive Dispute categories for merchants and acquirers.
The GMAP ratio is the number of transactions reported as fraud plus non-fraud chargebacks in a month, divided by the number of transactions in the previous month. Reported fraud counts even when no chargeback is filed. A merchant must also meet a minimum transaction count and a dollar floor before a tier applies.
A High Dispute Merchant has at least 5 cleared transactions, $5,000 or more in combined fraud and disputes, and a ratio of 5% or more. An Excessive Dispute Merchant meets the same transaction floor with $10,000 or more and a ratio of 50% or more. All criteria must be met at once.
Excessive Dispute Merchant assessments are $5,000 in the first month, $25,000 in the second, and $100,000 a month from the third, rising to $300,000 a month from month 19. High Dispute Merchant assessments start after six months at $5,000 and rise to $25,000 a month. Acquirers usually pass these costs to the merchant.
Yes. Under GMAP, a transaction reported as fraud to Mastercard's Fraud and Loss Database counts toward the ratio even if the cardholder or issuer never files a chargeback. This is the main difference from Mastercard's previous chargeback programs, which looked mainly at chargebacks.
Both combine fraud and disputes in one ratio, but GMAP covers card-present and card-not-present activity while VAMP covers card-not-present only. GMAP uses the previous month's transactions as the denominator, charges flat monthly assessments instead of per-transaction fees, and adds retroactive fraud liability for Excessive Dispute Merchants.
Acquirers and payment facilitators should calculate a combined fraud and dispute ratio for every merchant today, across all processors, and monitor it in real time at merchant and submerchant level. Stopping fraud at authorization, reducing non-fraud disputes and agreeing limits with the acquirer before April 1, 2027 reduce the risk of entering a GMAP tier.
How about trying our solution and experiencing the next generation for yourself?
