High-Risk Merchant Categories: What Acquirers Should Review First

The Classification Problem

‍

Acquirers inherit high-risk category lists from scheme bulletins, internal policy documents, and historical convention. The problem is structural: these lists describe categories as they were understood when the policy was written, not as merchants operate today.

‍

A merchant registered under a general retail merchant category code might be running unlicensed pharmaceutical sales through its website. A digital goods reseller may have expanded into subscription gambling credits.

‍

A travel agency may have shifted entirely into ticket brokering with no verifiable supplier relationships. MCC meaning, in its technical sense, is straightforward: a four-digit code that identifies the registered business category of a merchant at the time of onboarding.

‍

What merchant category codes do not capture is what the merchant is actually selling, how their business model has evolved, or what their website shows a current visitor today.

‍

This is the central tension in high-risk merchant monitoring: the classification system is static, but merchant behavior is dynamic. Acquirers who rely on MCC-based lists alone are working with a snapshot that may be months or years out of date.

‍

‍

‍

How Card Schemes Define High-Risk Merchant Categories

‍

Visa and Mastercard both maintain program-level frameworks for identifying elevated-risk merchants, and both publish guidance connecting specific MCC codes to enhanced due diligence requirements. Mastercard's MATCH (Member Alert to Control High-Risk Merchants) program is the primary tool for acquirers to identify merchants with prior terminations before boarding.

‍

Acquirers are required to query MATCH before entering a merchant agreement, and a confirmed entry indicates prior termination for cause.

‍

Mastercard designates a set of high-brand-risk merchant category codes that require acquirer attention. These include:

• MCC 5912 (Drug stores and pharmacies)

‍

• MCC 5933 (Pawn shops)

‍

• MCC 7995 (Gambling transactions, betting, lottery tickets)

‍

• MCC 5816 (Digital goods)

‍

The critical limitation of this system is that merchant category codes reflect what a merchant reported at registration, administered by the acquirer at onboarding. They do not reflect what the merchant's current website shows, what products are listed for sale, or how transaction patterns have shifted post-approval.

‍

A merchant registered under MCC 5999 (miscellaneous retail) may be operating a nutraceuticals subscription business with aggressive negative-option billing, a billing structure that generates disproportionate chargebacks and consumer complaints. The code will still read 5999 until a review triggers reclassification, which may never happen absent a proactive monitoring program.

‍

‍

‍

‍

The Highest-Risk Categories Right Now

‍

Pharmaceuticals and Online Pharmacies

‍

Online pharmacies represent one of the most consistently high-risk categories for acquirers. The FDA's BeSafeRx program has issued over 2,400 warning letters to online pharmacies for unapproved drug sales, a figure that reflects the scale of non-compliant activity in this space.

‍

The registered code is typically MCC 5912, but many operators misclassify through miscellaneous retail or health supplement codes.

‍

Signals to monitor: absence of NABP (National Association of Boards of Pharmacy) or CIPA (Canadian International Pharmacy Association) accreditation, prescription-free drug listings, controlled substance terminology in product descriptions, and shipping availability to jurisdictions where the drugs are prohibited.

‍

Gambling and Online Betting

‍

Gambling is one of the most tightly regulated high risk business industries globally, and the regulatory landscape varies significantly by jurisdiction. The UK Gambling Commission's 2024 Annual Report reported a 15% increase in illegal gambling sites, a trend that directly affects acquirers who may unknowingly board unlicensed operators.

‍

MCC 7995 is the designated code, but operators running without licenses frequently register under generic entertainment or software merchant category codes.

‍

Signals to monitor: licensing documentation that does not match the operator's active user geography, crypto-only betting interfaces designed to obscure transaction routing, and newly registered domains offering betting functionality.

‍

Adult Content

‍

Both Visa and Mastercard maintain explicit acceptable use policies governing adult content platforms. These policies require age verification, consent documentation, and records of performer rights under 18 U.S.C. § 2257. The compliance obligations are specific, and the consequences of non-compliance include termination from scheme participation.

‍

Signals to monitor: absence of an age gate, AI-generated content without appropriate labeling, ambiguity in content category scope (platforms that start with legal content and expand into prohibited categories), and gaps in the performer documentation trail.

‍

Cryptocurrency and Digital Assets

‍

This is among the most rapidly shifting of all high risk business industries from a regulatory standpoint.

‍

VASP (Virtual Asset Service Provider) registration requirements under FinCEN and CASP (Crypto Asset Service Provider) obligations under the EU's MiCA (Markets in Crypto-Assets) regulation impose AML/CFT (Anti-Money Laundering / Combating the Financing of Terrorism) program requirements that many smaller operators have not yet implemented.

‍

Signals to monitor: unregistered exchange activity, token types that may qualify as securities under applicable law, inadequate AML/CFT program documentation, and jurisdictional mismatches between where the operator is incorporated and where users are transacting.

‍

Tobacco, Vape, and CBD

‍

Regulation in this category is fragmented across US states and EU member states. CBD legality varies depending on THC threshold and applicable jurisdiction. FDA and EFSA health claims rules prohibit specific representations without approved evidentiary support.

‍

Signals to monitor: unlicensed health claims on product pages, THC threshold language that implies compliance without documentation, and fulfillment capabilities that include shipping to restricted states or countries.

‍

Travel and Ticketing

‍

Travel merchants present a distinctive risk profile: advance payment structures, extended time between purchase and service delivery, and event-driven lifecycles that can result in a merchant appearing before a major event and becoming unreachable after it. High refund and dispute rates are structurally embedded in the category.

‍

Signals to monitor: vague or unverifiable supplier relationships, no physical presence that can be confirmed, newly registered domains carrying significant transaction volume, and refund terms structured to heavily favor the merchant over the consumer.

‍

Debt Collection

‍

Debt collection involves federal and state-level regulatory obligations, including FDCPA (Fair Debt Collection Practices Act) compliance and state licensing requirements that vary by jurisdiction. FTC and CFPB enforcement activity in this space has been consistent, and non-compliant collectors generate consumer complaint patterns that become visible in chargeback and dispute data.

‍

Signals to monitor: absence of state licensing documentation, FDCPA compliance indicators in consumer-facing communications, and elevated consumer complaint rates in public complaint databases.

‍

Nutraceuticals and Supplements

‍

Negative-option billing and subscription abuse are endemic in this category. The FTC has taken enforcement action against nutraceutical companies for unsubstantiated health claims and deceptive trial-offer structures that enroll consumers in recurring billing without clear disclosure. This is one of the high risk business industries where chargeback velocity functions as a primary early-warning signal.

‍

Signals to monitor: trial-offer structures where recurring billing terms are obscured, ingredient claims that require cross-checking against approved health claim databases, and sudden spikes in chargeback volume relative to transaction count.

‍

Weapons and Firearms

‍

Federal licensing requirements (FFL, Federal Firearms License) and state-level compliance obligations apply to merchants in this category. Card scheme network rules vary, and some acquirers exclude this category by policy regardless of licensing status.

‍

Signals to monitor: product catalog scope including accessories with compliance implications, FFL documentation currency, and jurisdictional shipping restrictions that the merchant may not be consistently enforcing.

‍

‍

‍

Why Merchant Category Codes Alone Are Insufficient

‍

Merchant category codes are a starting classification. They are not a verification of what a merchant is doing.

‍

Merchants self-report their category at onboarding, or are assigned a code by the acquirer based on the information provided at application. Post-approval, business activity drifts. A merchant registered under digital goods (MCC 5816) may expand into subscription billing, gambling credits, or adult content within eighteen months of approval.

‍

The registered code remains 5816 until a review triggers reclassification, which may never happen absent a proactive monitoring program.

‍

In high risk business industries specifically, category drift is common and consequential. The gap between what the MCC records and what the merchant's website shows is where acquirers accumulate undetected risk. That gap is visible only through active web presence review, transaction pattern analysis, and periodic requalification.

‍

A merchant's MCC is one signal from one point in time. Treating it as a current description of the merchant's activity produces systematic blind spots.

‍

‍

‍

A Practical Risk-Tiered Review Framework

‍

The framework below organizes high risk merchant categories by scrutiny level, review cadence, and escalation criteria. The goal is to direct monitoring resources toward the categories where drift, misclassification, and regulatory exposure are most consequential.

‍

Tier 1: Highest Scrutiny (Monthly or Continuous Monitoring)

‍

Applies to: pharmaceuticals, gambling, adult content, cryptocurrency.

‍

These categories carry the highest combination of regulatory complexity, scheme AUP obligations, and reputational exposure. Review at this tier covers:

‍

• Active licensing status against user geography

‍

• Scheme-specific acceptable use policy compliance

‍

• Web presence review for product and content category scope

‍

• Transaction pattern analysis for velocity anomalies and routing irregularities

‍

Escalation to termination review is warranted when: unlicensed activity is confirmed, prohibited content is detected, a MATCH entry is identified, or transaction patterns are materially inconsistent with the stated business model.

‍

Tier 2: Elevated Scrutiny (Quarterly Review)

‍

Applies to: tobacco/vape/CBD, nutraceuticals, travel and ticketing, debt collection.

‍

These categories carry structural chargeback risk, fragmented regulatory obligations, and business models that are prone to consumer harm patterns. Review at this tier covers:

‍

• Regulatory compliance documentation (state licenses, FFL, FDCPA indicators)

‍

• Chargeback ratio against program thresholds

‍

• Web content monitoring for claim language and billing disclosure

‍

• Supplier and fulfillment verification for travel merchants

‍

Escalation to Tier 1 is warranted when: chargeback rate breaches program threshold, consumer complaint volume increases significantly, or web review reveals licensing gaps or prohibited claim language.

‍

Tier 3: Standard Enhanced Due Diligence (Semi-Annual Review)

‍

Applies to: weapons and firearms, pawn shops, digital goods, miscellaneous high-MCC categories.

‍

Review at this tier covers:

‍

• Licensing documentation currency (FFL, state-level pawn licensing)

‍

• Product catalog scope for category expansion into higher-risk subcategories

‍

• Policy fit assessment against scheme and acquirer AUP requirements

‍

• MCC accuracy relative to current business activity

‍

Escalation to Tier 2 or Tier 1 is warranted when: product catalog expands into a higher-risk subcategory, licensing lapses, or activity patterns become inconsistent with the registered merchant category code.

‍

‍

‍

‍

Where MCC Lists End and Analysis Begins

‍

Risk teams that rely on merchant category codes alone are working with one signal from one point in time. What closes the gap is analysis of what the merchant is actually doing, read against the registered category and applicable scheme policies.

‍

This is where vertical-specific analysis becomes operationally relevant. Generic KYB (Know Your Business) workflows are not built to detect THC threshold language in a CBD product listing, identify missing 2257 performer documentation on an adult content platform, or flag a nutraceuticals merchant's subscription billing terms as structurally deceptive.

‍

Each of those determinations requires category-specific knowledge applied at the web presence level.

‍

Ballerine's high-risk vertical coverage addresses this through AI agents built specifically for each of the eight verticals where MCC misclassification and category drift are most consequential: pharmaceuticals, gambling, adult content, cryptocurrency, CBD, nutraceuticals, IP rights, and forex.

‍

Each agent reads merchant websites as a compliance reviewer would, identifying product types, billing structures, licensing signals, and content categories against the relevant regulatory and scheme requirements.

‍

Merchant monitoring in this framework is continuous, not periodic. A nutraceuticals merchant that adds an undisclosed subscription billing structure post-approval surfaces in continuous monitoring. It does not surface in a semi-annual manual review.

‍

For scheme compliance specifically, acceptable use policy detection maps what the merchant is doing against the relevant AUP requirements, identifying gaps before they become enforcement actions or scheme fines.

‍

The classification problem described at the start of this article does not resolve at the MCC level. It resolves when analysis keeps pace with what the merchant is actually doing.

‍

‍

‍

‍

About Ballerine

Ballerine is a risk intelligence platform built for acquirers and payment service providers. Its core function is AI-driven risk category detection that goes beyond merchant category codes: analyzing merchant websites directly, identifying product types and billing structures, and flagging mismatches between registered category and active business activity.

‍

The platform supports language-agnostic analysis of merchant websites across markets and provides structured high-risk vertical coverage across eight categories.

‍

Claim 5 free merchant risk reports at ballerine.com/wp-trial.

‍