Global Merchant Audit Program (GMAP)

The Global Merchant Audit Program (GMAP) is Mastercard's updated framework for monitoring fraud and dispute activity at both the merchant and acquirer level. Set to take effect on April 1, 2027, GMAP replaces the Acquirer Chargeback Monitoring Program (ACMP) and consolidates the existing Excessive Fraud Merchant (EFM), Excessive Chargeback Merchant (ECM), and High Excessive Chargeback Merchant (HECM) categories into a single program. It introduces four new dispute-focused categories and tightens chargeback thresholds over a multi-year schedule. GMAP measures combined fraud reports and non-fraud chargebacks, expanding the scope of what counts toward a merchant's or acquirer's monitoring status.

‍

‍

‍

Why GMAP Matters

‍

‍

Tighter Thresholds on a Fixed Schedule

GMAP phases down the ECM threshold from 1.5% to 0.9% between 2027 and 2031. Merchants and acquirers that currently operate near the existing ceiling will need to reduce dispute ratios before each step-down takes effect. The schedule is published in advance, but preparation requires changes to underwriting criteria, merchant monitoring cadence, and remediation workflows.

‍

Combined Fraud and Dispute Measurement

Previous programs measured fraud and non-fraud chargebacks separately. GMAP combines them into a single metric. A merchant with moderate fraud and moderate disputes could breach a threshold that neither category would have triggered on its own. This changes how acquirers need to assess portfolio risk. The shift is structurally similar to how Visa's VAMP consolidated fraud and dispute monitoring into a unified framework.

‍

Acquirer-Level Accountability

GMAP introduces two acquirer-level categories: High Dispute Acquirer (HDA) at 0.5% and Excessive Dispute Acquirer (EDA) at 0.7%. Acquirers that exceed these thresholds for 12 or more months face a mandatory franchisee review at their own expense. At 19 months, Mastercard may restrict or terminate the acquirer's license. This shifts monitoring from a merchant-level obligation to a portfolio-level one.

‍

‍

‍

How to Prepare for GMAP

‍

1. Map Your Current Portfolio Against the New Thresholds

Run your existing merchant base against GMAP's combined fraud-plus-dispute metric, not just chargeback ratios. Identify merchants that would trigger HDM (500+ basis points) or EDM (5,000+ basis points) status under the new measurement. Prioritize those closest to the ECM step-down thresholds scheduled for 2029 and beyond.

‍

2. Shift to Submerchant-Level Monitoring

GMAP monitors at the submerchant ID level when available, rather than the merchant ID level. Payment facilitators and acquirers with aggregated merchant accounts need submerchant-level visibility into fraud and dispute volumes to avoid being flagged at the portfolio level.

‍

3. Update Remediation Timelines

Merchants placed in a GMAP category must remain compliant for three consecutive months to exit the program. Build remediation plans that account for this sustained compliance requirement, not one-time corrections.

‍

4. Align Onboarding Criteria With Monitoring Standards

Merchants onboarded after January 1, 2026 must undergo an initial content or transaction laundering scan prior to processing their first transaction. Underwriting policies should reflect this requirement and include documented evidence of the scan.

‍

5. Prepare for Escalating Financial Exposure

GMAP assessments increase on a fixed monthly schedule. An EDM-flagged merchant faces monthly assessments that escalate from $5,000 in month one to $300,000 by month 19. At two consecutive months in EDM status, issuers gain recovery rights through reason code 4849 covering all fraud-related chargebacks from the prior three months plus the following six months.

‍

‍

‍

GMAP in Practice: A Real-World Scenario

‍

A mid-size acquirer processes transactions for 400 merchants across e-commerce, digital goods, and subscription services. Under previous monitoring, two merchants triggered ECM status based on chargeback ratios alone. Under GMAP's combined measurement, four additional merchants cross the HDM threshold when fraud reports from Mastercard's Fraud and Loss Database are added to their non-fraud chargebacks.

‍

The acquirer's own portfolio-level dispute ratio sits at 0.45%, just below the HDA threshold of 0.5%. One high-volume merchant with rising refund disputes could push the acquirer into HDA status, triggering a 12-month compliance clock.

‍

The acquirer responds by implementing submerchant-level monitoring, setting internal alert thresholds at 80% of each GMAP category, and building remediation workflows that target the three-consecutive-month compliance window required to exit the program.

‍

‍

‍

Strategic Impact on Payment Providers

‍

Financial Risk From Escalating Assessments

GMAP's assessment structure is steeper and faster than previous programs. EDM assessments reach $100,000 per month by month three and $300,000 by month 19. The extended issuer recovery rights under reason code 4849 create additional financial exposure that did not exist under prior frameworks. Early identification and remediation directly reduces total cost of non-compliance.

‍

Operational Shift to Portfolio-Level Monitoring

The introduction of acquirer-level categories (HDA and EDA) means that monitoring individual merchants is no longer sufficient. Acquirers need portfolio-wide visibility into combined fraud and dispute metrics, with the ability to identify which merchants contribute most to aggregate thresholds. This requires tooling that connects merchant-level data to portfolio-level risk oversight.

‍

Audit Readiness and Documentation

Mastercard may require a franchisee review for acquirers in non-compliance for 12 or more months. Documented evidence of monitoring processes, remediation actions, and merchant-level risk assessments becomes a requirement, not a best practice. Acquirers that rely on manual tracking or spreadsheet-based monitoring face operational risk during an audit.

‍

‍

‍

How Ballerine Supports GMAP Compliance

‍

Ballerine's merchant monitoring platform provides portfolio-level visibility into fraud and dispute metrics across the merchant lifecycle.

The system tracks combined fraud and chargeback data at the submerchant level, flags merchants approaching GMAP thresholds before they breach, and supports structured remediation workflows with audit-ready documentation.

As one of five solutions globally certified under Mastercard's MMSP, Ballerine helps acquirers and payment facilitators reduce scheme fines by up to 75% while maintaining continuous compliance with Mastercard's evolving monitoring requirements.

‍