High Excessive Chargeback Merchant (HECM)

The High Excessive Chargeback Merchant (HECM) designation is the most severe tier of Mastercard's Excessive Chargeback Program (ECP).

A merchant enters HECM status when 300 or more first-presentment chargebacks are recorded in a calendar month and the chargeback-to-transaction ratio reaches 3% or higher (300+ basis points). Both conditions must be met for two months to trigger enrollment.

HECM carries steeper penalties than the standard ECM tier, including monthly assessments up to $200,000, an Issuer Recovery Assessment of $5 per chargeback above 300, and accelerated risk of MATCH listing. HECM is part of the broader Acquirer Chargeback Monitoring Program (ACMP), which will be replaced by the Global Merchant Audit Program (GMAP) on April 1, 2027.

‍

‍

‍

Why HECM Matters

‍

The Steepest Penalty Curve in Mastercard's Programs

HECM monthly assessments follow an aggressive schedule: $1,000 in month two, $2,000 in month three, $10,000 per month in months four through six, $50,000 per month in months seven through eleven, $100,000 per month in months twelve through eighteen, and $200,000 per month from month 19 onward. The Issuer Recovery Assessment adds $5 per chargeback above 300 starting in month four. A merchant in HECM for 12 months accumulates over $300,000 in fixed assessments alone, before variable charges.

‍

Six-Month Minimum Before Tier Downgrade

Even if a merchant reduces chargebacks below the HECM threshold (300 count, 3% ratio), Mastercard requires a minimum of six months in the program before considering a downgrade to ECM. The merchant cannot exit directly from HECM to compliant status without first passing through the ECM tier's exit requirements. This means the fastest possible path from HECM enrollment to full program exit is approximately nine months under optimal conditions.

‍

MATCH Listing and Termination Risk

Merchants that remain in HECM without demonstrating sustained improvement face MATCH listing. Once a merchant is placed on the MATCH list, it is effectively excluded from obtaining Mastercard processing services with any acquirer in the network. For acquirers, a MATCH-listed merchant represents a relationship that should have been terminated earlier, and Mastercard's review of the acquirer's management of that merchant follows.

‍

‍

‍

How to Manage HECM Risk

‍

1. Treat HECM as an Emergency, Not a Monitoring Issue

A 3% chargeback ratio with 300+ chargebacks indicates a fundamental problem with the merchant's operations, product, or customer base. Standard remediation steps like descriptor updates or refund policy changes are unlikely to reduce a 3% ratio to below 1.5% (the ECM threshold) within the six-month minimum window. Conduct a full operational review before committing to a remediation plan.

‍

2. Evaluate Whether to Remediate or Terminate

Not every HECM merchant is salvageable. Calculate the total cost of continued association: monthly assessments, Issuer Recovery charges, internal remediation effort, and reputational risk. Compare this against the revenue the merchant generates. If the merchant's processing volume does not justify the compliance cost, termination may be the more defensible decision.

‍

3. Implement Transaction-Level Controls Immediately

While root cause analysis proceeds, apply immediate controls: daily chargeback monitoring, transaction velocity limits, hold periods for high-risk order types, and mandatory customer confirmation for recurring charges. These controls reduce incoming chargeback volume while longer-term fixes are developed.

‍

4. Plan for the Nine-Month Minimum Exit Path

HECM requires six months before downgrade consideration, then three consecutive months below ECM thresholds to fully exit. Build remediation milestones against this timeline. Month-over-month chargeback reduction targets should aim for ECM-level ratios (below 1.5%) by month four to create a buffer for the six-month review.

‍

5. Document Everything for Mastercard Review

HECM merchants receive heightened scrutiny from Mastercard. Document every remediation action, merchant communication, chargeback root cause analysis, and outcome. Acquirers that can demonstrate active, structured management of HECM merchants reduce the risk of adverse findings during Mastercard's review process.

‍

‍

‍

HECM in Practice: A Real-World Scenario

‍

A digital goods merchant processing 6,000 Mastercard transactions monthly records 380 chargebacks in March (6.3% ratio) and 420 in April (7.0% ratio). Both months exceed the 300-count and 3% thresholds, triggering HECM enrollment.

‍

The acquirer's investigation reveals that the merchant sells digital content with no delivery confirmation, and customers dispute charges by claiming they never received the product. The merchant has no purchase verification system and no customer support channel for resolving delivery issues before they become chargebacks.

‍

The acquirer implements a remediation plan: delivery confirmation emails with download timestamps, a 24-hour customer support response SLA, and a proactive refund policy for undelivered content. Chargebacks drop to 180 by month five (below 300 count) and the ratio falls to 2.1%. After the six-month minimum period, Mastercard downgrades the merchant to ECM. Three additional months of sustained compliance below 1.5% result in full program exit at month ten. Total assessments paid: $54,000.

‍

‍

‍

Strategic Impact on Payment Providers

‍

Disproportionate Financial Risk From a Small Merchant Cohort

HECM merchants are rare in most portfolios but create outsized financial exposure. A single merchant reaching month 19 costs $200,000 per month in assessments, plus variable Issuer Recovery charges. For acquirers managing thin margins, one unmanaged HECM case can offset the revenue contribution of dozens of compliant merchants.

‍

Portfolio-Level Monitoring and Early Intervention

HECM enrollment is preceded by ECM status in most cases. Acquirers with effective ECM management rarely see merchants escalate to HECM. The presence of HECM cases in a portfolio typically indicates gaps in merchant monitoring cadence, remediation enforcement, or willingness to terminate non-compliant merchants before they reach the upper tier.

‍

Acquirer Reputation and License Risk

Mastercard tracks which acquirers consistently have merchants in HECM. A pattern of HECM enrollments signals inadequate underwriting standards or insufficient ongoing monitoring. Under GMAP (effective April 2027), acquirer-level thresholds (HDA at 0.5%, EDA at 0.7%) formalize this accountability with direct financial penalties and license restrictions at the acquirer level.

‍

‍

‍

How Ballerine Supports HECM Management

Ballerine's merchant monitoring platform identifies merchants trending toward HECM thresholds and surfaces them for intervention at the ECM stage, before they escalate. The system tracks chargeback counts and ratios continuously, supports structured remediation workflows with milestone tracking, and maintains the audit-ready documentation required for Mastercard's review process. As one of five solutions globally certified under Mastercard's MMSP, Ballerine helps acquirers reduce scheme fines by up to 75% and manage high-risk merchants across the full compliance lifecycle.

‍