High risk MCC codes and what they trigger

Your MCC is a four-digit number that tells card networks what your business sells. It is assigned by your payment processor during underwriting and is based on your primary line of business. While there is no official 'high risk mcc code list' published by Visa or Mastercard, certain codes are universally treated as high-risk by acquirers due to higher historical rates of chargebacks, fraud, or regulatory scrutiny associated with them.

These categories include, but are not limited to, online gambling (7995), adult content (7273, 5967), travel agencies (4722), pharmaceutical and supplement sales (5912, 5499), debt and credit services (6051, 6012), and digital goods or subscription services (5815, 5816). If your business falls into one of these MCCs, you are automatically subject to more rigorous underwriting, stricter transaction monitoring, and less favourable commercial terms. The code is the primary filter; it sets the baseline for how every other part of your file is interpreted. It is the first decision that shapes the life of your merchant account.

Your acquirer assigns your MCC when they open your merchant account. This decision is not arbitrary; it is based on the business description, website, and supporting documentation you provide in your application. The acquirer has an obligation to the card schemes to code merchants accurately. Getting this wrong can expose them to fines and penalties, particularly if they are found to be deliberately miscoding a portfolio to avoid scheme-level risk monitoring programmes.

Transaction monitoring systems are designed to detect mismatches between your assigned MCC and your actual sales activity. For example, if you are coded as a bookstore (5942) but your average transaction value is £200 and you have a high volume of recurring payments, automated systems will flag your account for review. An analyst will then manually check your website and business model. If they discover you are actually selling high-ticket subscription coaching, your account will be terminated for misrepresentation. This is not a matter of 'if' but 'when'. Intentionally applying for the wrong MCC is a direct route to account closure and placement on the MATCH list.

Processing under a high-risk MCC comes at a higher cost. These fees are provider-specific and depend on your exact business model, but you can expect certain indicative terms. Blended processing rates for high-risk accounts typically range from 2.5% to 7% or more, compared to the 1-3% seen in standard-risk sectors. This reflects the acquirer's increased risk exposure.

A rolling reserve is also standard practice. Acquirers will hold a percentage of your settlement funds to cover potential future chargebacks. This is usually between 5% and 15% and is held for a rolling period, often 180 days. Settlement times may also be longer, with funds paid out on a T+3 or T+7 basis (three or seven days after the transaction), giving the provider a buffer to detect and hold fraudulent transactions. Finally, expect stricter processing volume caps. Your acquirer will set monthly limits on your sales volume and may require a manual review to increase them, limiting your ability to scale rapidly without clear communication and a proven track record of stable processing.

The most common reason for termination related to an MCC is miscoding. If an acquirer discovers you are selling goods or services that do not match your assigned code, they will almost always close your account immediately. This is considered a breach of your merchant agreement and a violation of card scheme rules. The provider's primary duty is to protect themselves from fines and penalties from the schemes, and knowingly allowing a miscoded merchant to operate puts their own licence at risk.

Beyond blatant miscoding, accounts are declined or terminated for activity that, while technically within the code's definition, is outside the acquirer's specific risk appetite. For example, some EEA-licensed acquirers will board supplement merchants (MCC 5499) but will not accept those selling CBD products, even though both can fall under the same code. Others may accept subscription businesses (MCC 5816) but draw the line at business models that rely on negative-option billing or aggressive marketing claims. Your account can also be terminated if your chargeback ratio exceeds the thresholds monitored by Visa and Mastercard's risk programmes, a common occurrence in many high-risk MCCs if not properly managed with tools like 3-D Secure and proactive fraud prevention.

A successful application for a high-risk MCC depends on transparency and comprehensive documentation. Instead of hiding the nature of your business, you must address the underwriter's concerns head-on. Your application file should provide a crystal-clear picture of what you sell, how you market it, and how you manage risk. This includes a fully compliant website with transparent product descriptions, clear terms of service, and easily accessible customer support details.

For businesses with multiple revenue streams that fall under different MCCs, the correct approach is not to pick the lowest-risk code but to seek multiple merchant accounts (MIDs). For instance, if you sell both physical books (a lower-risk activity) and high-ticket business coaching (a high-risk service), you should operate two separate MIDs. This allows the acquirer to apply the correct MCC, pricing, and monitoring rules to each revenue line, demonstrating transparency and preventing the riskier activity from jeopardising the entire account. A well-prepared file shows the underwriter that you understand the risks of your business model and have the controls in place to manage them effectively.

If your business operates under a high-risk MCC, a single merchant account is a single point of failure. Account terminations can happen suddenly, often with little warning, for reasons ranging from a spike in chargebacks to a shift in your acquirer's risk policy. To protect your business from this revenue-stopping event, you must build redundancy into your payment infrastructure. This means securing and maintaining relationships with at least two different payment providers.

These providers should ideally be based in different jurisdictions and have different underlying acquiring partners. For example, you might pair a UK FCA-authorised payment institution with a specialist domestic acquirer in the US, or a UAE-licensed PSP. This diversification ensures that a policy change or termination at one provider does not leave you unable to accept payments. Actively splitting your transaction volume between these accounts not only proves their value to the providers but also keeps both MIDs warm and ready to handle your full volume in an emergency. Preparing the compliance file for multiple providers is a significant upfront effort, but it is the only professional way to ensure business continuity in a high-risk industry. You can get started by preparing a file at xavioncapital.com/start.