Two rule changes are changing how your business gets classified and monitored. Visa's April 2026 Merchant Data Standards Manual lists MCC 7995 (betting, casino gaming, lottery) and MCC 6051 (non-financial institutions, foreign currency, crypto) among its high-integrity-risk codes.
And since 1 January 2026, Mastercard's Merchant Monitoring Program requires a content scan, gated and members-only pages included, before any newly onboarded merchant processes a single transaction.
What an MCC actually is
A Merchant Category Code is a four-digit number, defined under ISO 18245, that classifies a business by its primary goods or services. Your acquirer assigns it during onboarding, based on your business model, website, and licensing. It's not visible to you at checkout, but it drives interchange rates, chargeback thresholds, and how closely your account gets watched.
Why some MCCs carry more scrutiny than others
Card networks look at category-level history: fraud rates, chargeback ratios, and regulatory exposure across an entire category of business, not any one merchant within it. That's the part worth sitting with. A high-risk MCC is a statement about the category, not a verdict on you specifically.
Visa's current high-integrity-risk list includes MCC 7995 for betting and gaming, MCC 6051 for foreign currency and crypto-related activity, plus codes like 5912 (pharmacies) and 5122 (drug proprietaries) for certain card-absent transactions. These sit under the Visa Integrity Risk Program, which tiers merchants by how much harm could follow if controls fail, not by how well any individual merchant is actually run.
Mastercard's side: three separate mechanisms, often confused
Mastercard runs BRAM (Business Risk Assessment and Mitigation), which is content-based. It scans your website, including gated and password-protected areas as of the January 2026 update, for anything that breaches Mastercard's prohibited-content standards.
QMAP (Questionable Merchant Audit Program) is different. It's issuer-referred, triggered by suspected collusive or fraudulent transaction patterns rather than by content or category.
Both programs sit inside Mastercard's own rules manual, which isn't publicly available outside Mastercard Connect. (Treat the specifics here as directionally accurate rather than something you can verify firsthand, the way you can with Visa's public documentation above).
MCC classification is assigned at onboarding and can be flagged as miscoded if your actual activity doesn't match it. A merchant can have a clean BRAM record, no QMAP history, and still carry a high-risk MCC simply because of the category they operate in.
What a high-risk MCC actually changes
In practice, a high-risk MCC tends to bring:
- Higher interchange rates than standard categories
- Lower chargeback thresholds before a card network takes action
- Rolling reserve requirements from your acquirer
- More upfront scrutiny during onboarding, and ongoing content monitoring after
It's the network pricing in category-level risk before it happens, the same way an insurer prices a category before it prices an individual policy.
Category risk isn't business risk
A fully licensed operator processing legitimate volume can carry the exact same MCC as a business under active investigation, because the code describes the category, not the conduct.
We see this constantly with clients in gaming. A licensed operator can be moving billions a year in fully compliant, taxed volume and still sit under a high-risk MCC, because the market treats the category as high-risk regardless of the individual operator's standing. The MCC doesn't know the difference. The rest of your compliance picture, licensing, monitoring, transaction history, is what actually tells that story.
MCC self-assessment table
| MCC | Category | Network flag | What it typically means operationally |
|---|---|---|---|
| 7995 | Betting, casino gaming, lottery | Visa high-integrity-risk (Tier 1/2 under VIRP) | Elevated interchange, stricter chargeback monitoring, mandatory pre-registration with most acquirers |
| 6051 | Foreign currency, crypto, money orders | Visa high-integrity-risk | Enhanced onboarding scrutiny, rolling reserves common |
| 5912 | Drug stores, pharmacies | Visa high-risk for certain card-absent transactions | Applies mainly to online/card-absent sales; in-store retail typically unaffected |
| 5967 | Direct marketing, inbound telemarketing | Visa high-risk for card-absent transactions | Content and script monitoring, higher documentation requirements |
| 5999 | Miscellaneous retail | Standard | No elevated flags by default; still subject to standard BRAM/MMP content checks |
If your business sits in one of the flagged categories, don't worry too much about the code. What matters is whether your licensing, documentation, and monitoring can demonstrate the difference between category risk and your actual business risk.
Frequently asked questions
Which MCC codes are considered high risk?
Visa's current list includes MCC 7995 (betting and gaming) and MCC 6051 (foreign currency and crypto) among its high-integrity-risk codes, alongside a handful of others like 5912 and 5967 for specific card-absent transaction types.
What is MCC 6051 and 7995?
MCC 6051 covers non-financial institutions dealing in foreign currency, crypto, and money orders. MCC 7995 covers betting, casino gaming, lottery tickets, and wagers. Both sit on Visa's high-integrity-risk list.
Is there an approval requirement for high-risk MCCs?
Many acquirers require pre-registration or additional underwriting before approving a merchant in a high-risk category, and Mastercard's MMP now mandates a content scan before a newly onboarded merchant's first transaction.
What is a high-risk merchant?
A high-risk merchant is one operating in a category card networks associate with elevated fraud, chargeback, or regulatory exposure. It describes the category the business sits in, not necessarily how that specific business is run.