Every business that accepts payments takes on risk. In the UK, over £629 million was stolen through payment fraud in the first half of 2025. Fraud, chargebacks, and regulatory missteps eat into a business's revenue. As a result, payment processors, banks, and financial institutions may consider a business as high-risk – and in some cases, levy fines or lock them out of payment processing. Some risks become obvious quickly, such as a surge in chargebacks or fraudulent transactions, or a business model that operates in legal grey areas. Others are more subtle, with patterns emerging only after the damage is done.

Managing merchant risk means understanding which risks are worth taking and those that can sink a business. Below, we'll explain how businesses can assess risk early and protect themselves from the main types of merchant risk.

What's in this article?

• What is merchant risk?
  
• What are the types of merchant risk?
  
• How is merchant risk assessed?
  
• How to manage merchant risk
  
• How Stripe Radar can help
  

What is merchant risk?

Merchant risk encompasses all the ways a business can be a financial or legal liability for a payment processor. It includes the risk that a business's transactions could lead to fraud, chargebacks, compliance issues, or reputational problems.

Being classified as high-risk isn't just a label – it comes with a real price tag. High-risk merchants typically face steeper per-transaction rates, added monthly or setup fees, and rolling reserve requirements to cover potential chargebacks. As a result, many high-risk businesses in 2026 face an effective processing fee of 3.5%–7% per transaction, above what a standard, low-risk merchant typically pays.

What are the types of merchant risk?

Different types of merchant risk include:

• Fraud risk: Some industries attract more fraud than others. A business that sells digital products, for example, might see more fraudulent purchases than a local coffee shop. If a company's transactions appear risky, a payment processor must carefully evaluate if it wants to do business with that company.

• Chargeback risk: When customers dispute charges, banks issue chargebacks, which cost businesses money. Too many chargebacks can put a business in a high-risk category or even shut down its account. Payment processors keep a close eye on businesses with high dispute rates to avoid financial losses.

• Regulatory risk: Payments are heavily regulated, and businesses have to follow rules around data security, fraud prevention, and AML. If a business isn't following the rules, the payment processor could be liable for fines or other penalties.

• Reputational risk: Some businesses operate in industries that are inherently risky, such as gambling and adult entertainment. A payment provider has to decide whether working with such a business could invite scrutiny or harm its reputation.

How is merchant risk assessed?

Merchant risk assesses whether a business is a safe bet for processing payments, or whether it's a potential liability. Payment processors, banks, and financial institutions carefully consider whether a business's revenue is sustainable and compliant, or whether it's likely to lead to fraud, chargebacks, or regulatory trouble.

Here's how they calculate merchant risk:

Industry risk

Some businesses are inherently riskier than others. Those with high chargeback rates, frequent fraud, or regulatory scrutiny are more likely to be flagged. For example, subscription services, adult content, travel, and CBD products tend to have more disputes and compliance challenges than low-risk categories such as food and beverages.

Other industries commonly in the high-risk category include firearms and ammunition retailers, nutraceuticals and dietary supplements, online gambling and casinos, vape and e-cigarette sellers, and timeshare or vacation-resale businesses – industries that combine higher-than-average dispute rates with tighter regulatory oversight.

Chargeback and fraud patterns

Excessive chargebacks are a warning sign. Mastercard flags merchants at a 1.5% chargeback ratio with 100+ chargebacks a month, and Visa's equivalent program (VAMP) changed to the same 1.5% threshold in April 2026, down from 2.2%.

High fraud rates from stolen cards, friendly fraud, or transaction laundering are also concerns. Subscription businesses are a common example: customers who forget they signed up, or don't recognise a recurring charge on their statement, often dispute it rather than cancel, which can push chargeback rates up quickly. A business with a history of chargeback issues or fraud exposure might need a mitigation plan (e.g., fraud prevention measures and better customer communication), or it might be considered too risky to onboard.

In serious cases, a terminated business can end up on the MATCH list – an industry-wide database that acquiring banks are required to check before approving any new merchant account. Banks add businesses to it after an account is shut down for reasons like excessive chargebacks, fraud, money laundering, bankruptcy, or ongoing Payment Card Industry Data Security Standard (PCI DSS) noncompliance. Once listed, a business's name, "doing business as" (DBA) names, and ownership details stay on file for five years, during which almost no processor will agree to open a new account – effectively locking the business out of accepting card payments altogether.

Business model and revenue stability

Businesses with large up-front payments but delayed fulfilment – such as travel agencies, custom manufacturing, or pre-orders – pose a higher risk. If something goes wrong, customers might not get what they paid for. Processors examine whether the revenue model creates future liabilities that could lead to mass refund requests or chargebacks.

Compliance and regulatory risk

Payments are heavily regulated, and processors have to make sure businesses aren't cutting corners. That means checking for PCI DSS compliance, adherence to KYC and AML rules, and any industry-specific regulations (e.g., cannabis businesses operating legally within state laws).

Firearms and ammunition retailers face similar federal licensing and state-by-state sales restrictions, while CBD and nutraceutical companies have to navigate FDA rules around which health claims they're allowed to make in marketing.

Card networks have also tightened their own oversight. For example, Mastercard's Business Risk Assessment and Mitigation (BRAM) program now requires a content scan before a high-risk merchant's first transaction. Visa's Integrity Risk Program sorts high-risk merchants into tiers with their own registration, monitoring, and fee requirements. If a business operates in a legal grey area, the processor has to decide if it's worth the risk.

Financial health and history

Processors want to know if a business is financially stable enough to handle refunds, disputes, and operating costs. A history of bankruptcies, sudden spikes in refunds, or negative press can signal instability. Financial statements, credit history, and operational history help demonstrate whether the business can withstand economic downturns or unexpected losses.

Business conduct red flags

If a business has a history of deceptive marketing, misleading subscription models, or legal disputes, that's a warning sign for processors. Multilevel marketing companies and timeshare resale businesses are common examples, as both have faced regulatory scrutiny and consumer complaints over how they present costs and obligations.

Some businesses run transactions for illegal sales through lower-risk accounts (i.e., transaction laundering), which can result in serious consequences for both businesses and payment providers. Processors look at customer complaints, reviews, and industry reputation to gauge whether a business operates fairly.

How to manage merchant risk

For businesses, managing merchant risk includes maintaining fraud prevention measures, keeping chargebacks under control, staying compliant, and taking on only liabilities they can handle. The right tools help businesses strike a balance between preventing bad transactions and not causing undue friction for real customers. These measures can also improve how processors and acquiring banks assess a business over time.

It's worth noting that a high-risk label isn't permanent. It's not a legal designation – it's a judgement processors and acquiring banks make based on the financial exposure a business represents. That judgement reflects both the business's industry and its track record, so a business that strengthens its practices and builds a cleaner operating history can eventually move into a lower-risk category.

The steps below can help businesses build that track record while preventing daily problems – all without negatively affecting the customer experience or slowing down operations.

Prevent fraud before it happens

Fraud is one way businesses lose money and credibility with payment providers. The best fraud prevention tools analyse patterns across broad networks of transactions to flag suspicious activity in real time. Stripe Radar, for example, assigns risk scores to transactions, blocks high-risk purchases, and applies extra authentication (e.g., 3D Secure) when necessary.

Monitor and respond to chargebacks

Chargeback monitoring tools track disputes in real time, flag patterns before they become a problem, and help businesses provide effective evidence. The goal isn't just resolving individual disputes – it's steadily bringing down your overall chargeback rate. Some tools let businesses preemptively issue refunds when they see a transaction that is likely to lead to a chargeback, which reduces the risk of getting hit with chargeback fees. A consistently lower chargeback rate keeps a business under card network thresholds, cuts monitoring and dispute fees over time, and gives processors clear evidence that the business is safe to keep working with.

Verify customers

KYC and AML regulations prevent fraud and financial crime. Compliance software automates customer verification, flags suspicious transactions, and generates the required reports for the authorities. This is especially helpful for industries under strict oversight, such as fintech, gaming, and anything involving high-value transactions.

Score risk before you onboard

Businesses can run their own risk check before a payment provider does. Payment providers and payments platforms use risk scoring to evaluate a business's financial stability, chargeback history, and overall risk level before approving it. Before applying for an account, pull together the same things a processor will look for – recent financials, chargeback and refund history, and a clear sense of how your industry is typically classified – so red flags can be addressed before they show up in a formal application. This helps platforms make better decisions about who they work with, and it helps payment processors avoid high-risk accounts that could become liabilities.

Negotiate your processing costs

High-risk merchant accounts often carry per-transaction fees, so processing many small transactions can cost more overall than processing fewer, larger ones. Consolidating orders or setting higher minimums where it makes sense for the business can reduce total fees. After a year or so of stable account history – low chargebacks, consistent volume, no compliance flags – many processors are open to renegotiating rates, since a proven track record lowers their risk. It's also worth working with a payment provider that specialises in your industry. They're equipped to price and support your specific risk profile, rather than treat it as an exception.

Control how and when you get paid

Payout management tools help reduce financial risk for businesses that handle large transactions, delayed fulfilment, or high refund rates. These tools can include reserves to cover potential chargebacks and losses, as well as payout schedules that adjust based on risk and prevent funds from being withdrawn before transactions are confirmed as legitimate. One common approach is a rolling reserve: the processor holds back roughly 5–10% of each transaction for 90–180 days before releasing it. Because this can meaningfully affect cash flow, businesses can build reserve holdbacks into their cash flow planning and negotiate lower percentages and shorter holding periods as their processing history improves.

How Stripe Radar can help

Stripe Radar helps detect fraud and unlock growth, using AI trained on data from Stripe's global network. Radar helps protect your business from fraud throughout the customer lifecycle before it affects your bottom line, while helping you approve more legitimate customers and payments.

Radar can help your business:

• Prevent fraud losses: Radar's AI learns from more than US$1.9 trillion in annual transactions across Stripe's global network, helping it identify and block fraud patterns that individual businesses might not catch on their own.

• Unify protection across evolving fraud attacks: Radar brings protection against transaction fraud, account fraud, and customer abuse all into one solution, so you gain unified protection across major fraud types.

• Adapt as fraud evolves: Radar continuously adapts to changing fraud patterns, from first-party abuse to agentic transactions, helping protect your business against emerging threats.

• Work with your existing tech stack: Use Radar with Stripe payments with no integration required, or access Radar's intelligence through programmable APIs, whether you process payments on Stripe or not.

Learn more about Stripe Radar or get started today.