Visa Integrity Risk Program (VIRP)

Also called VIRP, Visa Integrity Risk Program, formerly GBPP

Visa's registration and oversight program for merchant categories that could facilitate illegal activity, in force since April 1, 2024.

What it is

The Visa Integrity Risk Program replaced the Global Brand Protection Program effective April 1, 2024, shifting the framing from brand damage to integrity risk, meaning merchants whose activity could facilitate illegal conduct. It operates through the acquirer: covered merchants must be registered by the acquirer with Visa, and the acquirer takes on specific diligence obligations. Covered categories are tiered by scrutiny. Tier 1 is reported to include dating services, online gambling and sports betting, and pharmaceuticals and weight loss. Tier 2 includes crypto trading platforms, online storage and skill-based gaming. Tier 3 includes trading platforms, telemarketing, negative-option billing and tobacco. Review cycles run in April and October. The costs are real and get passed to the merchant. Registration is reported at 950 dollars per acquirer-merchant registration, raised from 500 dollars on April 1, 2024, with an integrity risk assessment reported at roughly 10 cents per transaction plus about 10 basis points on processed volume for covered categories. Mastercard runs a parallel registration reported at roughly 500 dollars per year per acquirer. Acquirer obligations reported under the program include website compliance review, verification of legality in each jurisdiction served, anti-trafficking controls, prevention of underage participation, and maintaining documentation available on Visa's demand. Categories that commonly require registration include CBD and cannabis-adjacent, adult, nutraceuticals and supplements, firearms and ammunition, travel, gaming, subscription and continuity billing, crypto, telemarketing and tobacco.

Why it matters to your business

If your business is in any covered category, expect registration fees and per-transaction assessments to appear in your pricing, and expect a slower, more documented underwriting process. That is not a processor being difficult; it is a network program with published obligations attached. The important defensive point: if a salesperson offers to get you approved by coding your business as something it is not, that is not creative underwriting. It puts your funds, your account and potentially your legal position at risk, and it is the fastest route to a five-year MATCH listing. This is education, not legal advice. Whether your business is lawful in a given jurisdiction is a legal question for your own counsel, not a payments question.

Where it gets contested

The obvious tension is that a private network is making legality determinations across jurisdictions, and doing so through commercial pressure on acquirers rather than through law. Businesses that are legal where they operate can find themselves unbankable because a network category places them in a tier and a fee structure that no small acquirer wants to administer. GLP-1 telehealth is the live 2026 flashpoint, sitting at the intersection of pharmaceuticals and weight loss in the highest scrutiny tier while being an entirely lawful business in most of the country. Firearms retail is the mirror image, where state legislatures have pushed back directly. Florida is among the states that enacted a 2023 law barring financial institutions from requiring the firearms merchant category code, after all four networks paused implementation of that code in March 2023. The gray area is miscoding. When a merchant cannot get boarded honestly, someone offers to board them under a different category. That is transaction laundering, it is a listed MATCH reason, and it exposes the merchant and the agent to consequences well beyond a terminated account.

How to check it yourself

Ask any prospective processor directly whether your business requires VIRP registration, what the registration fee is, and what the per-transaction integrity risk assessment will be on your statement. Get all three in writing before you sign.

Receipts

Claims above that are checkable, with where to check them. Published so you do not have to take anyone's word for it.

VIRP replaced the Global Brand Protection Program on April 1, 2024, with tiered categories, registration fee and assessment structure
corepay.net ↗
Visa and Mastercard high-risk registration fee structures compared
bankcardinternationalgroup.com ↗
States including Florida enacted 2023 laws barring required use of the firearms merchant category code after the networks paused implementation
paymentsdive.com ↗
Visa Core Rules and Visa Product and Service Rules, public edition
usa.visa.com ↗