Following our announcement of Mastercard’s revised Global Merchant Audit Program (GMAP), it's time to dig deeper into what this actually means for your business. While the high-level changes are important, it’s also critical to ensure you have an actionable roadmap in place.
A Refresher on Key Changes
Mastercard's revised GMAP takes effect April 1, 2027, fundamentally transforming how merchant performance is monitored. The new framework introduces three major changes: combining confirmed fraud reports with non-fraud chargebacks into a single metric; establishing four new monitoring categories—High Dispute Merchant (HDM), Excessive Dispute Merchant (EDM), High Dispute Acquirer (HDA), and Excessive Dispute Acquirer (EDA)—with low-volume triggers that can flag merchants with as few as five transactions; and gradually tightening existing Excessive Chargeback Merchant (ECM) thresholds through 2031.
The GMAP ratio—calculated as fraud reports plus non-fraud chargebacks divided by prior-month sales—now counts fraud reported to Mastercard’s Fraud and Loss Database (FLD) even when it never results in a chargeback. Merchants exceeding thresholds face escalating consequences including formal audits, issuer notifications, and expanded chargeback liability for EDM-designated businesses. The program evaluates performance at both the merchant and acquirer level, meaning consolidated visibility across payment service providers (PSPs), acquirers, and merchant IDs (MIDs) is essential. With enforcement beginning in 2027, merchants should start preparing now by unifying their transaction, fraud, and dispute data to understand how they may be assessed under the new framework.
Which Merchant Segments Are Most at Risk?
The new GMAP framework fundamentally changes the risk equation for merchants. Here’s who should be paying closest attention:
Small and Emerging Merchants
This is perhaps the most significant shift. The HDM category can be triggered with as few as five cleared sales in a month, provided the $5,000 threshold and 5% ratio are met. Consider a merchant processing $100,000 monthly who experiences $5,000 in fraud reports and non-fraud chargebacks. Under ECM, 100 chargebacks were required—this merchant might never have been flagged. Under GMAP, they could be an HDM with just five problematic transactions. New businesses, seasonal merchants, and those with naturally low monthly volumes are particularly vulnerable.
High-Risk Vertical Merchants
Industries traditionally associated with higher dispute rates—digital goods, subscription services, travel, and electronics—face heightened exposure. The 5% HDM ratio is lower than the current ECM threshold, and with fraud reports now counting alongside chargebacks, businesses in these sectors may find themselves exceeding thresholds more quickly than anticipated.
Merchants Using Multiple PSPs or MIDs
The GMAP framework evaluates performance at the merchant level, meaning your combined activity across providers matters. Merchants who previously believed they could compartmentalize risk by distributing volume across multiple acquirers or MIDs may find this strategy less effective. Mastercard can now aggregate your performance, potentially triggering thresholds based on cumulative activity that no single provider would have flagged individually.
Card-Not-Present (CNP) Merchants
E-commerce businesses will feel the impact most acutely. CNP transactions carry inherently higher fraud and dispute risk, and with Mastercard now evaluating card-present and card-not-present activity separately at the acquirer level, CNP merchants face more focused scrutiny.
Seven Steps to Build Visibility and Maintain Compliance
With the April 2027 effective date approaching, merchants who begin preparation now have a significant advantage. The following actionable strategies can help you build the visibility and operational processes needed to maintain compliance under the new framework.
Unify Fraud, Dispute, and Sales Data
The GMAP ratio calculation requires a consolidated view across PSPs, acquirers, MIDs, submerchant IDs, fraud tools, and card schemes. Many merchants lack this unified perspective, making it difficult to predict their GMAP ratio before it triggers an audit.
IXOPAY Payments Analytics addresses this by consolidating data across providers and supporting analysis by MID, issuer, BIN, geography, and payment method. Having one normalized view across your entire payment ecosystem is the foundation of effective GMAP preparation.
Build Mastercard-Specific Monitoring
Merchants should establish dedicated monitoring that tracks:
FLD fraud counts
Non-fraud chargeback counts and values
Prior-month Mastercard sales counts
Results segmented by MID, submerchant, acquirer, country, and business unit
A rolling view of HDM, EDM, ECM, and HECM exposure
According to chargebacks experts, greater visibility into chargeback data should be the top priority. Merchants should be tracking chargeback ratios for each card network on each MID and should have early warning systems in place for when those ratios approach specific thresholds.
Set Alerts Before Thresholds Are Crossed
Waiting until a threshold is breached is too late. Merchants need internal warning levels set below Mastercard’s thresholds to provide time for corrective action.
IXOPAY’s Monitoring & Risk Management capabilities allow merchants to create custom alerts for important payment KPIs, thresholds, and operational changes. With these tools, merchants can configure alerts by area, metric, aggregation fields, merchant accounts, and timeframe. They can set threshold conditions such as increases, drops, or event-count triggers, and receive notifications in-platform, via Slack, or through email.
Stop Preventable Disputes Before They Become Chargebacks
The most effective way to manage GMAP exposure is to prevent disputes from occurring in the first place. Merchants should:
Use Ethoca and Verifi pre-chargeback alerts to intercept potential disputes before they escalate.
Issue fast refunds where appropriate to resolve customer concerns.
Use recognizable billing descriptors so customers can identify transactions.
Provide clear refund, cancellation, and subscription terms.
Improve customer-service escalation processes
Ensure transaction information helps customers recognize their purchases.
IXOPAY chargebacks monitoring integrates Ethoca and Verifi into a unified dashboard, enabling merchants to manage pre-chargeback activity across both networks from a single interface. Merchants can filter alerts by action required, review each alert, and log outcomes such as refunded, not refunded, or not settled.
Strengthen Fraud Controls
With fraud reports now counting toward the GMAP ratio—even without chargebacks—merchants need better visibility into what their fraud tools are reporting.
IXOPAY’s Risk & Fraud Services support centralizing fraud providers, defining custom risk profiles, and using transaction-level risk scores. The platform’s risk statistics allow merchants to identify which risk rules are triggered most often and optimize profiles to reduce unnecessary declines while preventing chargebacks.
Review 3-D Secure Strategy
3DS should be used as part of a risk-based strategy rather than applied indiscriminately. When used appropriately, 3DS can reduce fraud and chargebacks while minimizing friction for legitimate customers. IXOPAY's 3DS module provides real-time authentication capabilities that support risk-based deployment.
Coordinate with the Acquirer
Merchants should proactively engage with their acquirer to understand:
Which GMAP data and reports the acquirer will make available
Whether the acquirer plans to impose internal limits below Mastercard thresholds
How submerchant IDs are populated (particularly important for marketplaces and platforms)
Who receives alerts and how remediation will be handled
How frequently merchant performance will be reviewed
The gap between acquirer monitoring (0.5% threshold) and merchant monitoring (5% HDM threshold) means acquirers face pressure well before their merchants do, and will likely pass that pressure down to their portfolios. This is why understanding your acquirer’s approach is essential.
How IXOPAY Supports GMAP Readiness
IXOPAY Payments Intelligence provides capabilities that support GMAP preparation through a simple three-step model:
Unify
Consolidate payment, fraud, dispute, and provider data into a single view. The platform integrates across PSPs, acquirers, fraud tools, and internal systems, providing the normalized view needed to calculate GMAP ratios.
Monitor
Analyze performance by scheme, PSP, MID, issuer, and market. Configure alerts for key thresholds and schedule recurring reports for operational reviews. IXOPAY's monitoring capabilities include VAMP tracking, custom alerts, and automated reporting.
Act
Use pre-chargeback alerts, fraud controls, and authentication to address risk before it becomes a formal dispute. The platform supports Ethoca and Verifi integration, fraud rule optimization, and 3DS authentication.
These capabilities can help merchants prepare for GMAP by providing the unified data visibility and proactive risk management required to maintain compliance under the new framework.
Don’t Delay—Assess Your Readiness Now
The GMAP framework represents a fundamental shift in how Mastercard evaluates merchant performance. The merchants most at risk are those with low volumes, high dispute rates, fragmented data visibility, or operations in traditionally high-risk verticals. However, with 18 months until enforcement begins, there remains time to prepare—provided merchants start now.
The key to success is unified transaction visibility combined with proactive dispute prevention. Merchants who wait until 2027 will find themselves reacting to audits rather than preventing them. Those who prepare today can build the data infrastructure and operational processes needed to maintain healthy processing relationships under the new framework.
Assess your payments intelligence maturity today by downloading the Payments Intelligence Checklist. The checklist already covers transaction visibility, chargeback prevention, monitoring, reporting, and card-scheme monitoring.