Your payment processor can terminate your merchant account, flag your business in a Mastercard database that every future processor checks, and keep that flag there for five years. And nobody is required to tell you it happened. Most business owners find out the worst possible way: the next processor they apply to rejects them with nothing but a vague "risk decision" by way of explanation.
That database is called MATCH — Member Alert to Control High-Risk Merchants. If you accept credit cards, you need to know how merchants end up on it, what it costs, and what the realistic paths off it look like.
What the MATCH List Is (and Isn't)
MATCH is a risk database maintained by Mastercard and shared across the card industry. When an acquiring bank terminates a merchant account "for cause" — fraud, excessive chargebacks, standards violations — it reports the merchant to MATCH, and every other acquirer consults that file during underwriting before boarding a new account. It is the successor to the Terminated Merchant File (TMF) created in the 1990s, and many processors still say "TMF" when they mean MATCH.
Three distinctions matter:
- Terminated is not the same as listed. Your processor can close your account without reporting you to MATCH — for example, at the end of a contract or because your business model no longer fits its risk appetite. Termination without a listing is an inconvenience; termination with a listing follows you for five years.
- MATCH is Mastercard's file, but the whole industry honors it. Visa runs its own monitoring programs (including VAMP, whose tightened 2026 thresholds have pushed more small merchants into monitoring), and Discover publishes its own negative file. In practice, a MATCH flag poisons applications at nearly every mainstream processor.
- There is no consumer-style dispute process. You cannot pull your own MATCH record the way you pull a credit report. Only acquiring banks and authorized users can query the MATCH portal, and Mastercard offers merchants no direct appeal. Everything runs through the bank that listed you — a fact that shapes every strategy below.
The Reason Codes That Land You There
Every MATCH listing carries a two-digit reason code identifying why the acquirer reported the merchant. The code determines how hard removal will be, so the first thing to learn about any listing is which code it carries. The main ones:
| Code | Meaning | Typical story |
|---|---|---|
| 01 | Account data compromise | Card data was breached on your watch |
| 02 | Common point of purchase | Your business was the shared link in a fraud pattern |
| 03 | Laundering (factoring) | Processing someone else's sales through your account |
| 04 | Excessive chargebacks | Chargeback ratio stayed over the line too long |
| 05 | Excessive fraud | Fraud volume tripped network thresholds |
| 07 | Fraud conviction | A principal was convicted of card-related fraud |
| 08 / 20 | Questionable merchant audit program | Flagged in a Mastercard audit sweep |
| 09 | Bankruptcy / liquidation / insolvency | Business collapsed owing the acquirer money |
| 10 | Violation of standards | Broke network operating rules |
| 11 | Merchant collusion | Cooperated in fraudulent activity |
| 12 | PCI-DSS noncompliance | Failed to meet card-data security standards |
| 13 / 24 | Illegal transactions | Processed sales of illegal goods or services |
| 14 | Identity theft | Account opened or used with stolen identity |
Excessive chargebacks (code 04): the one that catches ordinary businesses
Fraud codes dominate the headlines, but code 04 is the workhorse of the MATCH list — and the one that catches legitimate businesses. The usual path runs through Mastercard's Excessive Chargeback Program: a merchant crosses into monitoring at 100 or more chargebacks in a month with a ratio at or above 1.5%, and hits the "high excessive" tier at 3%. Fines escalate month after month, the acquirer pays penalties of its own, and after several months without improvement the acquirer concludes the account is unprofitable and terminates it — with a MATCH report attached.
Note what this means: nobody accused you of fraud. You simply had too many disputes for too long — friendly-fraud chargebacks, "product not as described" claims, subscription cancellations handled through the bank instead of your support desk — and the math did the rest.
The codes that are hardest to escape
Not all codes are equal. Fraud-adjacent codes — 03 (laundering), 07 (conviction), 11 (collusion), 13 (illegal transactions) — are treated as character evidence by underwriters and are rarely reversed. Operational codes are a different story: code 12 (PCI noncompliance) has a defined cure path, and code 04 listings can sometimes be revisited once the underlying chargeback problem is demonstrably fixed. Code 09 (bankruptcy) usually just has to age out.
How You Find Out You're on It
There is no formal notification process. Processors are not required to send you a letter saying you have been MATCH-listed, and most termination notices use bland language about "risk decisions" that never mentions the database.
In practice, merchants discover a listing in one of three ways:
- A new application dies in underwriting. You apply for a new merchant account and get declined, sometimes with a vague reference to "prior processing history." This is the most common discovery path.
- You ask your former processor directly. Call the risk or underwriting department of the processor that terminated you and ask two questions: "Was I reported to MATCH?" and "What reason code was used?" They may or may not answer, but asking costs nothing.
- An underwriter tells you. Some sales agents and independent sales organizations will disclose that a MATCH hit is the reason for a decline — and occasionally which code — especially if they want to route you to a high-risk product.
Because you cannot search the file yourself, treat any post-termination rejection as a possible MATCH hit until you confirm otherwise. And confirm the code: your entire removal strategy depends on whether you are fighting a 04, a 12, or something worse.
What Five Years on the List Actually Costs
A MATCH listing does not make card acceptance impossible — it makes it expensive. Mainstream processors will generally decline you, which leaves specialized high-risk processors that board MATCH-listed merchants on a case-by-case basis. Typical high-risk economics in 2026:
- Processing rates of 4–8% all-in, versus roughly 2–3% for a standard small-business account. Total cost commonly lands between 3.5% and 7% once every fee is included.
- Rolling reserves of 5–15% of volume held for 90 to 180 days — money you have earned but cannot touch for months. This is the most underestimated cost: on $50,000 of monthly volume, a 10% reserve on a 180-day hold parks tens of thousands of dollars with your processor at all times.
- Monthly minimums and account fees of $25–$100 regardless of volume, plus setup fees, PCI compliance fees, and per-chargeback fees of $25–$100 each.
- Slower settlement — three to seven business days instead of next-day — which strains cash flow on top of the reserve drag.
There is also a reliability cost. High-risk processing relationships are fragile: if your processor loses its own acquiring relationship, every merchant on that portfolio loses processing simultaneously. Merchants on MATCH should always have a backup acceptance method — ACH, invoicing, a second processor — rather than depending on a single fragile account.
The Three Paths Off the List
There are exactly three ways a MATCH listing ends. Understanding which one applies to you saves months of effort aimed at the wrong target.
1. Wait out the five years
Listings expire automatically five years after the reporting date if no new issues arise. This is the default path for codes that cannot be cured — bankruptcy, convictions, collusion findings. It is also the fallback for everyone else: even a failed appeal leaves the clock running.
Waiting is not passive, though. Processors considering a high-risk application mid-listing will look at what you did during the listing period. A clean processing record elsewhere, settled debts, and documented compliance work all strengthen the eventual post-expiry application.
2. Correct an erroneous listing
If the listing was a mistake — wrong merchant, wrong code, account closed for a non-cause reason but reported anyway — the bank that reported you can contact Mastercard and have the entry removed. Your job is to document the discrepancy precisely (closure letters, final statements showing zero balance owed, correspondence showing the real reason for termination) and present it to the former acquirer's risk department in writing.
Erroneous listings are more common than the industry admits, which is why step one is always "get the code and check it against reality." A merchant closed for inactivity but coded 04, or a merchant whose PCI compliance was actually current, has a correction case, not an appeal case.
3. Cure the violation and appeal through the listing acquirer
For curable codes, the path is: fix the underlying problem, document the fix, and ask the bank that listed you to request early removal. The clearest example is code 12: become PCI-DSS compliant, and the listing acquirer can submit an attestation of compliance to Mastercard to lift the entry. For code 04, the equivalent is demonstrating a sustained period of low chargeback ratios on another account plus the prevention systems that produced them.
Two hard truths about this path. First, Mastercard has no appeal process for merchants — the listing bank is the only door, and it has no obligation to open it. A professional, evidence-backed written request to the risk department beats repeated phone calls. Second, for fraud-adjacent codes, most merchants need specialized legal help; payments attorneys who do MATCH removal work exist precisely because the process is opaque and the stakes are existential. Before engaging anyone, settle all outstanding balances with former processors — unpaid debts end every appeal before it starts.
Be skeptical of anyone guaranteeing removal for an upfront fee. Legitimate help works on documentation and bank negotiation; guarantees are a red flag in a process where the decision belongs to a third party.
Keep Processing While You're Listed
Removal takes months at best. In the meantime, you still need to get paid. High-risk processors that accept MATCH-listed merchants typically ask for:
- Government ID and business formation documents
- Three to six months of bank statements and prior processing statements
- A bank letter or voided check
- Evidence that prior processor debts are settled
- An explanation of the MATCH listing and what changed since
Apply with the explanation ready — underwriters decide faster on files that acknowledge the listing and document the fix than on files that hope nobody notices. Negotiate the reserve as a term, not a tax: reserves should step down as your track record builds, so get the review schedule (commonly after 6–12 months of clean processing) in writing.
One absolute rule while you rebuild: never process your sales through someone else's merchant account. That is factoring — code 03, laundering — and it converts a curable listing into a nearly permanent one. The same goes for opening a new account without disclosing principals connected to the listed entity; identity-linking is exactly what the database is built to catch.
How to Stay Off the List in the First Place
Avoidance is dramatically cheaper than removal. The highest-leverage habits:
- Treat your chargeback ratio as a vital sign. Know your monthly ratio and keep it well under 1% — not just under the 1.5% monitoring line, since one bad month can start a slide. Refund-first policies for unhappy customers are almost always cheaper than disputes: a refund costs you the sale, while a chargeback costs you the sale plus a fee plus ratio damage.
- Use pre-dispute alerts. Services that notify you of incoming disputes before they post as chargebacks let you refund in time to keep the dispute off your ratio. They charge per alert, so run the math — but for merchants near monitoring thresholds, alerts are the fastest way back to safety.
- Tighten the basics. Match AVS and CVV on card-not-present orders, use clear billing descriptors customers recognize on statements, send order confirmations and shipping notifications, and make cancellation one click for subscriptions. Most "friendly fraud" starts as customer confusion.
- Stay PCI compliant and document it. Code 12 is one of the most avoidable listings: complete the annual self-assessment questionnaire, use a compliant gateway, and keep the attestation on file.
- Read your processing agreement's termination section. Know what your processor considers cause — prohibited products, volume spikes, business-model changes — and notify them before you pivot rather than after they notice.
The bookkeeping connection
Your books are an early-warning system if you set them up that way. Reconcile processor payouts to gross sales, fees, refunds, and chargebacks every month through a clearing account — the same discipline as reconciling payment-processor payouts — and the chargeback ratio falls out of the reconciliation for free. Track reserves as a separate receivable so a growing hold balance shows up before it becomes a cash crisis, and keep chargeback fees in their own expense line so the true cost of disputes is visible at a glance. High-risk merchants should add one more habit: a monthly reserve-aging review, so held funds that should have released but didn't get chased instead of forgotten.
Keep Your Payment Processing Boring
The MATCH list rewards one thing above all else: uneventful processing history. Low disputes, compliant systems, honest applications, and books that prove it. Whether you are rebuilding after a termination or protecting a clean record, the work is the same — monitor the ratio, fix problems before your acquirer notices them, and keep financial records that tell the story for you. Beancount.io provides plain-text accounting that gives you complete transparency and control over your financial data — no black boxes, no vendor lock-in. Get started for free and see why developers and finance professionals are switching to plain-text accounting.





