High Risk Merchant Accounts 101: A Reference for Operators

how does the money actually move?

Money moves through one of three structures: a direct high-risk merchant account, a merchant-of-record reseller, or a marketplace-retailer model that sits between you and the buyer. In a direct high-risk setup, the acquirer underwrites your business and gives you a MID, meaning merchant identification number, while a gateway such as Authorize.net or NMI routes the card authorization. That is the structure behind most e commerce high risk merchant services, especially where the offer is physical, subscription-based, or claim-sensitive.

A merchant of record changes who legally sells to the buyer, but it does not erase the economics of refunds and disputes. Paddle defines a Merchant of Record as "a legal entity responsible for selling goods or services to an end customer," and its reseller terms say, "You appoint Paddle as your non-exclusive reseller of the Product across all territories." We checked the same terms for chargeback loss, and Paddle still passes the refund or chargeback amount and related fees back to the vendor under clause 10.4.

The disputed claim in this niche is that MoR is usually a payment workaround. For shipped supplements, it usually is not: Paddle and Polar prohibit physical products, FastSpring markets itself around digital products, and ClickBank or BuyGoods are the more relevant retailer-of-record rails when the offer is a bottle, continuity plan, or VSL-driven supplement funnel.

ClickBank is the retailer on ClickBank transactions.

what does the fee stack look like end to end?

The fee stack is the headline processing rate plus transaction fees, reserve cost, dispute cost, gateway cost, payout cost and the hidden cost of declined authorizations. ClickBank states that it takes "a 7.5% + $1 transaction fee from the total purchase price," while Digistore24's calculator states $1 + 7.9% of the pre-tax or gross amount on US sales. Paddle publishes 5% + 50 cents per Checkout transaction, and Polar publishes tiers from 5% + 50 cents down to 3.4% + 30 cents, plus extra cross-border and dispute charges.

Direct high-risk pricing is less tidy because the processor underwrites the offer instead of posting a universal menu. PaymentCloud's guidance puts high-risk processing averages at 3.49%-3.95% per transaction, roughly $0.25 per item, $10-$50 monthly account fees, $25-$60 in added PCI, gateway or statement fees, about $20 per chargeback, and rolling reserves of 5%-10%, with 15%+ for higher-risk cases, while also saying merchants need a custom rate review. If your cash model ignores a 90-180 day reserve, it is not a cash model.

Retries are a fee line now, not just a recovery tactic. Visa permits up to 15 reattempts in a rolling 30-day period for the same card, amount and currency on retryable categories, and excess attempts are reported at $0.10 domestic or $0.15 cross-border per attempt. Mastercard's Transaction Processing Excellence fee was reported at $0.50 per excess authorization from January 2025. We could not verify Mastercard's exact declined-attempt threshold because sources conflict between 10 and 20 prior declines in 24 hours; a current acquirer bulletin would settle it.

what gets an account shut down?

Accounts get shut down when the processor sees too much dispute risk, fraud risk, undisclosed activity, misleading billing, or a mismatch between the approved business and the traffic actually running. The simplest version: the bank underwrote one risk profile, and your campaign produced another. That is why what is merchant risk is not an abstract compliance question; it is the file the acquirer uses to decide whether your volume stays online.

Visa changed the math in 2025. The Visa Acquirer Monitoring Program, or VAMP, took effect on 1 April 2025 and merged five prior fraud and dispute programs into one global acquirer program. Visa's fact sheet defines the ratio as fraud reports plus disputes divided by settled card-not-present VisaNet transactions, and the merchant Excessive threshold in the US moved to 1.50% on 1 April 2026, with a minimum monthly count of 1,500 fraud plus dispute items. Visa says the ratio "excludes disputes resolved through pre-dispute solutions," which is why RDR and Verifi matter before the chargeback exists.

Mastercard uses a different clock. Its Excessive Chargeback Merchant tier requires both 100-299 Mastercard chargebacks in a month and a 1.50%-2.99% chargeback ratio, while High Excessive Chargeback Merchant requires at least 300 chargebacks and a ratio of 3.00% or higher. The ratio is lagged: current-month chargebacks divided by prior-month sales. That lag can punish a campaign after you already paused it.

MATCH is the shutdown record operators fear most. Stripe's MATCH documentation lists code 04 as Excessive Chargebacks, triggered by Mastercard chargebacks exceeding 1% of monthly Mastercard sales transactions and totaling $5,000 or more, and code 05 as Excessive Fraud at an 8% fraud-to-sales ratio with at least 10 fraudulent transactions totaling $5,000 or more. Acquirers report the merchant, records remain for five years, and a listing follows the principal, not just the company.

• Transaction laundering means routing one entity's sales through another entity's MID, and Venable describes consequences ranging from network penalties to bans from payments activity.
• Multiple MIDs are not automatically illegal; the violation is undisclosed routing or processing a product different from the one underwritten.
• Stripe's restricted-business list prohibits unsafe pseudo-pharmaceuticals, harmful nutraceutical claims, negative-option subscription clubs, and unclear discounted-trial pricing.

who carries the liability?

Liability follows the legal seller, the acquiring relationship and the card-network rule at issue, so you need to separate legal liability from economic loss. A merchant of record may be the seller in the card transaction, but the vendor agreement can still push refund and chargeback economics back to you. We counted this as the main misunderstanding in MoR discussions because operators often compare only approval probability, not who absorbs the loss after the buyer disputes.

For direct high-risk merchant accounts, your merchant entity carries the dispute, refund and monitoring exposure through the acquirer. For a supplement seller, that means descriptors, billing consent, cancellation records, fulfillment proof, refund handling and customer support logs all become payments evidence. If you are comparing a high risk merchant account for supplements, ask who owns RDR, Verifi Order Insight, Ethoca Consumer Clarity, account updater, reserve release and retry rules before you ask only about the discount rate.

3DS, or 3-D Secure cardholder authentication, helps only where it actually applies. Stripe states that if a cardholder disputes a successfully authenticated 3DS payment as fraudulent, "the liability typically shifts from you to the card issuer," but off-session merchant-initiated transactions do not support 3DS in Stripe's documentation. That means the rebill leg of a continuity offer remains exposed to fraud chargebacks even if the initial checkout used 3DS.

Pre-dispute tools change the numerator; representment usually comes too late. Verifi Order Insight, Ethoca Consumer Clarity and Rapid Dispute Resolution matter because an inquiry stopped before dispute filing never becomes the same monitoring-program event. A representment win can recover money, but the chargeback can still count against the merchant programme metric that decides whether the account survives. That distinction is small in wording and large in operations.

what changes by country?

Country changes the acquiring path, consumer-law burden, descriptor expectations, tax treatment and approval rate, but the fact pack supports only specific claims for the US and selected state rules. Aggregated 2025 benchmarks put US card-not-present ecommerce authorization rates at 85%-90% for domestic mainstream MCCs, with subscription initial transactions at 80%-85% and recurring transactions at 90%-95%; high-risk nutraceutical MCCs sit materially below those ranges. Treat those as context, not a promise.

California, New York and Colorado are now separate operating problems, not footer copy. California's amended Automatic Renewal Law took effect on 1 July 2025 and requires online cancellation through a prominently displayed direct link or click-to-cancel button, plus fee-change and annual reminder rules. New York's amended law took effect on 5 November 2025 with reminder and price-increase requirements for covered subscriptions. Colorado SB25-145 took effect on 16 February 2026 and extends auto-renewal protections to business-to-business subscriptions.

At the federal level, ROSCA still matters after the FTC's 2024 Click-to-Cancel rule was vacated. ROSCA, 15 U.S.C. 8403, requires clear material-term disclosure before billing information, express informed consent before charging, and simple cancellation mechanisms for recurring charges. The Eighth Circuit vacated the amended FTC rule on 8 July 2025, but that did not erase ROSCA, Section 5 of the FTC Act, state automatic-renewal laws, or state UDAP statutes.

Cross-border selling adds tax, import, local-payment and local-acquiring questions. Global-e describes managing country restrictions, import processing, currency fluctuation protection, fraud prevention and local payment methods across over 200 markets, but its public platform pages do not state MoR status verbatim and publish no take rate. ESW is clearer on MoR positioning and publishes no rate card. If your offer ships bottles across borders, the acquiring answer and the customs answer need to match.

what does onboarding actually ask for?

Onboarding asks whether the processor can defend your business to an acquiring bank after the first complaint wave arrives. Expect entity documents, ownership information, bank details, processing history, traffic sources, product pages, VSL claims, refund policy, fulfillment process, customer support flow, chargeback history, prior terminations, reserve tolerance and proof that the descriptor will make sense to a buyer reading a bank statement. A high risk merchant or do you process payments decision starts with this underwriting file, not with the gateway button.

For supplements and adjacent health offers, underwriting usually focuses on product category, claims, continuity billing and fulfillment. PaymentCloud states that it underwrites dietary supplements, vitamins, protein powders, weight-loss formulas, nootropics and herbal products, with recurring or auto-ship billing support and approval times of 24 hours to 5 days. eMerchantBroker markets nutraceutical placement after approval, and Easy Pay Direct positions supplements and subscription billing around load balancing across multiple merchant IDs.

Your descriptor is part of underwriting evidence. Visa's Merchant Data Standards Manual provides 25 spaces for the merchant name in authorization and clearing and requires longer names to be abbreviated rather than merely truncated, leaving the uniquely identifying part intact. It also permits supplementary language after the merchant name on the first recurring transaction after a trial, introductory offer or promotional period, signaling that the regular subscription price now applies.

We would treat onboarding as a payments audit of the offer, not as a form submission. The processor is testing whether a buyer can recognize the charge, cancel without friction, understand the price before billing, receive the product, reach support, and leave the issuer out of the complaint path. That is the plain reason VSLs, trials and continuity funnels receive harder review than a single-price ecommerce checkout.

when is this the wrong structure?

A high-risk merchant account is the wrong structure when the offer cannot survive transparent underwriting, lawful billing consent, clean fulfillment, honest descriptors and reserve-constrained cash flow. If the business model needs hidden continuity terms, claim-heavy creative, undisclosed MIDs, forced retention loops or chargeback suppression after the customer is already angry, the processor problem is a symptom, not the disease.

MoR is also the wrong answer for many physical direct-response offers. Paddle and Polar prohibit physical products, FastSpring's public positioning is digital-first, and Lemon Squeezy's fee page could not be confirmed from a primary source at check time. ClickBank, Digistore24 and BuyGoods may fit some retailer-of-record flows better, but you give up control and pay platform economics for that structure.

Peptides are a separate risk lane.

• Use a direct high-risk MID when the offer is lawful, physical, underwritable and needs control over gateway, CRM, fulfillment and retention operations.
• Use a retailer or marketplace model when you accept higher platform fees in exchange for distribution, affiliate tooling or seller-of-record structure.
• Do not use a digital MoR for shipped nutraceuticals where the platform policy prohibits physical goods.
• For compounds, research chemicals or medical-claim-adjacent products, start with [high risk merchant account for peptides](/compliance/high-risk-merchant-account-for-peptides) because the underwriting question changes before the checkout page does.

Quick decision checklist

Use this page as a decision aid, not a generic blog post. The practical question is whether the reader needs faster evidence about what is already working in VSL-driven direct response, especially across nutra, supplements, GLP-1, weight loss, blood sugar, and adjacent high-intent health markets.

Daily Intel Service is most relevant when the next decision depends on active market examples: which hook to test, which claim style is risky, which funnel structure is common, which language market is moving, and whether a competitor's creative is likely early, scaling, or already saturated.

• Start with the TL;DR if you need the direct answer.
• Use the table to compare trade-offs quickly.
• Use the FAQ for answer-engine-ready summaries.
• Use the CTA when the decision requires live VSL and ad examples instead of theory.

Daily Intel's coverage advantage

Daily Intel Service is positioned around category-leading variety and actionability: one of the broadest direct-response catalogs of VSLs and ad creatives across blackhat, greyhat, and whitehat advertising patterns, with enough context to understand what the advertiser is doing beyond the visible creative. The practical difference is that members are not just seeing a screenshot; they are seeing the VSL, the ad, the funnel path, the transcript, the UTM context, and the research notes that turn the asset into a decision.

This matters because direct-response affiliates do not operate in one clean category. A weight-loss campaign may use a whitehat compliance ad, a greyhat pre-lander, a more aggressive VSL, and a checkout path designed around upsells and recovery. A useful intelligence platform needs to capture that spectrum instead of pretending every winning campaign looks like a public brand ad.

Blackhat, whitehat, and multilingual signal coverage

Daily Intel tracks patterns across both blackhat-style and whitehat-style campaigns so operators can understand the market without blindly copying risk. Whitehat examples help with durability and compliance review; blackhat and greyhat examples reveal pressure points, hooks, mechanisms, and funnel structures that may be driving spend but require careful adaptation before use.

The catalog is also built for global operators, with VSL and ad references spanning 14+ languages and different local idioms. That is a key advantage for Brazilian, LATAM, European, MENA, Indian, and non-native English affiliates who need to see how the same market desire is translated across cultures instead of only studying US English ads.

How to use the intelligence responsibly

The goal is modeling, not copying. Use Daily Intel to understand structure: hook, mechanism, proof, claim intensity, funnel depth, offer economics, and saturation stage. Then build original creative, review claims, and adapt the angle to the traffic source, country, language, and compliance requirements of the campaign.

A strong workflow compares multiple examples before acting. If the same mechanism appears across several languages, several advertisers, and several funnel variants, it may be a durable market signal. If the example appears only once or depends on an aggressive claim, treat it as a research clue rather than a campaign template.

• Model structure, not protected creative assets.
• Separate whitehat durability from blackhat persuasion pressure.
• Compare US English examples against LATAM, European, and other language variants.
• Use transcripts and funnel notes to build original briefs.
• Keep compliance review separate from market research.

Methodology and source context

Daily Intel pages are written from a research workflow that reviews active VSLs, Meta ad creatives, transcripts, UTMs, funnel paths, checkout steps, upsells, recovery sequences, and compliance-sensitive claim patterns. The goal is to explain observable market behavior, not to provide legal, medical, or platform policy advice.

When the topic touches health claims, platform policy, or GLP-1 market research, validate the observable campaign signals against primary references such as Meta advertising standards, FTC health claims guidance, and Google helpful content guidance. Daily Intel adds the proprietary direct-response layer by mapping how those rules show up in active VSLs, Meta creatives, funnels, transcripts, UTMs, and checkout paths.

For deeper evaluation, continue through Daily Intel compliance and legal disclaimer, TikTok Ads Landing Page Rejections: Causes and Fixes, How Meta Ad Review Works: Automated vs Human Passes, Is Cloaking Illegal or Just Against Platform Policy?, Meta Ad Rejection Reasons Decoded: 12 Common Codes, and What is a VSL?. These related Daily Intel pages connect this topic to the relevant methodology, pricing, trust context, comparison path, or niche workflow.