Mastercard GMAP (Global Merchant Audit Program)
1. What Is GMAP?
GMAP (Global Merchant Audit Program) is Mastercard's comprehensive upgrade of the existing Acquirer Chargeback Monitoring Program (ACMP), effective 1 April 2027. GMAP brings confirmed fraud (including fraud that does not result in a chargeback) and non-fraud dispute activity into a single monitoring framework.
- Retires ACMP and migrates its EFM, ECM and HECM components into GMAP.
- Introduces new assessment requirements for HDM, EDM, HDA and EDA.
1.1 Effective dates
| Effective date | Change |
|---|---|
| 1 April 2027 | GMAP Standards take effect; ECM/HECM/EFM monitoring moves to submerchant ID level (currently measured at website level; after the change, measured at the level of the merchant's contracting entity). |
| 1 January 2029 | ECM chargeback ratio threshold tightened to 1.3%–2.99%. |
| 1 January 2030 | ECM chargeback ratio threshold tightened to 1.1%–2.99%. |
| 1 January 2031 | ECM chargeback ratio threshold tightened to 0.9%–2.99%. |
2. Four New Monitoring Categories under GMAP
2.1 Merchant Level
| Category | Full name | Assessment criteria | Notes |
|---|---|---|---|
| HDM | High Dispute Merchant | - At least 5 successful transactions. - Fraud amount (as reported to the Fraud & Loss Database) plus non-fraud chargebacks totaling USD 5,000 or more. - Chargeback ratio of 5% or more: the number of fraud plus non-fraud chargebacks relative to the number of sales in the previous month. | - Mastercard may notify issuers when a merchant exceeds the HDM threshold for two or more consecutive months. |
| EDM | Excessive Dispute Merchant | - At least 5 successful transactions. - Fraud amount (as reported to the Fraud & Loss Database) plus non-fraud chargebacks totaling USD 10,000 or more. - Chargeback ratio of 50% or more: the number of fraud plus non-fraud chargebacks relative to the number of sales in the previous month. | - Where a merchant exceeds the EDM threshold for two consecutive months, the merchant is liable for all fraud-related chargebacks on transactions that occurred in the three months before identification, and for all fraudulent transactions that occur in the six months after identification. - Mastercard will publish the list of EDM merchants and the applicable timeframes. Issuers may use chargeback reason code 4849 (Questionable Merchant) to recover 100% of the transaction amount. |
2.2 Merchant-Level HDM/EDM Threshold Breaches: Assessments and Exit Process
- An audit is opened and the monthly counter starts as soon as a merchant or Merchant ID (MID) is noncompliant with either threshold. Once either the HDM or the EDM threshold is exceeded, the corresponding HDM or EDM enters the monthly assessment count.
- The merchant must be compliant with both thresholds for three (3) consecutive months before the audit is closed and the monthly counter is reset. After exceeding the HDM or EDM threshold, therefore, a merchant must remain below both thresholds for three consecutive months in order to exit the monitoring program and end the monthly assessment count.
- During the audit period, the applicable assessment depends on the number of months the audit has been open and on the threshold that has been exceeded. The corresponding assessment is therefore charged throughout the merchant's exit from the HDM/EDM monitoring program.
2.3 Acquirer Level
| Category | Full name | Assessment criteria | Notes |
|---|---|---|---|
| HDA | High Dispute Acquirer | - At least 1,500 successful transactions. - 1,500 or more transactions reported as fraud or charged back for non-fraud reasons. - Chargeback ratio of 0.5% or more: the number of fraud plus non-fraud chargebacks relative to the number of sales in the previous month. | |
| EDA | Excessive Dispute Acquirer | - At least 1,500 successful transactions. - 1,500 or more transactions reported as fraud or charged back for non-fraud reasons. - Chargeback ratio of 0.7% or more: the number of fraud plus non-fraud chargebacks relative to the number of sales in the previous month. | An acquirer ICA that remains noncompliant for 12 consecutive months or more may be required to complete a Franchise Management Program (FMP) review at its own expense and to remediate any issues identified. If noncompliance continues for 19 months or more, the acquirer may face restrictions, suspension or termination of its Mastercard license. |
2.4 Acquirer-Level HDA/EDA Threshold Breaches: Assessments and Exit Process
- An audit is opened and the monthly counter starts as soon as an acquirer is noncompliant with either threshold. Once either the HDA or the EDA threshold is exceeded, the corresponding HDA or EDA enters the monthly assessment count.
- The acquirer must be compliant with both thresholds for three (3) consecutive months before the audit is closed and the monthly counter is reset. After exceeding the HDA or EDA threshold, therefore, an acquirer must remain below both thresholds for three consecutive months in order to exit the monitoring program and end the monthly assessment count.
- During the audit period, the applicable assessment depends on the number of months the audit has been open and on the threshold that has been exceeded. The corresponding assessment is therefore charged throughout the acquirer's exit from the HDA/EDA monitoring program.
3. How Merchants Should Prepare in Advance
- Build monthly monitoring and early warning. Track chargebacks and fraud month by month, and set internal warning thresholds below the card network thresholds to leave a buffer, so that a warning is triggered before any threshold is breached.
- Strengthen fraud prevention. For example, increase the use of 3-D Secure (3DS) for high-risk transactions.
- Reduce non-fraud chargebacks. Non-fraud chargebacks also count toward HDM/EDM. Reduce service-related disputes through accurate product descriptions, on-time fulfillment, end-to-end trackable logistics, reasonable refund policies and rapid handling of customer complaints.
- Prepare a standard operating procedure (SOP) for threshold breaches. Once a threshold is exceeded, the assessment increases month by month, and three consecutive compliant months are required to exit monitoring: the faster the remediation, the lower the cost. Be ready at the same time to submit remediation reports in cooperation with your acquirer.
- Remediate high-risk business models. Merchants whose dispute rate has long hovered just below the threshold, or whose model relies on misleading marketing, should first remediate the underlying business. For such merchants, the retroactive liability under EDM and the publication of the EDM merchant list can be severely damaging.
Note: This article summarizes Mastercard Bulletin GLB 14127.1, Revised Standards for the Acquirer Chargeback Monitoring Program (ACMP), the Global Merchant Audit Program (GMAP) and the Questionable Merchant Audit Program (QMAP). It is provided for general information only and does not replace the Mastercard Standards or the official bulletin, which prevail in the event of any discrepancy.