Mastercard's GMAP Just Rewrote the Chargeback Rulebook. Here's What Actually Changes for You.

Mastercard is retiring its patchwork of fraud and dispute monitoring programs and replacing them with one unified framework: the Global Merchant Audit Program, or GMAP. It takes effect April 1, 2027.

If you’ve been tracking Visa’s Acquirer Monitoring Program (VAMP) rollout, the shape of this will feel familiar. Mastercard is doing what Visa already did: collapsing separate fraud and dispute scorecards into one combined ratio. GMAP introduces four new monitoring categories, restructures how submerchants get tracked, and adds new financial assessment schedules for both merchants and acquirers.

Here's what's actually in it, and what it means for how you run chargeback prevention and recovery between now and 2027.

What GMAP Replaces, and What It Keeps

GMAP absorbs the Acquirer Chargeback Monitoring Program (ACMP) and folds in Mastercard's existing fraud and dispute categories. Three categories carry over largely intact: Excessive Fraud Merchant (EFM), Excessive Chargeback Merchant (ECM), and High Excessive Chargeback Merchant (HECM).

Four new categories get added on top, and this is where GMAP earns its comparison to VAMP:

• High Dispute Merchant (HDM) and Excessive Dispute Merchant (EDM): merchant-level categories that combine fraud and non-fraud dispute activity into a single ratio
• High Dispute Acquirer (HDA) and Excessive Dispute Acquirer (EDA): portfolio-level categories that hold acquirers accountable for the merchants they underwrite

The practical effect: a clean chargeback ratio no longer protects you if your fraud rate is high, and vice versa. Both numbers now count against the same scorecard.

Mastercard is also renaming its SAFE fraud-reporting system to FLD, the Fraud and Loss Database. That is more than a label change: FLD is the same feed that now counts directly toward HDM and EDM status, including fraud that was reported but never resulted in a chargeback.

The ECM Threshold Is Getting Tighter, in Stages

Mastercard isn't dropping the ECM threshold all at once. It's phasing it down over four years, starting in 2029:

By 2031, the threshold that triggers Excessive Chargeback Merchant status will have fallen by 40%. The 100-chargeback minimum stays the same, and HECM status still kicks in at 300+ basis points.

Mastercard is also shifting monitoring to the submerchant ID where one is available, instead of the shared Merchant ID (MID). For any business processing under a payment facilitator, this means a high-risk submerchant is tracked individually, rather than blended into the aggregate numbers of other submerchants sharing the same MID.

HDM and EDM Catch Merchants the Old Rules Missed

ECM has always required a meaningful transaction volume before it applies. HDM and EDM do not. Both categories can trigger with as few as 5 cleared transactions in a month, provided the dollar amount and ratio thresholds are also met:

A small or newer merchant with a handful of bad transactions in a slow month can land in HDM or EDM territory, a volume level that would never have approached ECM’s 100-chargeback floor.

The financial consequences escalate month over month once a merchant is flagged. HDM assessments start at $0 for the first six months, then climb to $5,000, $10,000, and eventually $25,000 monthly. EDM is far less forgiving: assessments start at $5,000 in month one, jump to $25,000 in month two, and hit $100,000 by month three, eventually reaching $300,000 monthly for sustained noncompliance.

The month-over-month progression is the part finance teams need for accrual planning, not just the endpoints. Here's the full ladder for both categories:

HDM and EDM run on independent clocks, since a merchant can be flagged under one, both, or neither depending on which combination of dollar and ratio thresholds it crosses. The stages above track escalation order, not a single shared calendar month between the two categories. Confirm exact figures against Mastercard's Security Rules and Procedures manual before using them for budget commitments, since card-network thresholds move on bulletin cycles.

EDM status also carries retroactive and forward-looking liability. Cross the threshold for two months and you become liable for fraud-related chargebacks going back three months before identification, plus the following six months. Mastercard plans to publish an EDM merchant list, and issuers get access to reason code 4849 to recover 100% of the transaction amount on any dispute during that window.

Acquirers Are on the Hook Too

Acquirers with concentrated high-risk merchant portfolios carry the most exposure under these thresholds. Some acquirers may apply internal chargeback limits stricter than Mastercard’s own thresholds, so it is worth confirming directly with your acquirer what limits, if any, apply to your account.

Specifically, Mastercard sets High Dispute Acquirer (HDA) status at a 0.5% combined fraud-and-dispute ratio and Excessive Dispute Acquirer (EDA) status at 0.7%, with both requiring at least 1,500 cleared transactions and 1,500 combined cases in the review period:

The assessments escalate the longer a portfolio stays over threshold, and the stakes go beyond fees: 12 or more months of noncompliance can trigger a self-funded Franchise Management Program review, and 19 or more months puts restrictions, suspension, or termination of the acquirer’s Mastercard license on the table.

How Reason Code 4849 Connects to the Acquirer Consequence Ladder

Reason code 4849 is the line item that turns EDM status into real financial exposure, and it links straight through to your acquirer's own risk profile. Here's how one merchant's dispute activity escalates, step by step:

Attribution of reason code 4849 is inconsistent across industry sources, some tie it to QMAP rather than GMAP. Mastercard's own Chargeback Guide (Merchant Edition) is the authoritative reference for reason code definitions and should be checked directly rather than relying on any single third-party summary.

For a merchant, the practical read is this: your dispute activity doesn't stop at your own GMAP status. It feeds your acquirer's HDA/EDA ratio, and a bad enough portfolio can put your acquirer's own Mastercard license at risk, which is exactly why acquirers move to offboard high-risk merchants long before a Franchise Management Program review becomes a real possibility.

QMAP Gets Sharper Teeth Too

On the same April 2027 date, Mastercard is tightening the Questionable Merchant Audit Program. The transaction volume floor for a QMAP case drops from $50,000 to $10,000, and the standard case window shrinks from 120 days to 30 (extendable to 60). Mastercard is also removing the rule that limited certain merchant identification to businesses under six months old, meaning older, established accounts are no longer exempt from scrutiny purely by tenure.

GMAP vs. GRIP, GCMS, SMMP, and QMAP: Sorting Out Mastercard's Acronym Soup

A notice or headline that mentions Mastercard and a string of capital letters doesn't automatically mean GMAP. Mastercard runs several distinct programs with overlapping names, and merchants routinely misattribute one for another. Here's how the ones most often confused with GMAP actually relate to it.

What Is the Mastercard Global Risk Investigation Program (GRIP)?

GRIP is not a GMAP category. It's the notice track Mastercard uses when it has already flagged a merchant account for suspected fraudulent activity at the network level, ahead of any acquirer-side investigation. A GRIP letter arriving at your acquirer is one of the recognized triggers for an SMMP investigation, with a 72-hour window to act. If you receive a GRIP-related notice, treat it as a scam-monitoring event, not a GMAP dispute-ratio event, since the response process and consequences differ.

What Is Mastercard GCMS?

GCMS is the Global Clearing Management System, Mastercard's back-end infrastructure for clearing and settling transactions between acquirers and issuers. It has nothing to do with chargeback or fraud monitoring. Merchants confuse it with GMAP purely on acronym similarity; operationally, the two share no thresholds, no scoring, and no consequences.

Chargeflow has a full breakdown of Mastercard's other major 2026 enforcement track, the Scam Merchant Monitoring Program (SMMP), including the 72-hour investigation window, the GRIP letter trigger, and what documentation acquirers expect during a review.

The Real Takeaway: Fraud and Disputes Are Now One Number

Whether you process mostly through Mastercard, Visa, or both, both card networks are moving away from siloed fraud and dispute tracking toward a single combined risk score, extending that scrutiny down to the submerchant and up to the acquirer level. Fraud prevention and dispute resolution now need to work off the same data, in real time, because GMAP scores them together.

Chargeback and fraud tools often live in separate systems, reported on separate dashboards, owned by separate teams. GMAP counts your fraud rate and your dispute rate as one line item regardless of how those teams are organized, so if both are not tracked together today, that gap becomes a monthly assessment starting April 2027.

How to Get GMAP-Ready

None of this requires waiting until 2027. Here is the practical checklist to work through now, before your first monthly counter starts.

• Audit your data sources first. Pull your fraud reports (soon to live in Mastercard’s FLD) and your non-fraud chargebacks into one view. GMAP scores them together, so if your team still tracks them separately, you are already behind the metric Mastercard will use.
• Make sure fraud reports are accurate before they reach FLD. GMAP counts confirmed fraud even when no chargeback was filed, so an inaccurate or miscoded fraud report affects your ratio the same way a confirmed case does. Dispute or correct any flags you believe are wrong rather than leaving them on the record.
• Check where your submerchant IDs actually sit. If you process under a payment facilitator or a shared MID, confirm submerchant-level IDs are populated. GMAP monitors at the submerchant level wherever it can, so a clean parent MID no longer hides a problem account.
• Ask your acquirer where their internal line is, not just Mastercard’s. Acquirers are held to a stricter 0.5% (HDA) or 0.7% (EDA) threshold than any merchant category, and some may apply additional internal limits on top of it.
• Fix the disputes you can prevent outright. Clear refund and cancellation terms, a recognizable billing descriptor, and prevention alerts that resolve a complaint before it becomes a formal chargeback all remove volume from both your fraud rate and your dispute rate at once.
• Put both numbers on one dashboard. Fraud rate and dispute rate need to live in the same view, tracked monthly, because that is the exact shape of the number GMAP will use to flag you.

How Chargeflow Closes That Gap Before It Costs You

That checklist is exactly what Chargeflow’s Chargeback OS runs for you, treating fraud prevention, dispute resolution, and chargeback ratio management as one connected system instead of three disconnected tools.

Prevention that moves the ratio before it is tested. Chargeflow’s Alerts product is powered by both Visa and Mastercard alert networks and can cut chargebacks by up to 90%, starting within 24 hours of activation. Every prevented chargeback never touches your GMAP ratio, your submerchant record, or your acquirer’s portfolio number. Under a framework where a handful of disputes can trigger HDM status, prevention is one of the most direct ways to keep disputes off your ratio.

Recovery that doesn't waste your remaining margin. For chargebacks that do get filed, Chargeflow Intelligence automatically gathers and organizes evidence across 1,000+ enriched data points, tailored to your specific business and transaction types, with a 100% submission rate and no missed deadlines. Because Chargeflow's pricing is success-based, you only pay when a case is recovered, so testing your defenses against GMAP's new categories costs nothing if it doesn't work.

Visibility across the number that now matters. Chargeflow's Insights dashboard gives you a single view of chargeback ratio thresholds and proactive AI recommendations, so you can see your combined fraud-and-dispute exposure the same way GMAP will score it, well before a monthly counter starts and long before an audit opens.

Merchants that treat fraud and disputes as one number, tracked continuously and acted on immediately, carry less exposure under GMAP. That is the model Chargeflow has been built around from the start.

Frequently Asked Questions About GMAP

When does Mastercard’s GMAP take effect?

GMAP takes effect April 1, 2027. The ECM ratio threshold reductions phase in separately, starting in 2029 and completing in 2031.

What is Mastercard’s Excessive Chargeback Merchant (ECM) program?

Excessive Chargeback Merchant (ECM) is a Mastercard chargeback-monitoring category that flags merchants with at least 100 chargebacks in a month and a chargeback-to-transaction ratio inside a set basis-point range. Under GMAP, ECM carries over from the retired Acquirer Chargeback Monitoring Program largely unchanged, but its ratio threshold tightens in stages: 150–299 basis points through 2028, then down to 90–299 basis points by 2031. Merchants that clear 300+ basis points are instead classified as High Excessive Chargeback Merchant (HECM).

What’s the difference between ECM and the new HDM/EDM categories?

ECM requires a minimum of 100 chargebacks before it applies. High Dispute Merchant (HDM) and Excessive Dispute Merchant (EDM) can trigger with as few as 5 cleared transactions in a month if the dollar and ratio thresholds are also met, catching smaller merchants ECM never reached.

Does GMAP replace the Acquirer Chargeback Monitoring Program (ACMP)?

Yes. GMAP absorbs ACMP and folds in Mastercard’s existing fraud and dispute categories (EFM, ECM, HECM), then adds four new ones: HDM, EDM, High Dispute Acquirer (HDA), and Excessive Dispute Acquirer (EDA).

What happens if a merchant is flagged as an Excessive Dispute Merchant (EDM)?

Monthly assessments start at $5,000 and can reach $300,000 for sustained noncompliance. Crossing the EDM threshold for two months also creates retroactive liability for fraud-related chargebacks going back three months, plus the following six.

Is GMAP similar to Visa’s VAMP program?

Yes. Both card networks are moving away from separate fraud and dispute scorecards toward one combined risk ratio that scores fraud and non-fraud disputes together.