Le programme GMAP de Mastercard vient de redéfinir les règles en matière de rétrofacturation. Voici ce qui change concrètement pour vous.

Dated provider guidance describes Mastercard’s plan to retire its patchwork of fraud and dispute monitoring programs and replace them with one unified framework: the Global Merchant Audit Program, or GMAP. Finby’s September 21, 2026 guidance and payabl.’s August 20, 2026 guidance give April 1, 2027 as the planned start date.

Sources: Finby’s September 2026 GMAP guidance, which identifies Mastercard GLB 14127.1 dated July 28, 2026, and payabl.’s August 2026 merchant guidance. The underlying bulletin was not inspected for this article; the details are future provider-reported parameters, not a certification of the whole bulletin. Confirm current dates, criteria and assessments with your acquirer.

If you’ve been tracking Visa’s Acquirer Monitoring Program (VAMP) rollout, the shape of this will feel familiar. Mastercard is doing what Visa already did: collapsing separate fraud and dispute scorecards into one combined ratio. Visa’s VAMP replaced the Visa Dispute Monitoring Program (VDMP) and the Visa Fraud Monitoring Program (VFMP). GMAP introduces four new monitoring categories, restructures how submerchants get tracked, and adds new financial assessment schedules for both merchants and acquirers.

Here is what the dated provider guidance reports and how to prepare while confirming the applicable network notice.

Ce que GMAP remplace, et ce qu'il conserve

According to Finby’s September 2026 guidance, GMAP is planned to absorb ACMP and carry forward Mastercard’s EFM, ECM and HECM categories. These are reported future arrangements, subject to the applicable network notice.

Quatre nouvelles catégories viennent s'ajouter à cela, et c'est là que GMAP mérite d'être comparé à VAMP :

• « Commerçant à fort taux de litiges » (HDM) et « Commerçant à taux excessif de litiges » (EDM) : catégories au niveau du commerçant qui regroupent les litiges liés à la fraude et ceux non liés à la fraude en un seul ratio
• Acquéreur à fort taux de litiges (HDA) et acquéreur à taux excessif de litiges (EDA) : catégories au niveau du portefeuille qui tiennent les acquéreurs responsables des commerçants qu’ils acceptent

Under the combined measure described by Finby, reported fraud can contribute even when it never becomes a chargeback. Keep your chargeback ratio as an operational metric, while tracking reported fraud alongside non-fraud chargebacks, and confirm the counting rules and reporting periods with your acquirer.

Finby describes reported fraud as data in Mastercard’s Fraud & Loss Database (FLD), including fraud that does not become a chargeback. Its reported GMAP ratio adds current-month fraud-report and non-fraud-chargeback counts, then divides by the previous month’s sales count; combined monetary value is a separate condition. Confirm the official report definitions with your acquirer.

Le seuil de l'ECM se resserre progressivement, par étapes

payabl.’s August 2026 guidance describes a future reduction of the ECM threshold floor in stages from 2029 through 2031:

The reported 150-to-90-basis-point floor schedule is a 40% reduction: (150 − 90) ÷ 150. payabl. says the 100-chargeback minimum remains. This arithmetic does not independently verify the announcement; confirm the applicable ECM and HECM criteria with your acquirer. For today’s limits, see chargeback thresholds for Visa VAMP and Mastercard ECM.

payabl.’s dated guidance says monitoring is planned to shift to the submerchant ID where one is available, instead of the shared Merchant ID (MID). For a business processing under a payment facilitator, this means a high-risk submerchant is tracked individually, rather than blended into the aggregate numbers of other submerchants sharing the same MID. Platforms that manage disputes for submerchants should also read our guide to chargeback management for payment platforms. Platforms run their own programs too, such as the Shopify Network Dispute Resolution Program (NDRP).

Le HDM et l'EDM permettent de repérer les commerçants que les anciennes règles ne prenaient pas en compte

Finby reports that the future HDM and EDM merchant tests require all three conditions during the month: at least five cleared transactions, the applicable combined fraud/non-fraud-chargeback value floor, and the count-based ratio against the previous month’s sales. Five transactions alone do not identify a merchant. The table summarizes that dated guidance:

Those reported HDM/EDM gates concern merchants; they must not be applied to the distinct HDA/EDA acquirer categories. Check all applicable value, count and ratio conditions rather than inferring identification from a small transaction count.

The reported financial consequences depend on category and identification month. Finby’s September 2026 guidance gives the monthly schedules below; the actual notice governs assessments and any pass-through terms.

Read this as Finby’s reported future monthly assessment schedule, not a single fee applied immediately to every merchant:

Use the identification month specified for the relevant category and reconcile the schedule with your acquirer’s actual notice. These figures are attributed to Finby’s dated guidance; the underlying bulletin and account-specific billing treatment were not inspected here. These assessments are separate from per-case fees such as Mastercard’s Dispute Administration Fee.

Finby’s dated guidance reports additional fraud-chargeback liability after two months of EDM identification, covering transactions from the three months before identification and fraudulent transactions during the following six months. It says Mastercard may allow issuers to use reason code 4849 to recover the relevant transaction amount. This is a reported fraud-related scope, not permission to recover every kind of dispute; confirm the actual identification and liability terms with your acquirer.

Les acquéreurs sont eux aussi tenus responsables

Les acquéreurs dont les portefeuilles de commerçants présentent une concentration élevée de risques sont les plus exposés au titre de ces seuils. Certains acquéreurs peuvent appliquer des limites internes en matière de rétrofacturation plus strictes que les seuils fixés par Mastercard; il est donc recommandé de vérifier directement auprès de votre acquéreur quelles limites, le cas échéant, s'appliquent à votre compte.

Finby confirms that HDA and EDA are planned portfolio-level acquirer categories. The numeric ratio, activity floors and licence-action schedule are not verified from the underlying notice here. Obtain the applicable acquirer notice before treating any industry-summary number as an enrollment or penalty rule.

Acquirer assessments, review obligations and potential licence action depend on the applicable network notice and identification history. Do not derive an acquirer’s deadlines or consequences from the merchant EDM assessment schedule.

How Reason Code 4849 Connects to the Acquirer Consequence Ladder

Reason code 4849 is the line item that turns EDM status into real financial exposure, and it links straight through to your acquirer's own risk profile. Here's how one merchant's dispute activity escalates, step by step:

Attribution of reason code 4849 is inconsistent across industry sources, some tie it to QMAP rather than GMAP. Mastercard's own Chargeback Guide (Merchant Edition) is the authoritative reference for reason code definitions and should be checked directly rather than relying on any single third-party summary.

For a merchant, the practical read is this: your dispute activity doesn't stop at your own GMAP status. It feeds your acquirer's HDA/EDA ratio, and a bad enough portfolio can put your acquirer's own Mastercard license at risk, which is exactly why acquirers move to offboard high-risk merchants long before a Franchise Management Program review becomes a real possibility.

QMAP gagne lui aussi en efficacité

À la même date d’avril 2027, Mastercard va renforcer son programme d’audit des commerçants suspects (QMAP). Le seuil minimal de volume de transactions pour qu’un dossier soit soumis au QMAP passe de 50 000 $ à 10 000 $, et le délai standard d’examen d’un dossier est ramené de 120 jours à 30 (prolongeable jusqu’à 60). Mastercard supprime également la règle qui limitait l'identification de certains commerçants aux entreprises créées depuis moins de six mois, ce qui signifie que les comptes plus anciens et bien établis ne sont désormais plus exemptés de contrôle au seul motif de leur ancienneté.

GMAP vs. GRIP, GCMS, SMMP, and QMAP: Sorting Out Mastercard's Acronym Soup

A notice or headline that mentions Mastercard and a string of capital letters doesn't automatically mean GMAP. Mastercard runs several distinct programs with overlapping names, and merchants routinely misattribute one for another. Here's how the ones most often confused with GMAP actually relate to it.

What Is the Mastercard Global Risk Investigation Program (GRIP)?

GRIP is not a GMAP category. It's the notice track Mastercard uses when it has already flagged a merchant account for suspected fraudulent activity at the network level, ahead of any acquirer-side investigation. A GRIP letter arriving at your acquirer is one of the recognized triggers for an SMMP investigation, with a 72-hour window to act. If you receive a GRIP-related notice, treat it as a scam-monitoring event, not a GMAP dispute-ratio event, since the response process and consequences differ.

What Is Mastercard GCMS?

GCMS is the Global Clearing Management System, Mastercard's back-end infrastructure for clearing and settling transactions between acquirers and issuers. It has nothing to do with chargeback or fraud monitoring. Merchants confuse it with GMAP purely on acronym similarity; operationally, the two share no thresholds, no scoring, and no consequences.

Chargeflow has a full breakdown of Mastercard's other major 2026 enforcement track, the Scam Merchant Monitoring Program (SMMP), including the 72-hour investigation window, the GRIP letter trigger, and what documentation acquirers expect during a review.

Ce qu’il faut retenir : la fraude et les litiges sont désormais regroupés sous un seul chiffre

Que vous traitiez principalement les paiements via Mastercard, Visa ou les deux, ces deux réseaux de cartes s’éloignent d’un suivi cloisonné des fraudes et des litiges pour s’orienter vers un score de risque unique et combiné, étendant cette analyse jusqu’au niveau du sous-commerçant et jusqu’à celui de l’acquéreur. La prévention de la fraude et la résolution des litiges doivent désormais s’appuyer sur les mêmes données, en temps réel, car GMAP les évalue conjointement.

Chargeback and fraud tools often live in separate systems, reported on separate dashboards, owned by separate teams. GMAP counts your fraud rate and your dispute rate as one line item regardless of how those teams are organized, so track the source events together while retaining the applicable reporting periods and denominators. An assessment depends on the relevant criteria, identification month and notice; a dashboard gap alone does not establish one.

Comment se préparer à GMAP

Il n'est pas nécessaire d'attendre 2027 pour cela. Voici la liste de contrôle pratique à suivre dès maintenant, avant le début de votre premier décompte mensuel.

Comment Chargeflow ce fossé avant que cela ne vous coûte cher

That checklist is exactly what Chargeflow’s Chargeback OS runs for you, treating fraud prevention, dispute resolution, and chargeback ratio management as one connected system instead of three disconnected tools.

Prevention that moves the ratio before it is tested. Chargeflow’s Alerts product is powered by both Visa and Mastercard alert networks and can cut chargebacks by up to 90%, starting within 24 hours of activation. Preventing a formal chargeback does not guarantee that an issuer fraud report disappears from the combined metric described by Finby. Confirm how the resolution affects the actual merchant and acquirer reports. Under a framework where a handful of disputes can trigger HDM status, prevention is one of the most direct ways to keep disputes off your ratio.

Recovery that doesn't waste your remaining margin. For chargebacks that do get filed, Chargeflow Intelligence automatically gathers and organizes evidence across 1,000+ enriched data points, tailored to your specific business and transaction types, with a 100% submission rate and no missed deadlines. Because Chargeflow's pricing is success-based, you only pay when a case is recovered, so testing your defenses against GMAP's new categories costs nothing if it doesn't work.

Visibility across the number that now matters. Chargeflow's Insights dashboard gives you a single view of chargeback ratio thresholds and proactive AI recommendations, so you can see your combined fraud-and-dispute exposure the same way GMAP will score it, well before a monthly counter starts and long before an audit opens.

Les commerçants qui traitent la fraude et les litiges comme un seul et même indicateur, qu’ils suivent en permanence et sur lequel ils agissent immédiatement, s’exposent moins aux risques dans le cadre du programme GMAP. C’est le modèle sur lequel Chargeflow construit dès le départ.

Foire aux questions sur GMAP

À partir de quand le programme GMAP de Mastercard entre-t-il en vigueur ?

Finby’s September 2026 guidance and payabl.’s August 2026 guidance report April 1, 2027 as the planned GMAP start. payabl. describes separate ECM floor reductions in 2029, 2030 and 2031. Confirm current implementation dates with your acquirer.

What is Mastercard’s Excessive Chargeback Merchant (ECM) program?

ECM is Mastercard’s chargeback-monitoring category. payabl.’s August 2026 guidance reports a retained 100-chargeback minimum and a future floor schedule of 150 bps through 2028, 130 bps in 2029, 110 bps in 2030 and 90 bps in 2031. The reported ECM band ends at 299 bps. Confirm the applicable count, ratio, reporting periods and separate HECM criteria with your acquirer instead of treating that schedule as a complete identification rule.

Quelle est la différence entre l'ECM et les nouvelles catégories HDM/EDM ?

payabl. reports that the 100-chargeback minimum remains for ECM. Finby describes future HDM/EDM merchant tests with at least five cleared transactions in the month, plus the applicable combined-event value and ratio gates. Its ratio compares current-month reported-fraud plus non-fraud-chargeback counts with the previous month’s sales count. All applicable conditions must be met; the five-transaction floor is not an acquirer rule.

Le programme GMAP remplace-t-il le programme de suivi des rétrofacturations des acquéreurs (ACMP) ?

That is the planned transition described in Finby’s September 2026 guidance: ACMP evolves into GMAP, carrying EFM, ECM and HECM and adding HDM, EDM, HDA and EDA. Confirm the current program version with your acquirer.

Que se passe-t-il si un commerçant est signalé comme « commerçant présentant un nombre excessif de litiges » (EDM) ?

Finby reports the future EDM monthly schedule as $5,000 in identification month 1, $25,000 in month 2, $100,000 in months 3–11, $200,000 in months 12–18 and $300,000 from month 19. Its guidance also describes additional fraud-related liability after two months of EDM identification, with a three-month look-back and six-month forward period. Confirm the applicable notice and liability scope; these are not universal fees on every dispute.

Le programme GMAP est-il similaire au programme VAMP de Visa ?

Yes. Both card networks are moving away from separate fraud and dispute scorecards toward one combined risk ratio that scores fraud and non-fraud disputes together. See Visa’s new VAMP rules for how Visa’s version works.