GMAP van Mastercard heeft de regels voor terugboekingen volledig herzien. Dit is wat er voor u concreet verandert.

Dated provider guidance describes Mastercard’s plan to retire its patchwork of fraud and dispute monitoring programs and replace them with one unified framework: the Global Merchant Audit Program, or GMAP. Finby’s September 21, 2026 guidance and payabl.’s August 20, 2026 guidance give April 1, 2027 as the planned start date.

Sources: Finby’s September 2026 GMAP guidance, which identifies Mastercard GLB 14127.1 dated July 28, 2026, and payabl.’s August 2026 merchant guidance. The underlying bulletin was not inspected for this article; the details are future provider-reported parameters, not a certification of the whole bulletin. Confirm current dates, criteria and assessments with your acquirer.

If you’ve been tracking Visa’s Acquirer Monitoring Program (VAMP) rollout, the shape of this will feel familiar. Mastercard is doing what Visa already did: collapsing separate fraud and dispute scorecards into one combined ratio. Visa’s VAMP replaced the Visa Dispute Monitoring Program (VDMP) and the Visa Fraud Monitoring Program (VFMP). GMAP introduces four new monitoring categories, restructures how submerchants get tracked, and adds new financial assessment schedules for both merchants and acquirers.

Here is what the dated provider guidance reports and how to prepare while confirming the applicable network notice.

Wat GMAP vervangt, en wat het behoudt

According to Finby’s September 2026 guidance, GMAP is planned to absorb ACMP and carry forward Mastercard’s EFM, ECM and HECM categories. These are reported future arrangements, subject to the applicable network notice.

Four new categories get added on top, and this is where GMAP earns its comparison to VAMP:

• High Dispute Merchant (HDM) en Excessive Dispute Merchant (EDM): categorieën op handelaarsniveau waarin zowel frauduleuze als niet-frauduleuze geschillen worden samengevoegd tot één enkele ratio
• Acquirers met veel geschillen (HDA) en acquirers met buitensporig veel geschillen (EDA): categorieën op portefeuilleniveau waarmee acquirers verantwoordelijk worden gehouden voor de handelaren die zij accepteren

Under the combined measure described by Finby, reported fraud can contribute even when it never becomes a chargeback. Keep your chargeback ratio as an operational metric, while tracking reported fraud alongside non-fraud chargebacks, and confirm the counting rules and reporting periods with your acquirer.

Finby describes reported fraud as data in Mastercard’s Fraud & Loss Database (FLD), including fraud that does not become a chargeback. Its reported GMAP ratio adds current-month fraud-report and non-fraud-chargeback counts, then divides by the previous month’s sales count; combined monetary value is a separate condition. Confirm the official report definitions with your acquirer.

The ECM Threshold Is Getting Tighter, in Stages

payabl.’s August 2026 guidance describes a future reduction of the ECM threshold floor in stages from 2029 through 2031:

The reported 150-to-90-basis-point floor schedule is a 40% reduction: (150 − 90) ÷ 150. payabl. says the 100-chargeback minimum remains. This arithmetic does not independently verify the announcement; confirm the applicable ECM and HECM criteria with your acquirer. For today’s limits, see chargeback thresholds for Visa VAMP and Mastercard ECM.

payabl.’s dated guidance says monitoring is planned to shift to the submerchant ID where one is available, instead of the shared Merchant ID (MID). For a business processing under a payment facilitator, this means a high-risk submerchant is tracked individually, rather than blended into the aggregate numbers of other submerchants sharing the same MID. Platforms that manage disputes for submerchants should also read our guide to chargeback management for payment platforms. Platforms run their own programs too, such as the Shopify Network Dispute Resolution Program (NDRP).

HDM en EDM leggen handelaars vast die de oude regels niet in acht namen

Finby reports that the future HDM and EDM merchant tests require all three conditions during the month: at least five cleared transactions, the applicable combined fraud/non-fraud-chargeback value floor, and the count-based ratio against the previous month’s sales. Five transactions alone do not identify a merchant. The table summarizes that dated guidance:

Those reported HDM/EDM gates concern merchants; they must not be applied to the distinct HDA/EDA acquirer categories. Check all applicable value, count and ratio conditions rather than inferring identification from a small transaction count.

The reported financial consequences depend on category and identification month. Finby’s September 2026 guidance gives the monthly schedules below; the actual notice governs assessments and any pass-through terms.

Read this as Finby’s reported future monthly assessment schedule, not a single fee applied immediately to every merchant:

Use the identification month specified for the relevant category and reconcile the schedule with your acquirer’s actual notice. These figures are attributed to Finby’s dated guidance; the underlying bulletin and account-specific billing treatment were not inspected here. These assessments are separate from per-case fees such as Mastercard’s Dispute Administration Fee.

Finby’s dated guidance reports additional fraud-chargeback liability after two months of EDM identification, covering transactions from the three months before identification and fraudulent transactions during the following six months. It says Mastercard may allow issuers to use reason code 4849 to recover the relevant transaction amount. This is a reported fraud-related scope, not permission to recover every kind of dispute; confirm the actual identification and liability terms with your acquirer.

Ook de overnemers zijn aansprakelijk

Acquirers with concentrated high-risk merchant portfolios carry the most exposure under these thresholds. Some acquirers may apply internal chargeback limits stricter than Mastercard’s own thresholds, so it is worth confirming directly with your acquirer what limits, if any, apply to your account.

Finby confirms that HDA and EDA are planned portfolio-level acquirer categories. The numeric ratio, activity floors and licence-action schedule are not verified from the underlying notice here. Obtain the applicable acquirer notice before treating any industry-summary number as an enrollment or penalty rule.

Acquirer assessments, review obligations and potential licence action depend on the applicable network notice and identification history. Do not derive an acquirer’s deadlines or consequences from the merchant EDM assessment schedule.

How Reason Code 4849 Connects to the Acquirer Consequence Ladder

Reason code 4849 is the line item that turns EDM status into real financial exposure, and it links straight through to your acquirer's own risk profile. Here's how one merchant's dispute activity escalates, step by step:

Attribution of reason code 4849 is inconsistent across industry sources, some tie it to QMAP rather than GMAP. Mastercard's own Chargeback Guide (Merchant Edition) is the authoritative reference for reason code definitions and should be checked directly rather than relying on any single third-party summary.

For a merchant, the practical read is this: your dispute activity doesn't stop at your own GMAP status. It feeds your acquirer's HDA/EDA ratio, and a bad enough portfolio can put your acquirer's own Mastercard license at risk, which is exactly why acquirers move to offboard high-risk merchants long before a Franchise Management Program review becomes a real possibility.

Ook QMAP krijgt meer slagkracht

On the same April 2027 date, Mastercard is tightening the Questionable Merchant Audit Program. The transaction volume floor for a QMAP case drops from $50,000 to $10,000, and the standard case window shrinks from 120 days to 30 (extendable to 60). Mastercard is also removing the rule that limited certain merchant identification to businesses under six months old, meaning older, established accounts are no longer exempt from scrutiny purely by tenure.

GMAP vs. GRIP, GCMS, SMMP, and QMAP: Sorting Out Mastercard's Acronym Soup

A notice or headline that mentions Mastercard and a string of capital letters doesn't automatically mean GMAP. Mastercard runs several distinct programs with overlapping names, and merchants routinely misattribute one for another. Here's how the ones most often confused with GMAP actually relate to it.

What Is the Mastercard Global Risk Investigation Program (GRIP)?

GRIP is not a GMAP category. It's the notice track Mastercard uses when it has already flagged a merchant account for suspected fraudulent activity at the network level, ahead of any acquirer-side investigation. A GRIP letter arriving at your acquirer is one of the recognized triggers for an SMMP investigation, with a 72-hour window to act. If you receive a GRIP-related notice, treat it as a scam-monitoring event, not a GMAP dispute-ratio event, since the response process and consequences differ.

What Is Mastercard GCMS?

GCMS is the Global Clearing Management System, Mastercard's back-end infrastructure for clearing and settling transactions between acquirers and issuers. It has nothing to do with chargeback or fraud monitoring. Merchants confuse it with GMAP purely on acronym similarity; operationally, the two share no thresholds, no scoring, and no consequences.

Chargeflow has a full breakdown of Mastercard's other major 2026 enforcement track, the Scam Merchant Monitoring Program (SMMP), including the 72-hour investigation window, the GRIP letter trigger, and what documentation acquirers expect during a review.

De echte conclusie: fraude en geschillen worden nu in één cijfer weergegeven

Of u nu voornamelijk via Mastercard, Visa of beide verwerkt: beide kaartnetwerken stappen af van het afzonderlijk bijhouden van fraude en geschillen en gaan over op één gecombineerde risicoscore, waarbij dat toezicht zich uitstrekt tot op het niveau van de subhandelaar en tot op het niveau van de acquirer. Fraudepreventie en geschillenbeslechting moeten nu in realtime op basis van dezelfde gegevens werken, omdat GMAP deze gezamenlijk beoordeelt.

Chargeback and fraud tools often live in separate systems, reported on separate dashboards, owned by separate teams. GMAP counts your fraud rate and your dispute rate as one line item regardless of how those teams are organized, so track the source events together while retaining the applicable reporting periods and denominators. An assessment depends on the relevant criteria, identification month and notice; a dashboard gap alone does not establish one.

Hoe maak je je klaar voor GMAP?

None of this requires waiting until 2027. Here is the practical checklist to work through now, before your first monthly counter starts.

Hoe Chargeflow die kloof dicht voordat het u geld kost

That checklist is exactly what Chargeflow’s Chargeback OS runs for you, treating fraud prevention, dispute resolution, and chargeback ratio management as one connected system instead of three disconnected tools.

Prevention that moves the ratio before it is tested. Chargeflow’s Alerts product is powered by both Visa and Mastercard alert networks and can cut chargebacks by up to 90%, starting within 24 hours of activation. Preventing a formal chargeback does not guarantee that an issuer fraud report disappears from the combined metric described by Finby. Confirm how the resolution affects the actual merchant and acquirer reports. Under a framework where a handful of disputes can trigger HDM status, prevention is one of the most direct ways to keep disputes off your ratio.

Recovery that doesn't waste your remaining margin. For chargebacks that do get filed, Chargeflow Intelligence automatically gathers and organizes evidence across 1,000+ enriched data points, tailored to your specific business and transaction types, with a 100% submission rate and no missed deadlines. Because Chargeflow's pricing is success-based, you only pay when a case is recovered, so testing your defenses against GMAP's new categories costs nothing if it doesn't work.

Inzicht in het cijfer dat er nu toe doet. Het Insights-dashboard van Chargeflow biedt u één overzicht van de drempelwaarden voor chargeback-ratio’s en proactieve AI-aanbevelingen, zodat u uw totale blootstelling aan fraude en geschillen kunt zien op dezelfde manier als GMAP deze beoordeelt, ruim voordat de maandelijkse telling begint en lang voordat een audit van start gaat.

Merchants that treat fraud and disputes as one number, tracked continuously and acted on immediately, carry less exposure under GMAP. That is the model Chargeflow has been built around from the start.

Veelgestelde vragen over GMAP

Wanneer treedt het GMAP-programma van Mastercard in werking?

Finby’s September 2026 guidance and payabl.’s August 2026 guidance report April 1, 2027 as the planned GMAP start. payabl. describes separate ECM floor reductions in 2029, 2030 and 2031. Confirm current implementation dates with your acquirer.

What is Mastercard’s Excessive Chargeback Merchant (ECM) program?

ECM is Mastercard’s chargeback-monitoring category. payabl.’s August 2026 guidance reports a retained 100-chargeback minimum and a future floor schedule of 150 bps through 2028, 130 bps in 2029, 110 bps in 2030 and 90 bps in 2031. The reported ECM band ends at 299 bps. Confirm the applicable count, ratio, reporting periods and separate HECM criteria with your acquirer instead of treating that schedule as a complete identification rule.

Wat is het verschil tussen ECM en de nieuwe HDM/EDM-categorieën?

payabl. reports that the 100-chargeback minimum remains for ECM. Finby describes future HDM/EDM merchant tests with at least five cleared transactions in the month, plus the applicable combined-event value and ratio gates. Its ratio compares current-month reported-fraud plus non-fraud-chargeback counts with the previous month’s sales count. All applicable conditions must be met; the five-transaction floor is not an acquirer rule.

Vervangt GMAP het Acquirer Chargeback Monitoring Program (ACMP)?

That is the planned transition described in Finby’s September 2026 guidance: ACMP evolves into GMAP, carrying EFM, ECM and HECM and adding HDM, EDM, HDA and EDA. Confirm the current program version with your acquirer.

What happens if a merchant is flagged as an Excessive Dispute Merchant (EDM)?

Finby reports the future EDM monthly schedule as $5,000 in identification month 1, $25,000 in month 2, $100,000 in months 3–11, $200,000 in months 12–18 and $300,000 from month 19. Its guidance also describes additional fraud-related liability after two months of EDM identification, with a three-month look-back and six-month forward period. Confirm the applicable notice and liability scope; these are not universal fees on every dispute.

Is GMAP similar to Visa’s VAMP program?

Yes. Both card networks are moving away from separate fraud and dispute scorecards toward one combined risk ratio that scores fraud and non-fraud disputes together. See Visa’s new VAMP rules for how Visa’s version works.