Global Merchant Audit Program (GMAP)Mastercard Fraud & Dispute Monitoring: What’s Changing in 2027 & Beyond

A Complete Guide to the Global Merchant Audit Program, QMAP, & the Acquirer Collaboration Decommission

In July 2026, Mastercard announced that they were conducting the most significant structural overhaul of their fraud and dispute monitoring framework in years.

The announcements covered program rule changes, the decommissioning of an existing dispute management solution, and its replacement by an enhanced Global Merchant Audit Program (GMAP) and Questionable Merchant Audit Program (QMAP). The aim, as they suggest, is to create a more unified, data-driven, and adaptable compliance environment.

Mastercard will introduce phased changes from January 2027 through January 2031. This is not a single change; it’s a phased overhaul of multiple programs. Here’s the basic timeline:

Understanding these changes matters, whether you’re currently inside a monitoring program or well below its thresholds. They’ll impact how disputes are measured across the board, expand enforcement reach to merchants who were previously outside QMAP scope, and put merchants on a multi-year trajectory toward stricter standards regardless of what happens to their dispute volume.

It can all be rather confusing, though. So, I created this guide to cover what’s changing, when, and what it means in practical terms.

What is the Global Merchant Audit Program (GMAP)?

Global Merchant Audit Program

[noun]/ɡlō • bəl • mər • CHənt • ô • dət • prō • ɡram/

GMAP is Mastercard’s new unified fraud and dispute monitoring program, effective April 1, 2027. It applies globally to any merchant or acquirer processing Mastercard transactions and tracks both fraud and non-fraud disputes together in a single performance metric.

So, let’s start with a basic overview of the new program.

The Global Merchant Audit Program is Mastercard’s framework for monitoring merchant and acquirer performance across their network. It replaces the Acquirer Chargeback Monitoring Program (ACMP), effective April 1, 2027, and takes a more comprehensive approach to measuring dispute and fraud activity.

What makes GMAP structurally different from its predecessor is the unified measurement model. Mastercard formerly tracked fraud and chargebacks through separate programs — the Excessive Chargeback Merchant (ECM), High Excessive Chargeback Merchant (HECM), and Excessive Fraud Merchant (EFM) — each with separate thresholds for “acceptable” chargeback or fraud volume.

Fraud-based monitoring and chargeback-based monitoring were separate programs with separate thresholds. A merchant could theoretically stay below each individual limit while their combined dispute-plus-fraud exposure was elevated. These programs aren’t going away in the near future; instead, they will operate side-by-side with GMAP.

The new rules close a gap by looking at the total of reported fraud and non-fraud chargebacks together, relative to sales volume. GMAP combines confirmed fraud activity — including fraud that doesn't result in a chargeback — and non-fraud dispute activity into a single performance view. That combined metric is then evaluated against predefined thresholds. This determines whether a merchant or acquirer is in violation.

The program applies globally to all merchants and acquirers processing Mastercard, Debit Mastercard, Maestro, and Cirrus transactions. Monitoring occurs at two levels: the merchant (by MID) and the acquirer (by ICA). Each level has its own threshold categories and escalating consequences for sustained non-compliance, which I’ll explain in detail in the next section.

The New Merchant Categories: What HDM & EDM Mean

The Global Merchant Audit Program introduces two new merchant-level monitoring categories — High Dispute Merchant and Excessive Dispute Merchant — each with distinct thresholds, escalating monthly assessments, and progressively severe consequences.

A merchant can be identified as “HDM” in any month it meets all three of the following:

• At least 5 cleared transactions
• $5,000 or more in combined fraud plus non-fraud chargebacks
• An overall chargeback-to-transaction ratio of 5% or higher

You may be assessed a fee if you violate all three of the limits I outlined above. And, these monthly financial assessments escalate the longer you remain in violation:

Number of Months in Violation	Monthly Financial Assessment
Months 1–6	$0 per month
Months 7-11	$5,000 per month
Months 12-18	$10,000 per month
19 Months or More	$25,000 per month

HDM identification also triggers an issuer notification mechanism. Mastercard is free to notify issuers if a merchant exceeds the HDM threshold for two or more consecutive months.

A merchant is identified as an EDM in any month it meets all three of the following:

• At least 5 cleared transactions
• $10,000 or more in combined fraud plus non-fraud chargebacks
• An overall chargeback-to-transaction ratio of 50% or higher

Monthly financial assessments under EDM are significantly more severe. That makes sense, though, given the fact that, in order to even qualify as “excessive,” you need to have a chargeback rate of 50% of transactions:

Number of Months in Violation	Monthly Financial Assessment
Month 1	$5,000
Month 2	$25,000
Months 3-11	$100,000 per month
Months 12-18	$200,000 per month
19 Months or More	$300,000 per month

EDM identification carries consequences beyond assessments. If you exceed the EDM threshold for two months, you become liable for all fraud-related chargebacks associated with transactions occurring during the three months before identification, plus during the subsequent six months.

Mastercard publishes a list of EDM merchants each month. Issuers can file chargebacks using reason code 4849 (Questionable Merchant Activity) against any merchant on that list to recover 100% of the transaction amount on qualifying transactions within that window.

Acquirer-Level Monitoring Is New Territory

The new acquirer-level categories — High Dispute Acquirer (HDA) and Excessive Dispute Acquirer (EDA) — monitor performance at the acquirer level.

HDA applies when an acquirer records at least 1,500 fraud or non-fraud chargebacks in a month, and has a chargeback-to-transaction ratio of 0.5% or more. Acquirers that violate both of these limits will be subject to monthly assessments, which will be applied for each month in which the FI is non-compliant.

Number of Months in Violation	Monthly Financial Assessment
Months 1–11	$0 per month
Months 12-18	$25,000 per month
19 Months or More	$50,000 per month

In other words, acquirers are allowed to go up to 11 months without paying a penalty. Beginning in the 12th month of noncompliance, though, Mastercard will start assessing heavy penalties.

EDA applies when an acquirer records all of the following in a given month:

• At least 1,500 cleared transactions
• At least 1,500 chargebacks (both fraud and non-fraud)
• A chargeback-to-transaction ratio of 0.7% or more.

Acquirers that violate all three limits will be subject to the following penalties for each month in which they remain non-compliant:

Number of Months in Violation	Monthly Financial Assessment
Month 1-2	$0 per month
Month 3-6	$10,000 per month
Months 7-11	$25,000 per month
Months 12-18	$50,000 per month
19 Months or More	$100,000 per month

Acquirers that remain non-compliant for 12 months or more are required to go through a Franchise Management Program review. This will be done at the acquirer’s expense. Continued non-compliance after 19 months can result in added restrictions, up to suspension or termination of the acquirer’s Mastercard license.

So, why should merchants care about this dynamic?

An acquirer whose portfolio is approaching HDA or EDA thresholds will face increasing financial and operational pressure to manage the merchants contributing to those numbers. Merchants with elevated dispute profiles may find their acquirer scrutinizing their relationship more closely. Even if you haven’t violated any limits yourself, the acquirer might try to mitigate their risk by restricting, or even cutting loose any merchants that they believe could pose a threat.

Mastercom Acquirer Collaboration Is Also Being Decommissioned

Mastercom Acquirer Collaboration currently allows issuers, acquirers, and merchants to communicate about and resolve disputes before a formal chargeback is initiated. For merchants and acquirers participating in the Mastercom network, this serves as a pre-dispute interception tool that’s functionally similar to Ethoca Alerts, in that both tools let merchants issue a refund and stop a chargeback before it files. 

Collaboration has been especially helpful in covering transactions that fall outside the Ethoca network, filling a gap in alert coverage. That’s all going away now, though.

Mastercard stopped accepting new users for  Acquirer Collaboration on July 21, 2026. Existing customers have a little more time, with Mastercard letting them continue to use the tool until January 4, 2027. After the effective date, though, the service will cease to function entirely; notifications will be disabled and billing codes set to zero.

Mastercard’s stated rationale is platform consolidation: as it modernizes its dispute infrastructure, existing collaboration capabilities are being replaced by “more advanced, streamlined processes.” What those processes are have not yet really been specified.

QMAP Is Getting Stricter — and Reaching More Merchants

QMAP targets merchants suspected of engaging in deliberate fraud, scam activity, or other deceptive practices. Three changes to its standards take effect April 1, 2027:

So, what does this all mean in a practical sense?

Well, under the revised framework, a merchant is identified as “questionable” if they meet the baseline conditions ($10,000 in volume, at least 5 transactions) and either:

• For bust-out fraud cases: At least 50% of transaction volume involves bust-out cardholder accounts.
• For non-bust-out fraud cases: At least two of three conditions apply (a fraud-to-sales transaction ratio of 70% or higher, 20% or more of transactions declined or referred, or total fraudulent transactions and declines exceeding approved transactions).

The ECM Threshold Is Tightening Through 2031

The Excessive Chargeback Merchant threshold currently identifies merchants with 100 or more chargebacks and a chargeback ratio between 1.5% and 2.99%. That threshold is being reduced on a phased schedule:

Effective Date	New ECM Threshold
January 1, 2029	100+ chargebacks and 1.3% to 2.99%
January 1, 2030	100+ chargebacks and 1.1% to 2.99%
January 1, 2031	100+ chargebacks and 0.9% to 2.99%

A merchant with a chargeback rate of 1.4% today is technically under the threshold for ECM program enforcement. By January 2029, though, that same merchant at that same performance level would breach the ECM threshold.

The sub-merchant ID change could also be meaningful for payment facilitators and their merchants. When a sub-merchant ID is populated in the relevant data element, Mastercard will evaluate that sub-merchant’s dispute and fraud performance independently, instead of rolling it into the facilitator’s aggregate MID. You can’t obscure performance issues at the sub-merchant level within a larger portfolio’s aggregate numbers.

What Merchants Should Do Now

I understand that is all a lot to take in. So, believe I leave you, I wanted to answer the question that’s likely burning on the tip of your tongue right now: what do I actually have to do?

The January 2027 Acquirer Collaboration deadline requires immediate action for merchants relying on that tool for pre-chargeback dispute resolution. The April 2027 GMAP and QMAP changes require merchants to assess their combined fraud-plus-non-fraud dispute profile, not just their chargeback ratio. In both cases, you need to take action before the effective dates (not after).

Any merchant or acquirer using Mastercom Collaboration to intercept disputes outside the Ethoca network should identify replacement coverage now. Verifi CDRN and Ethoca Alerts together provide the broadest available pre-chargeback alert coverage. Waiting until January 2027 leaves no time to integrate, test, and calibrate a new alert solution.

GMAP relies on a metric that most merchants probably aren’t used to tracking as a single number. Pull both your confirmed fraud figures and non-fraud chargebacks, add them together, and calculate that combined total as a percentage of your sales volume. That combined ratio is what the new HDM and EDM thresholds measure. Your fraud and chargeback profile may look okay in isolation, but approach HDM territory when added together.

Your acquirer relationship is the first line of defense in any monitoring program. An acquirer who understands your business, your dispute composition, and your remediation steps is better positioned to provide context to Mastercard when thresholds are breached.

What is your combined chargeback and fraud rate now? Calculate the year in which each threshold step would bring you into ECM range at current performance; if you’re consistently around 1.3% basis points, 2029 is a real deadline. Building a dispute reduction strategy around that timeline is much more manageable than responding to ECM identification after the fact.

The new program rules may complicate the merchant-acquirer relationship, to some degree. But, that’s exactly why close collaboration with your acquirer is more important than ever. Fostering a tighter working relationship will help insulate you, and your acquirer, from runaway disputes.