In the world of mid-to-high risk ecommerce, “merchant account termination” is often treated like an unpredictable natural disaster. In reality, it is the predictable outcome of failing to align with the rigid—and often opaque—rules of the card schemes.
As an SME merchant, you operate within an ecosystem governed by Visa and Mastercard. Because these schemes are membership clubs, their direct communication is with their members (the acquirers), not you. Consequently, the scheme rulebooks are written for financial institutions, leaving merchants to rely on their acquirer for interpretation. Whether you use Shopify Payments, Stripe, Worldpay, or a direct bank, your acquirer is the Scheme’s enforcer. If they fail to hold you to these rules, they face catastrophic fines. To maintain continuity, you must master the three pillars of Scheme compliance: Qualification, Transparency, and Behavioural Monitoring.
1. Qualification: The “Merchant Outlet Location”
The Merchant Outlet Location rule is an often misunderstood requirement that blocks many approvals before they even start. It is the primary reason global ecommerce businesses find themselves unable to secure stable processing.
The Functional Grasp Principle
The Scheme rules mandate that a merchant must use its Principal Place of Business (PPOB) as the merchant outlet location. This is designed to hold the merchant accountable to the customer by ensuring they are subject to local laws, consumer protections, taxes, and legal venues within the functional grasp of the buyer.
What Constitutes an “Outlet”?
An outlet must be a permanent location where the employees or agents accountable for the sale or distribution of goods actually work.
- Non-Compliant: A PO Box, a mail-forwarding “virtual office,” or the address of your law firm does not constitute an outlet.
Jurisdictional Mismatch: A common trigger for termination occurs when a UK-registered merchant sells exclusively, or in the substantial majority, to US customers. This creates a jurisdictional mismatch that violates the “Area of Use” principle, as the merchant is effectively operating outside their licensed territory.
Read about how to prove your operating location.
2. Transparency: Website Disclosures Mandate
Acquirers view your website as a legal contract. Because scheme rules are not directly communicated to you, the burden of ensuring your site provides the “full scope” of information falls on your shoulders. If a customer cannot make a fully informed decision, the transaction is considered deceptive by default.
The Essential Disclosure Checklist
To pass a compliance audit, your site must prominently display:
- Full Company Identity: Legal business name, registration number, registered country, and physical registered address (typically in the footer).
- Contact & Support: Clear contact information (email and/or phone) and direct links to Terms & Conditions and Privacy Policies.
- Transactional Detail: The final amount to be charged, including all adjustments or surcharges, must be shown in the selected currency immediately prior to the final “Pay” button.
- Policy Granularity: Within your terms and conditions and dedicated policy pages, you must explicitly detail the core contractual terms of the sale, including:
- Shipping Policy: Clear delivery timelines, methods, and any geographic restrictions.
- Cancellation Policy: The specific timeframe and procedure for a customer to cancel an order or service.
- Refunds and Returns Policy: A step-by-step procedure for returning goods and the conditions under which a refund is granted.
- Governing Law: The specific legal jurisdiction and venue for dispute resolution.
Requirements for Subscription Merchants
If you are using recurring billing, requirements strongly favor the customer. You must explicitly disclose:
- The exact length of any trial and the specific transaction amounts/timing of all subsequent billing.
Proactive Notification: Rebill notifications and “one-click” cancellation rights are mandatory. Failure to observe these will cause fraud flags to spiral, triggering an immediate investigation.
Find out how acquirers assess your website in our guide to merchant account approval.
3. The Math of Survival: VAMP (Visa) and Scam Monitoring (Mastercard)
The Card Schemes have moved monitoring of refunds, chargebacks, and fraud from retrospective reporting to real-time enforcement.
- Visa VAMP: Monitors your (Total Fraud + Total Disputes) / Total Sales. While the merchant threshold is 1.5%, your acquirer is under pressure at 0.5%. They will often terminate a merchant early to protect their own portfolio average.
Mastercard “Scam Merchant” Rules: Effective July 2026, Mastercard requires a 72-hour investigation if a new merchant hits a 5% combined refund and chargeback ratio. If deceptive practices are confirmed, processing is blocked immediately.
The Credibility Map: Underwriting Red Flags
When assessing your application and while you are processing, underwriters build a “credibility map” to determine if you are a serious operator. Red flags signify that a merchant may be willing to deceive or is not a professional enterprise.
Key Red Flags Include:
- Incomplete Disclosures: The lack of proper company identification, missing registration numbers, or the absence of clear contact information is a major red flag that signals an unvetted or high-risk operation.
- False or Misleading Founder Stories: Creating fictional narratives about the brand’s origins—often used to gain sympathy or promote a manufactured sense of sorority or fraternity—is a common indicator of a non-serious operator or a deliberate attempt to deceive.
- Provenance & Story: Claiming a product origin story like “Made in the UK” when shipping data shows it originates from Shenzhen. You do not have to highlight your supply chain, but you cannot lie about it.
- Unverified Social Proof: Claims of “thousands of satisfied customers” on a newly registered domain, or unverifiable numbers of Trustpilot reviews that do not align with the business’s age or traffic.
- Misleading Scale: Using false images of physical storefronts to imply a brick-and-mortar presence that does not exist.
Learn how underwriters assess your business with our full underwriting checklist.
The “Aggregator” Risk vs. The CardCorp Strategy
Shopify is undoubtedly the world’s greatest ecommerce platform. However, the combination of Shopify + Shopify Payments (or Stripe) can be a lethal combination for a growing business. On these platforms, you are sitting on borrowed approval from an aggregator. You do not have your own fully vetted approval from an appropriately risk-tuned acquirer; you are a number in a pool, and when the algorithm sees a red flag, it cuts you off.
The Path to Processing Certainty
Partnering with CardCorp provides a clear framework for long-term stability. We assist merchants in moving from “borrowed approval” to processing certainty through:
- Direct MIDs: We assist in securing direct, fully vetted Merchant IDs, ensuring your business is judged on its own merits.
- Red Flag Detection: We analyze your “credibility map” to detect red flags and provide specific guidance on how to mitigate them before an underwriter sees your application.
- The Chopify Bridge: Our app lets you keep the world-class conversion of Shopify while utilising a direct, risk-aligned acquiring backbone.
By taking careful note of the framework set out in this article, you can understand how an underwriter considers your risk factors. CardCorp provides the expertise to help you successfully navigate the scheme rules and build a fortress around your ability to accept payments.
Don’t leave your business continuity to an aggregator’s algorithm. Let CardCorp guide you through the Scheme Rules.