How Payment Processors Classify Your Business Vertical (and Why It Matters)

When a business applies for a merchant account or signs up with a payment processor, one of the first things that happens is classification. The processor assigns a four-digit Merchant Category Code (MCC) to the business, and that code determines almost everything that follows: the interchange rate applied to every transaction, whether specific processors will accept the business at all, the level of compliance scrutiny from the card networks, and the reserve requirements the processor will impose.

Most business owners never see their MCC and don't know what it is. That's a problem, because an incorrect classification can cost real money, and a classification in the wrong risk tier can result in the processor closing an account entirely.

What a Merchant Category Code Is

MCCs are four-digit codes defined by ISO 18245, adopted by Visa and Mastercard as the standard way to classify merchant business type. The ISO standard was introduced in 1987. Visa and Mastercard maintain their own versions of the code set, with some minor differences in specific categories.

There are approximately 600 MCC codes in active use. Each one corresponds to a specific type of business. Stripe's MCC reference guide is one of the more readable public databases of active codes. A garden centre and a pharmaceutical retailer both accept card payments, but they operate under different MCCs with different interchange rates and different risk profiles.

When a cardholder pays a garden centre on a Visa Signature Rewards card, the interchange rate might be 1.65% + 10¢. The same card at a pharmaceutical retailer may carry a different rate. Across millions of transactions, these differences are material.

How MCCs are assigned

The acquirer or payment processor assigns the MCC at the point of underwriting. For direct merchant accounts (traditional acquiring relationships), the underwriter reviews the application, understands the business model, and assigns the appropriate code. For payment aggregators like Stripe, Square, or PayPal, MCC assignment happens through automated systems based on the business description provided during sign-up.

Businesses do not choose their own MCC. If you describe your business as software-as-a-service, you may be classified under 7372 (Computer Programming, Data Processing). If you describe it as an online game, you may be classified under 5816. The difference between those two codes is significant in terms of risk classification and processing fees.

Standard MCCs vs High-Risk MCCs

Card networks and processors segment MCCs into risk tiers. The specific names vary by network, but the structure is broadly consistent.

Standard MCCs cover the majority of retail, service, restaurant, hotel, and business-to-business categories. These carry normal interchange rates and receive no additional compliance scrutiny. Examples: 5411 (Grocery stores), 5812 (Restaurants), 7372 (Computer Programming), 4900 (Utilities).

High-risk MCCs are codes that card networks have designated as carrying elevated fraud, chargeback, or regulatory risk. Merchants in these categories face:

• Higher interchange rates on some card types
• Additional compliance requirements under network programs (Visa's VIRP, Mastercard's High-Risk Merchant programs)
• Refusal from many mainstream processors
• Mandatory reserve requirements from acquirers willing to underwrite them

Specific high-risk MCCs and their Visa/Mastercard tier classifications:

Tier 1 under Visa's Integrity Risk Program (VIRP) - which replaced the Global Brand Protection Program in May 2023 - represents the highest compliance obligation. Acquirers accepting Tier 1 merchants must conduct enhanced due diligence, submit merchant information to Visa for registration, and maintain ongoing monitoring reports. This compliance overhead is why most mainstream processors refuse Tier 1 verticals entirely.

What Visa's VIRP and Mastercard's High-Risk Programs Mean for Merchants

Visa Integrity Risk Program (VIRP): Since May 2023, Visa requires acquirers to register merchants operating in specific high-risk categories with Visa directly. Unregistered high-risk merchants are a compliance liability for the acquirer. If discovered, the acquirer faces fines. The result is that acquirers either refuse high-risk merchants or apply rigorous due diligence processes that many high-risk businesses cannot pass with a standard application.

Mastercard High-Risk Merchant Registration: Mastercard maintains a similar registration framework. Merchants in gambling, adult content, and certain pharmaceutical categories must be registered with Mastercard through their acquirer. The acquirer takes on compliance responsibility for those merchants' conduct.

Practical effect: Any business in a Tier 1 or VIRP-registered category applying to Stripe, Square, or PayPal will typically be declined at sign-up, or accepted initially and then terminated when automated systems flag the MCC or transaction patterns. These aggregators operate on a model of automated onboarding that cannot accommodate the compliance requirements of registered high-risk merchants.

How Business Vertical Classification Affects Your Costs

Interchange rates: MCCs directly influence interchange rates because Visa and Mastercard set different rates for different merchant types. A business classified as a standard grocery store on a Visa credit card transaction pays interchange of around 1.22% + 5¢. A business classified under a high-risk MCC may pay elevated rates, and on some card types may be ineligible for preferred interchange programs.

Processing fees: High-risk processors charge significantly more than standard-rate processors, reflecting the underwriting risk they're taking on. A standard ecommerce merchant might pay 2.9% + 30¢ on Stripe. A comparable business in a high-risk vertical with a specialist acquirer might pay 3.5-5% + various per-transaction fees, depending on the specific category, chargeback history, and processing volume.

Reserve requirements: High-risk merchant accounts routinely include rolling reserves of 5-10% of monthly volume, held for 90-180 days. An upfront reserve of 1-3 months' estimated processing volume is also common for new high-risk accounts. On $100,000/month in processing, a 10% rolling 180-day reserve means $60,000 in held funds at steady state.

Application acceptance rates: Many processors maintain a prohibited business list. Stripe's list explicitly includes certain firearms dealers, drug paraphernalia, certain subscription services with negative option billing, adult content, and regulated financial services. PayPal prohibits a similar list. An MCC in these categories results in application rejection or account termination regardless of the individual business's conduct.

How to Find Your MCC

For businesses on Stripe: MCCs are available in the Stripe Dashboard under Business settings. Stripe allows merchants to request a review of their assigned MCC if they believe it is incorrect.

For businesses on Square: MCCs are not displayed directly in the Square dashboard, but Square's support team can provide the assigned code on request.

For businesses with a traditional acquiring bank: The MCC appears on merchant account statements and in the merchant agreement paperwork. It can also be retrieved from the acquirer's support team.

For any business: the MCC can also be inferred by running a test transaction through a tool like Visa's Merchant Category Code Lookup tool or by checking a card statement - the descriptor and merchant category are often visible in the transaction detail.

What to Do If Your MCC Is Wrong

Incorrect MCC assignment happens, particularly on automated platforms. Common errors:

• A SaaS company classified as a direct marketing company (5967) instead of software (7372), placing them in a Tier 1 risk category
• A fitness coaching business classified as a gym (7941) instead of professional services, affecting interchange rates
• An ecommerce business selling CBD-adjacent wellness products classified under a standard health/beauty code, then re-classified as 5912 when product descriptions were reviewed

If the assigned MCC is incorrect, the process to correct it is:

1. Contact the payment processor or acquirer's underwriting or risk team directly
2. Provide documentation of the actual business model: website, product descriptions, sample invoices
3. Request formal reclassification with the correct MCC
4. On aggregator platforms, expect this process to take 5-20 business days and to require direct communication with a risk analyst

If the MCC is correct and it is placing the business in a high-risk category, the solution is not to dispute the classification but to find a processor that is set up to handle that specific vertical. Operating in a high-risk MCC with a processor that doesn't support that category is not stable - the account will eventually be terminated when the mismatch is identified.

The Relationship Between MCCs, Business Verticals, and Processor Selection

The most common mistake businesses in elevated-risk verticals make is choosing a processor based on price and simplicity, ignoring whether that processor's underwriting model can actually sustain their business category. Stripe is cheap and fast to set up. It is not set up to underwrite nutraceutical subscription businesses, online gambling adjacent platforms, or adult content. A business in those categories will be terminated, and the process of getting funds released can take 90-180 days.

The right processor selection for a high-risk MCC starts with identifying who actually underwrites that vertical, what their reserve requirements are, what compliance documentation they require, and what contractual protection exists if the account is reviewed. That's a different evaluation than comparing flat transaction rates. If your business is in the digital goods space, also read about digital product chargeback rates and what processors do about them - chargeback history is a second underwriting variable on top of the MCC.

Frequently Asked Questions