High-Risk MCC Codes: What Global Merchants Need to Know

You may already be accepting payments successfully in your home market. Your website is live, customers can check out, and your business has an appropriate Merchant Category Code (MCC) —— Download Antom's searchable MCC code list here.

Then something changes.

You expand into a new market, introduce a new revenue model or change how customers pay for your products or services. During payment onboarding, you may suddenly be asked for more information about your business model, licences, billing structure or customer journey.

This does not necessarily mean there is something wrong with your business. It usually means that the new activity introduces payment considerations that were not present, or were less significant, in your original setup.

For example, additional review may be required when:

• You expand into a new market: A product or service that is allowed in your current market may have different regulatory requirements elsewhere.
• You introduce subscriptions: Recurring payments require clear customer consent, renewal terms and cancellation processes.
• You add stored-value features: Payment providers may need to understand how funds or value are stored, transferred or used after payment.
• You change how customers pay for a digital product: A new payment model may represent a different commercial activity from your original business.

Your MCC is part of this picture because it tells the payment ecosystem what type of business you operate. However, the code alone cannot explain:

• whether customers pay once or repeatedly;
• how value moves after payment;
• whether your service is regulated differently across markets;
• whether a new product has changed the economic purpose of the transaction.

This is where the idea of a high-risk MCC becomes useful.

It should not be treated as a universal blacklist. Visa identifies certain activities through its High Integrity Risk framework, while Mastercard applies additional registration and compliance requirements to certain merchant activities. Acquirers and payment providers can also apply their own eligibility policies.

For you, the practical question is therefore not simply whether your MCC appears on a "high-risk list." It is whether your actual business model can be supported, what additional information may be required, and whether you should resolve those questions before investing in payment integration.

Table of contents

1. Understanding high-risk MCCs
2. Why some businesses require additional review
3. Why MCC alone does not explain every payment review
4. High-risk MCC vs. high-risk merchants
5. What to prepare before payment onboarding
6. Why accurate MCC classification matters
7. Restricted vs. prohibited businesses
8. How Antom supports MCC classification and payment risk management
9. FAQs

Understanding high-risk MCCs

Your MCC gives payment providers a starting point for understanding what you sell. Risk becomes more important when the way you make money creates questions that the MCC cannot answer by itself.

Take recurring payments. If you move from one-time purchases to subscriptions, customers can now be charged again after the first transaction. That brings customer consent, renewal terms and cancellation into the payment relationship.

A stored-value product changes something different. The initial payment may be successful, but the value can then be stored, transferred or used elsewhere. How that value moves matters because fraud may become harder to reverse once the original payment has been completed.

Cross-border expansion adds another layer. A product that you can legally sell in your home market may require a licence, restriction or different treatment when offered to customers elsewhere.

Gaming shows why even the industry name is not enough. Selling a downloadable game is not the same payment activity as allowing a customer to pay to participate in an activity where something of value can be won.

These differences are what "higher risk" is trying to capture. It does not mean that your company is inherently suspicious. A legitimate, properly operated business may simply have a transaction model that requires more evidence or more controls.

The reverse is also true. You can operate in an ordinary retail category and still develop a higher merchant-level risk profile if disputes, fraud or fulfilment problems become serious.

So MCC tells the payment ecosystem what kind of business you are. Risk assessment looks at how your business actually works.

Examples of MCC categories that may require additional review

A high-risk MCC is not a universal blacklist. Different card networks, acquirers and payment providers apply their own rules, and the same MCC may receive different treatment depending on the merchant’s business model and operating environment.

However, certain categories commonly receive additional review because they may involve higher regulatory requirements, faster movement of value, increased dispute exposure or additional consumer-protection considerations.

Why some businesses require additional review

The easiest way to understand additional review is to look at what changes in the transaction.

Different business models create different payment considerations because risk can emerge at different points in the payment journey.

The key differences usually depend on:

• When value is delivered
• How value moves after payment
• Whether customers may later dispute the transaction

For example:

Physical ecommerce: value is delivered after payment

If a stolen card is used to order a physical product and the fraud is detected before fulfilment, you may still be able to stop shipment.

The risk can often be identified before the product leaves your control.

Stored-value and financial activities: value can move quickly after payment

When value is delivered or transferred almost immediately, the same level of protection may not be available after a fraudulent payment occurs. This is one reason card networks apply additional requirements to certain financial and crypto-related activities.

The broader principle is that payment risk does not always end when the authorization succeeds.

Subscription businesses: customers may challenge future charges

You can receive a successful payment today and still face a chargeback later. Recurring billing makes this especially important because customers need to understand what they agreed to pay for beyond the first transaction.

However, this does not mean every subscription company is high risk. A SaaS service that clearly bills customers each month is not automatically the same as a negative-option model where a customer enters through a trial and later disputes an automatic renewal. Visa and Mastercard apply specific requirements to certain negative-option activities rather than treating all recurring payments as one category.

If recurring revenue is part of your model, our guide to subscription payments explains the wider authorization, renewal and failed-payment issues separately.

Why businesses in the same industry can receive different payment reviews

Two businesses can operate in the same industry, use similar Merchant Category Codes (MCCs), and still receive different levels of payment review.

This is because an MCC describes the general category of a merchant’s business, but it does not capture every detail of how transactions actually happen. Payment networks and payment providers may also consider factors such as the type of transaction, how value is delivered, where the business operates and what controls are in place.

For example, two gaming companies may both be classified within the gaming industry. One may sell downloadable games or in-game digital content, while another may allow customers to pay for the opportunity to win something of value. Although both businesses are related to gaming, the underlying payment activities are different and may require different risk considerations.

Visa’s Merchant Data Standards define separate MCC treatment for different types of gaming-related activities, including digital goods and certain wagering-related activities. This reflects the fact that the commercial purpose of a transaction can affect how payment risk is assessed.

The same principle applies beyond gaming. A "subscription business" can describe a straightforward SaaS company charging customers monthly for continued access, or a different model where customers enter through a trial and later dispute automatic renewal charges. These businesses may have very different customer consent, dispute and transaction-flow considerations.

For this reason, MCC should be viewed as one part of the assessment rather than the complete picture. A more accurate understanding of payment risk comes from looking at the combination of:

• Merchant category: what type of business you operate;
• Transaction type: what customers are paying for and how payments are processed;
• Business model: how value is delivered, stored or transferred after payment.

Understanding this difference can help you avoid a common misconception: a "high-risk MCC" does not automatically mean a business cannot accept payments, while an ordinary MCC does not guarantee that a merchant will never require additional review.

Example: A gaming business that changes its payment model

Imagine a gaming company that initially sells downloadable games and in-game digital content.

Its transactions may fall under MCC 5816 (Digital Goods – Games), which covers merchants selling games delivered in electronic format, including in-app purchases for games.

Later, the company introduces a new feature where customers pay to participate in an activity with the possibility of winning something of monetary value.

Although the brand, website and customers remain the same, the payment activity has changed. The transaction is no longer simply a purchase of digital entertainment. It may involve wagering-related considerations, which Visa classifies separately from ordinary digital game purchases.

The lesson is not that one MCC is "better" than another. The important point is that the classification needs to continue matching what customers are actually paying for. Using an ordinary gaming MCC for a materially different payment activity can create compliance and risk-management issues rather than solving them.

High-risk MCC vs. High-risk merchants

This distinction matters when you are trying to understand why your business is being reviewed.

A higher-risk MCC relates primarily to the type of activity you conduct. A higher-risk merchant profile can develop because of what happens in your own business over time.

For example, even with a conventional ecommerce MCC, high fraud, excessive disputes or problematic fulfilment practices can affect how your business is assessed.

Mastercard's merchant-screening framework reflects this wider view. Merchant due diligence can extend beyond MCC to factors including ownership, websites, fraud controls and operating history, while MATCH Pro can provide acquirers with risk information associated with merchants previously terminated under specified circumstances.

That means changing your MCC is not a solution to every payment problem. If the problem is merchant history or operational performance, the underlying issue has to be addressed. Likewise, strong fraud performance does not remove licensing requirements from a regulated activity.

What to prepare before payment onboarding

If your business model could require additional review, the most useful thing you can do is describe the payment relationship clearly before technical integration becomes expensive to change.

You should be able to explain:

• what your customers actually pay for;
• where those customers are located;
• whether you charge once, repeatedly or through stored value;
• how cancellation and refunds work;
• when the customer receives the product, service or value;
• whether licences or market restrictions apply.

This matters because descriptions such as "online service" or "digital platform" are often too broad to support a payment decision.

If you operate a streaming subscription, say that. If customers buy stored value, explain how that value is used. If a gaming product involves prizes, explain how participation and rewards work.

The clearer the commercial model is, the easier it is to understand whether ordinary onboarding is sufficient or whether additional information is likely to be required.

This is also why acquiring services involve more than moving an authorization request between your checkout and a card network. Merchant onboarding and eligibility are part of the acquiring relationship as well.

Why accurate MCC classification matters

As your business evolves, your original MCC may need another look.

An inaccurate classification can cause problems for any merchant, but it becomes particularly important when the real activity should trigger additional registration, licensing or monitoring requirements.

Gaming again provides a useful example. If a transaction is actually wagering but is presented as an ordinary digital-game purchase, the problem is not simply that one code would have been more precise. The incorrect classification may prevent the relevant controls from being applied to the real activity.

Visa requires higher-risk lines of business to use the relevant MCC rather than simply absorbing them into another ordinary business line where different rules apply.

For you, the objective is not to find the MCC that creates the easiest onboarding path. It is to make sure your classification continues to describe what customers are actually paying you for.

Restricted vs. prohibited businesses

A card network having rules for an activity does not automatically mean every payment provider can support that activity.

This is an important distinction when you compare payment solutions.

Visa or Mastercard may explain how a certain activity should be classified, registered or monitored. Your payment provider must still decide whether that activity falls within the businesses it can serve.

Antom distinguishes between restricted activities, which may be considered after additional risk assessment, and prohibited activities, which we do not support.

For you, this creates a simple order of operations:

Confirm eligibility first. Integrate payments second.

If your activity is prohibited, changing an API, payment route or fraud tool will not change that decision. If it is restricted, you may instead need to provide more information about licences, markets, billing or how value is delivered.

Resolving this before development begins can save engineering work and make payment-provider comparison more meaningful.

How Antom supports MCC classification and payment risk management

Before integration, getting the merchant setup right comes first. Antom assigns MCCs to merchants using its published MCC framework, helping keep the merchant classification aligned with the business being processed. Businesses should also confirm whether their activities fall within Antom's current standard, restricted or prohibited categories before committing significant development resources.

Once your business has been approved and payments start flowing, MCC becomes only one part of the picture.

You can have the right MCC, be fully eligible for payment services and still face card testing, stolen credentials, account takeover or other transaction fraud.

At this stage, the problem has shifted. During onboarding, you were establishing whether the business could be supported. After launch, you need to identify which individual payments look legitimate without unnecessarily blocking genuine customers.

Antom's payment security guide covers the wider controls involved in protecting payment data, accounts and transactions.

For merchants that need transaction-level fraud management, Antom Shield provides risk-control capabilities for payments after launch. Antom Shield currently offers different service levels, including real-time transaction monitoring, customizable risk-control rules and AI-driven risk scoring, depending on the service package selected.

The goal is not simply to decline more transactions. Controls that are too aggressive can also block genuine customers and reduce conversion. As fraud, false declines and authorization performance begin to affect one another, the problem becomes part of the broader payment-performance discussion covered in our payment optimisation guide.

This is also where MCC-related risk and payment optimisation separate into two different decisions. An accurate MCC cannot prevent a stolen card from being used, while a fraud tool cannot make a prohibited business eligible.

Both matter, but they matter at different stages of your payment journey.

If you are expanding into new markets, introducing new payment models or unsure how your business activity may be assessed, our team can help you review your payment requirements before integration. Contact us to discuss your business model, market plans and the controls needed to support your payment journey.