A merchant describes its business accurately at onboarding, gets approved, and still receives terms it did not expect: a reserve, slower settlement, or a limit on its markets. Part of the explanation often sits in a four-digit number the merchant never chose. Understanding merchant category codes for high-risk businesses turns that outcome from a guess into something you can question.
Quick answer: A merchant category code (MCC) is a four-digit number classifying a merchant’s principal business activity for card payments. The acquirer or payment facilitator assigns it, not the merchant, and card networks use it for activity tracking, reporting and risk management. An MCC shapes how a business is reviewed, monitored and priced, but it does not replace underwriting.
What is a merchant category code?
A merchant category code is a four-digit number describing a merchant’s primary business, based on annual sales volume measured in local currency. Some codes identify a specific merchant or type of transaction rather than a whole industry.
The values are standardised internationally: ISO 18245:2023 defines codes classifying merchants by type of business, trade or service, while stating that mandating their use in any given situation sits outside its scope. The card networks handle that part. An MCC is not the trading name, the card descriptor or the activity registered in corporate documents.
Who assigns the merchant category code?
The acquirer does. Under the Visa Merchant Data Standards Manual (April 2026 edition), acquirers and their agents must assign the correct MCC to each merchant, and Visa retains the right to require corrections. A payment facilitator carries the same obligation for businesses it sponsors. Mastercard sets out its own acceptor business code requirements in the Quick Reference Booklet.
The decision draws on what you supply at onboarding: website, products, fulfilment model and corporate file, which is one reason the material prepared before applying matters beyond clearing the check.
With several lines of activity, the rules generally allow either the code covering the highest-volume line or separate codes per line. Some activities override that: online gambling transactions must use MCC 7995 even where gambling is not the main business. A merchant cannot pick a code to secure better terms, and requests for a new or amended MCC reach the network through a member, not the merchant.
How MCCs are used in payment processing
Networks and their members use MCC data for activity tracking, reporting and risk management. In practice the code can be used to:
- Identify the type of activity behind a transaction.
- Apply network rules written for a specific category.
- Inform risk assessment and ongoing transaction monitoring.
- Determine restrictions, including categories an acquirer will not support.
- Group fraud and dispute data for comparison against similar merchants.
- Check whether a business fits a given product or acquiring arrangement.
- Support reporting and reconciliation.
No outcome rests on the code alone. It is one input into decisions that also weigh volume, trading history, geography and business model.
Why some merchant category codes for high-risk businesses attract scrutiny
Categories draw attention when the activity behind them raises the chance of disputes, refunds or regulatory exposure: future delivery, subscription billing, high refund rates, cross-border sales, licensing exposure, product claims, dispute frequency, long fulfilment cycles, digital delivery and reputational risk.
Part of this is formalised. Visa designates certain codes as high integrity risk for card-absent transactions, covering adult content and services, dating and escort services, betting, certain financial trading platforms, subscription negative-option billing and crypto on-ramp providers. Those merchants face enhanced registration through their acquirer and closer monitoring under the Visa Integrity Risk Program.
Sectors commonly treated as higher risk include iGaming, forex and trading, CBD and cannabis-related businesses, adult subscriptions, nutraceuticals, dating, travel and ticketing, crypto businesses and subscription models with elevated disputes. The list is not exhaustive and settles nothing about an individual business. “High-risk MCC” is industry shorthand rather than a formal designation: two merchants can share a code and be assessed very differently, because the code describes activity while the assessment covers the whole operation.
How an MCC can affect underwriting, pricing and reserves
At review, the code gives a provider an early read on business model, transaction patterns, fulfilment cycle, refund exposure, dispute risk, customer location and regulatory requirements. It sets the questions rather than answering them, which is why approval decisions rest on the wider file.
The same caution applies commercially. A category can be one signal feeding into transaction rates and settlement terms, or into whether a rolling reserve applies. No rate attaches automatically to a code, and different acquirers can reach different conclusions on identical activity.
What happens when the MCC is wrong
An inaccurate code produces an inaccurate picture: risk assessment built on wrong assumptions, unsuitable processing conditions, compliance reviews, monitoring alerts triggered by patterns that look abnormal for the category, settlement disruption, an account review, or friction during future onboarding. The reason behind the mismatch matters, and these are not equivalent:
- Administrative error. Activity described correctly, recorded under an unsuitable code.
- Changed activity. The business evolved and the classification was never revisited.
- Undeclared activity. A line of business was added without telling the provider.
- Deliberate misclassification. Activity presented so as to obtain a different category.
Miscoding and merchant laundering
MCC miscoding means a merchant is classified under a code that does not accurately reflect its activity. Merchant laundering, also called transaction laundering, means processing transactions for a different business or activity from the one declared to the acquirer.
The first can be an error; the second is treated as illegal activity by the card networks. Both can lead to termination, withheld funds, network reporting, additional reviews and loss of processing access, and acquirers must terminate acceptance for merchants that cannot comply with applicable law. The remedy is to correct the record with your provider, never to obscure what the business actually does.
MCC vs underwriting category vs descriptor vs legal activity
| Element | What it describes |
|---|---|
| MCC | The merchant’s principal commercial activity for card payment classification |
| Underwriting category | The provider’s internal assessment of the merchant’s risk profile |
| Card descriptor | The name or reference displayed on the customer’s statement |
| Legal business activity | The activity registered in corporate or licensing documents |
Different parties set these, for different purposes, so they will not always align. A business can hold one MCC, sit in a stricter internal risk band, trade under a descriptor matching neither, and be registered for broader activities than it performs. Treating them as interchangeable is what leads merchants to assume a classification is wrong when it is simply describing something else.
What documentation supports the correct classification
Classification improves when activity is easy to verify: website and product pages, terms and conditions, refund policy, fulfilment information, supplier agreements, product documentation, licensing, marketing materials, transaction projections, subscription terms, the customer journey and corporate documents. The KYB checks a gateway runs and the documents gathered before applying cover this ground in detail.
What to do if you think your MCC is incorrect
Work through it in order and keep the exchange documented:
- Review the business activity originally declared at onboarding.
- Check whether the business model has changed since.
- Gather evidence of the current primary activity, including revenue split by line.
- Contact the payment provider or acquirer.
- Ask how the classification was determined.
- Request a formal review where the evidence supports one.
- Confirm whether pricing, reserves or monitoring would change.
- Keep written records of the review and its outcome.
A merchant cannot normally change its own MCC. The route runs through the acquirer or provider, and Visa recommends assigned codes are reviewed periodically to keep them accurate.
MCCs, card descriptors and chargebacks
The MCC classifies activity for the payment system; the descriptor helps customers recognise a charge on their statement. An unclear descriptor can raise disputes on its own, whatever the code says, and the MCC is not necessarily visible to the buyer. Where the code matters for disputes is context, shaping how dispute and fraud performance is grouped and compared during monitoring. Reducing disputes is a separate task, covered in our guide to reducing chargebacks in high-risk industries.
Questions to ask during onboarding
- Which MCC is expected for our primary activity?
- Which part of our business model determines the classification?
- How are multiple revenue streams handled?
- Could the classification affect pricing or reserves?
- What happens if our business model changes?
- Which documents support the classification?
- How can we request a review?
- Are any products or regions incompatible with the assigned category?
- How is merchant activity monitored after approval?
Merchant classification and Niftipay
Niftipay supports card, crypto and stablecoin acceptance for high-risk and non-standard online businesses, with terms assessed individually during qualification rather than published as a fixed schedule. Confirm the specifics there: which entity in the processing chain determines the category for your account, how multiple lines of business are treated, whether a review can be requested later, and how a change in business model should be notified. Those answers depend on the acquiring arrangement behind the account.
Merchant category code FAQs
What is an MCC in payment processing?
A four-digit number classifying a merchant’s principal business activity for card payments. It travels with transaction data and is used for activity tracking, reporting and risk management.
Who assigns a merchant category code?
The acquirer, or a payment facilitator sponsoring the merchant, based on information gathered at onboarding. Network rules require the code to be correct, and Visa retains the right to require corrections.
Can a merchant choose its own MCC?
No. A merchant describes its activity and supplies evidence, but the acquirer or facilitator makes the classification under network rules. Requests for a change reach the network through a member.
Are some MCC codes automatically high risk?
Not automatically. Visa designates certain categories as high integrity risk for card-absent transactions, bringing enhanced registration and closer monitoring. Beyond that, assessment depends on volume, history, geography, disputes and business model.
Can the wrong MCC affect payment processing?
It can. Consequences may include a risk assessment built on wrong assumptions, unsuitable processing conditions, monitoring alerts, compliance reviews, settlement disruption or an account review, plus friction in later applications.
Can an MCC affect fees or rolling reserves?
It can be one signal among several. No rate or reserve requirement attaches automatically to a code. Providers weigh the category alongside volume, history, geography, disputes and business model.
What should a merchant do if its MCC is incorrect?
Check what was declared at onboarding and whether the business has changed, gather evidence of the current primary activity, and raise it with the provider. Ask how the classification was reached and keep written records.
Review how your business is classified
An MCC is a meaningful part of how a merchant is classified, but it is a summary rather than a verdict. It does not replace a full risk assessment or decide approval, pricing and reserves on its own. Describing the real activity clearly and documenting it at onboarding is what stops the classification becoming a problem later.
Check whether your business model fits Niftipay’s qualification requirements. Start qualification to confirm which conditions would apply to your activity, markets and payment setup.