Why does my business need a high risk merchant account, and what changes if I start accepting crypto?

"High risk" is not a judgement about you. It is a judgement an acquiring bank makes about your category: how much money it expects to lose on businesses that look like yours. Travel agencies, dating apps, VPN subscriptions, online courses, ticketing, licensed forex brokers, licensed online pharmacies, adult platforms in the many countries where they are legal, licensed iGaming — all legal businesses, all on somebody's list.

A high risk merchant account is an ordinary card account with that expectation priced in: a higher rate, a slice of your revenue held back, and a chargeback ceiling you are watched against. You need one because the standard account you applied for was underwritten on the assumption that your customers almost never dispute a payment, and the acquirer no longer believes that about your category.

Crypto changes exactly one thing here, and it is a big one: there is no acquirer and no chargeback, so nothing you pay depends on how often your customers change their mind. Everything else — the checks on you, the checks on the money, the refunds customers ask for — stays. It just moves into different hands.

What a high risk merchant account actually is

Three different things get called "the payment provider", and it matters which one turned you down.

• The payment gateway is the technical layer. It shows the card form, encrypts the card number and passes it on. Gateways rarely care what you sell.
• The payment processor, or acquiring bank, is the company that actually moves the money and carries the risk. It pays you for card sales before it has finished collecting on them.
• Merchant services is the retail name a provider puts on the bundle — account, gateway, terminal, support — when it sells all of it together.

The merchant account itself is the account card money passes through on its way to your bank. A high risk merchant account is the same account, opened by an acquirer that is willing to serve your category, on terms that cover what it expects your category to cost.

Here is the sentence that explains nearly all of those terms. When a customer wins a dispute, the money is taken back out of your account — and if your account is empty or your company is gone, the acquirer pays out of its own pocket. It is lending you its money and its licence, so it prices for the day you cannot cover what your customers claw back.

Why an acquirer calls my business high risk

There are two separate reasons, and a business can be flagged for either one alone.

Money: the acquirer pays for the chargebacks you cannot

A chargeback is a forced reversal: the customer tells their bank the payment was wrong, and the bank takes the money back from your side of the chain. Your customers need not be dishonest for this to be expensive — a cancelled event, a delayed parcel or a subscription someone forgot they had all arrive as disputes.

The clock is long, and long clocks are the whole problem. Visa's dispute window is 120 days, and for goods that never showed up it is counted from the expected delivery date, not the payment date. Sell a tour in November for a trip in March and the acquirer is exposed to that sale until well into the summer.

On top of the individual disputes, the card networks count your ratio and fine the acquirer when it drifts.

• Mastercard's Excessive Chargeback Merchant programme kicks in at 100 chargebacks in a month combined with a chargeback ratio of 1.5%, with the ratio counted against the previous month's sales.
• Visa consolidated its monitoring into VAMP on 1 April 2025. The merchant threshold started at 2.2%, with an advisory period running to 30 September 2025.
• From 1 April 2026 that threshold is 1.5% in the US, Canada, the EU, APAC and LATAM. The CEMEA region stays at 2.2%.

Sitting above the line means fees, then remediation plans, then the loss of the account. Cross-border payments are disputed more often than domestic ones, which is why a business selling worldwide from one country gets a harder look than a shop selling down the street.

Rules: what is allowed depends on your customer's country

The second reason has nothing to do with your chargeback ratio. Some categories are legal in one country and not in the next, so the acquirer has to know where your customers are before it can say yes. Others need a licence before anyone will touch them at all: a gambling operator, a broker selling trading products, a pharmacy dispensing prescriptions. And the card networks separately police what runs across their network, with their own registration requirements — clearing local law is not the same as clearing the scheme.

Licensed iGaming meets both reasons at once: a regulated activity with a licence to verify, plus payment patterns an acquirer treats as volatile. A licence answers the rules half of the question and none of the money half, and the operator still has to build a cashier that takes the money: how crypto payments work for online casinos and sports betting platforms.

The merchant category code that puts you in the bucket

Merchant category codes, or MCCs, are the four-digit labels the card networks use to classify what a business does:

• MCC 4722 — travel agencies and tour operators.
• MCC 7995 — betting and casino gambling.
• MCC 5912 — drug stores and pharmacies.
• MCC 6211 — security brokers and dealers, the code a trading business tends to land in.

You do not choose your code — the acquirer assigns it during onboarding, and it follows you to the next provider. Much of what looks like a personal verdict on your business is a rule written against your code.

Which businesses are on the high risk merchants list

Every acquirer keeps its own list and the lists largely agree with each other. The thing that confuses everyone who lands on one is that a single label covers two situations with nothing in common. A legal business is there because of its dispute statistics, or because its category needs a licence. An illegal business is there for being illegal. Same word, opposite meanings — which is why the list explains nothing until you split it.

The legal half then splits again, because the two reasons above land differently: some businesses are flagged for their numbers, others for their paperwork. Three groups in all.

Legal, and flagged for the disputes

Ordinary businesses whose economics an acquirer expects to cost it money:

• Travel. Money changes hands months before the service is delivered, and one supplier failure turns into a wave of disputes at once.
• Ticketing. Events get cancelled and rescheduled, and when that happens the disputes arrive in a single week rather than spread over a year.
• Dating. Recurring billing, an intangible service, and a share of customers who would rather dispute the charge than have the conversation about it at home.
• VPN and subscription services, including SaaS. Free trials that roll into paid, small repeating charges people stop recognising on a statement, and instant delivery with no shipping record to show a bank.
• Online education and courses. The buyer got access on day one and asks for a refund in week six, and "I watched nothing" is hard for anyone to disprove.
• Supplements and nutrition products sold on subscription. Legal to sell, and flagged because the billing repeats, the claims on the page are easy to overstate, and the category has enough sharp operators to have earned the attention.
• Debt advice, credit repair and remote tech support. Bought by people already under pressure, refunded often, and impersonated by outright scams often enough that honest firms inherit the suspicion.
• Shops with long delivery times. Pre-orders, made-to-order goods and slow cross-border shipping all stretch that 120-day window from a date far in the future.

Legal, and flagged for the rules

Here the disputes may be perfectly ordinary. What makes the category hard is the licence, the geography and the card networks' own conditions:

• Licensed iGaming. A licence to verify, a list of markets it actually covers, and a payout side where money leaves almost as often as it arrives.
• Forex, CFDs and other trading products. Licensed brokers are legal, regulated businesses in many countries; what may be sold to a retail customer differs sharply from one market to the next, so the acquirer wants the licence and the exact list of countries you sell into.
• Adult. Legal in many countries, and held by the card networks under conditions of their own: age and consent verification, control over what gets published, registration before a single payment runs.
• CBD, hemp and vape products. Legal in some markets, restricted in others, and occasionally different from one region to the next inside the same country.
• Online pharmacies. Legal with a licence and a real prescription check. The same shopfront without either belongs in the third group.
• Buying and selling crypto for cards. Licensing that differs by country, and a payment that becomes a transferable asset the moment it settles.

Illegal, and not a risk grade at all

The third group is not a harder version of the first two. It is business nobody in the card system may process at any price:

• Counterfeit goods and pirated media.
• Gambling run without the licence the customer's market requires — the unlicensed twin of the operator in the list above.
• Prescription medicines sold without a prescription.
• Pyramid schemes, where the income comes from recruiting the next person rather than from selling anything.
• Transaction laundering — running one business's payments through another business's approved account, so that what the acquirer underwrote is not what it is processing.

Money does not move this group, and it is worth seeing why not. A rate and a reserve are a price for a loss that can be estimated — disputes the acquirer will end up covering. Here there is nothing to estimate: what the acquirer stands to lose is network fines, a regulator's attention and its own permission to be in this business. The card networks require that no illegal transaction is submitted to them at all, and Mastercard's rules reach further than the law does — it bars transactions it judges damaging to its own brand, whether or not anything about them breaks a law. No merchant's volume buys past that, so there is nothing to negotiate and nothing to gain by shopping around: the rule sits above the acquirer and reads the same at the next one.

The legal groups pay for the third one's existence, in a currency that is not money. Nothing illegal applies under its own name — it arrives looking like an ordinary shop. So underwriters read the site, the refund policy and the exact wording of what you sell, and a perfectly legal business gets that treatment because of a neighbour on a list it has nothing to do with. It is also why a serious provider reviews the project itself instead of reading a category off a form: a label cannot tell a licensed casino from an unlicensed one, or a pharmacy that checks prescriptions from one that does not, and a project can.

Subscription services move to crypto more easily than most of this list, because there is nothing to ship and no delivery date to argue about: how VPN services accept crypto payments, step by step.

What a high risk merchant account costs: the rate, the reserve and the ceiling

Three things change against a standard account, and they do not hurt equally:

• The rate. It is higher, but less dramatically than the folklore suggests — published high-risk rates generally sit within about a percentage point of standard pricing. If someone quotes you double the normal rate with no explanation, ask what in your numbers justifies it.
• The rolling reserve. The acquirer holds back a share of every settlement — commonly 5–10%, for three to six months — as a fund to cover disputes that arrive after you have been paid. It is a card acquiring practice, and it is not a fee: the money is yours, later.
• The ceiling. Your contract will name a chargeback ratio you must stay under, set at or below the scheme thresholds. Cross it and you get fees and a remediation plan; stay over it and you get closed.

The reserve is the line to run the numbers on before you sign. On 50,000 a month with 8% held for six months, roughly 24,000 of your money is parked at any given time once the scheme is fully wound up. A business with thin margins can be profitable on paper and short of cash every single week because of that one line.

How to get a high risk merchant account

Underwriting is asking one question: if this business stops covering its own disputes, how much do we lose? Everything on the list below is evidence towards that answer.

• Processing history. Three to six months of statements from a previous provider, showing volume, average ticket and your chargeback ratio. A business with no history is not refused, but it is priced as an unknown.
• Company documents. Registration, ownership structure, the people behind the company, bank details. This is KYB — know your business, the corporate cousin of the identity check a customer goes through.
• A licence, where the category needs one. Valid, in the name of the entity applying, covering the markets you actually sell to.
• A working website. Clear pricing, who is behind the company, contact details, and terms that say what a customer gets.
• Refund and delivery policy. Underwriters read these closely, because a generous, clearly worded refund policy is the cheapest chargeback prevention there is.
• Chargeback handling. What you already do about disputes: order confirmations, delivery proof, a support channel a customer reaches before they reach their bank.

Expect the offer to arrive with a reserve percentage and a hold period in it. Both are negotiable, both are worth more attention than the headline rate, and both belong in writing before you sign anything.

What crypto actually changes, and what it does not

This is where most explanations go wrong in one direction or the other. Crypto is not a way around checks, and it is not a small improvement either. It removes one specific mechanism, and that mechanism is the one your whole high-risk problem is built on.

What goes away:

• The chargeback. A confirmed transfer on a blockchain has no reverse gear. No bank can pull it back, and no customer can file a dispute against it.
• The ratio and the monitoring programmes. No chargebacks means no chargeback ratio, so no VAMP threshold, no Excessive Chargeback Merchant programme, and no fee schedule built on either.
• The rolling reserve at the acquirer. There is nothing to reserve against when there is nothing to claw back.
• The merchant category code. A crypto payment processor does not classify you by MCC, because your payments never enter the card networks.
• The acquiring bank itself. The money goes from the customer's wallet to your payment address. Nobody is fronting it, so nobody is underwriting your risk of failing.

What stays:

• Your customers' complaints. People still want money back when a trip is cancelled or a course disappoints, and now there is no bank to force it — which means a refund is something you send yourself, and the awkward cases go with it: how refunds, overpayments and mistaken transfers work in crypto payments.
• Checks on your business. A crypto payment gateway onboards you, verifies who you are and reviews the project. Different questions from an acquirer's, but a real gate.
• Checks on the money. Incoming funds get screened, and coins with a bad history can be held.
• Licensing. If your activity needs a licence in a market, taking payment in USDT does not change that. The payment method was never what made the activity regulated.
• Cards. Most customers still want to pay with a card. In practice crypto is a second rail beside the account you have, or the rail that keeps revenue moving while you look for a new acquirer.

One thing crypto does not do at all: it does not move a business out of the illegal group of that list. A processor worth connecting to reviews the project and screens incoming funds, so what the card networks refuse for being illegal gets refused here too — by different people, on different grounds, with the same answer.

The legal-but-restricted categories are a separate matter. Crypto processors keep their own lists of what they will and will not take, and those lists do not match each other or the card networks': a broker or an adult platform can be turned down by one and onboarded by the next. Ask about your category first, before you build anything around a checkout.

Do crypto payment gateways still ask for KYC?

Yes, and it helps to see that they are asking about something else entirely.

An acquirer's question is "how much will this merchant's customers dispute?" A crypto payment processor has no disputes to fear, so its question is "who is this business, and where is this money from?" That is why the checks look different: KYB on the company and its owners, a review of the project, and automated screening of the wallets that pay you.

The screening part is worth understanding before you switch, because it is the one place where a crypto payment can go wrong for a merchant who did nothing unusual: what AML screening and wallet risk checks look at in crypto payments.

Three ways to take a crypto payment

Once you are through onboarding, a crypto payment processor gives you the same three routes, whatever your segment:

• A payment link. You generate a link and send it in a chat, an email or an invoice. No site changes at all, and it works for a fixed amount or for a sum the customer types in.
• A checkout button on your site. The customer clicks, gets an address and an amount, pays, and the status comes back to your page. This is the normal choice for a shop or a subscription page.
• An API. Your system creates invoices and receives payment events. This is what you use when payments have to trigger something automatically — opening access, extending a subscription, releasing a ticket.

Pricing is a percentage of each successful payment, and the headline percentage is the easy part to compare. Ask about holdbacks separately: a rolling reserve exists to cover chargebacks, and a rail that has none leaves a provider no disputes to cover — so if one does hold back a share of your settlements, ask what it is for and how long it lasts. Ask the same about withdrawal terms and any minimum before you decide anything on the rate alone: what a crypto payment gateway costs and how to connect it.

CryptumPay works with legal high-risk niches. The fee is 1% of each successful payment. Registration, identity verification and the review of the project usually take about a business day between them, and it is that review that decides whether a particular project goes live.

What it comes down to

If your business is legal, you were turned down for what your category costs an acquirer or for what it has to prove — not for what you did. A high risk merchant account is the card industry's answer to that: same rails, higher rate, a reserve, and a ratio you have to stay under.

Crypto is the other answer, and it works by removing the part that created the problem. No chargeback means no chargeback ratio, no monitoring programme, no MCC and no acquiring bank holding back a slice of your settlements against disputes. What it does not remove is being checked — on your company, your project and the money arriving — or the need to handle refunds yourself.

For most of the businesses reading this, the sensible shape is both: a card account on whatever terms you can negotiate, and a crypto checkout beside it that is not hostage to anybody's chargeback ratio.

Questions people ask

When is a rolling reserve released, and is there a cap on it?

Each day's holdback is released when its own term runs out — that is what "rolling" means. Hold 8% for six months and, from month seven, money starts flowing back to you while fresh holdbacks are still going in, so the reserve settles at roughly half a year of holdbacks and stays there while you keep processing. The cap is not something the card networks publish: the percentage, the hold period and any ceiling are terms in your contract, so ask for all three in writing, along with what happens to the balance if the account is closed.

Can a customer charge back a crypto payment if they bought the coins with a card?

They can dispute the card payment they made to the exchange or broker that sold them the coins, and that dispute sits between the customer and that exchange. It does not reach the transfer they sent you: a confirmed on-chain payment cannot be reversed, and your processor was never part of that card transaction. The practical consequence is simple — if that customer wants money back from you, it comes as a refund you decide to send.

Do I still pass KYB if I only accept crypto?

Yes. A crypto payment processor verifies the company, its owners and the project before live payments are switched on. It is usually faster and lighter than card underwriting, because nobody is estimating how much your disputes might cost them, but it is a real check — and a project that cannot show what it sells does not get through it.

Is instant approval for a high risk merchant account real?

The instant part is the form, not the account. You get an immediate answer on a pre-screen — your category, your country, your stated volume — and then an underwriter reads your statements and documents, which takes days. Treat instant approval as a promise about the speed of the reply; the numbers that decide whether the deal is any good, the rate and the reserve, arrive later.

Can a travel agency get a high risk merchant account?

Yes — travel is a standard high-risk category rather than a refused one, and MCC 4722 exists for exactly this kind of business. What underwriting weighs is the gap between the payment and the trip: the further ahead you sell, the longer the acquirer is exposed and the larger the reserve it asks for. Agencies selling months in advance are usually asked for more paperwork about supplier arrangements and about what protects a customer's money if a trip does not happen.

This article is general information, not legal or tax advice. Which categories count as legal, licensed or banned depends on the country and changes over time, so check your own market and your own licensing obligations with a qualified adviser before you act on anything here.