High-Risk MCC Codes Explained: What Your Code Decides

The short version

Four digits decide more about your merchant account than your chargeback ratio does. Your MCC, or merchant category code, is what tells Visa, Mastercard, the issuing bank and every acquirer in the chain what you sell. If you sit inside the high risk MCC codes the card brands actively watch, that number is the first thing an underwriter reads, and often the only thing that determines whether your application reaches a human.

Here's the practical picture:

• Visa publishes its own list. The October 2026 edition of the Visa Merchant Data Standards Manual names 5122, 5912, 5966, 5967, 5993, 7273 and 7995 as high integrity risk MCCs for card-absent merchants, with 4816, 6211, 5968, 5816, 6051 and 6012 joining them in certain card-absent scenarios.
• Approval is per-program, not per-processor. Under the Visa Integrity Risk Program (VIRP), every high integrity risk merchant has to be registered with Visa before it submits a single transaction, and the acquirer needs separate Visa approval for each Tier 1 merchant category, plus High Integrity Risk Acquirer Registration before soliciting or processing.
• Mastercard runs a parallel system - specialty merchant registration - with a $1,000 annual registration fee per merchant from May 1, 2026 under bulletin 12568.1.
• A wrong code is not a paperwork slip. The October 2026 manual requires a merchant with multiple lines of business to carry a separate high integrity risk MCC for the risky line. The public Visa Core Rules (18 April 2026 edition), §12.5.3.2, goes further: if Visa determines that an Acquirer, Merchant, Sponsored Merchant or Third Party Agent changed, modified or altered the Merchant name, Merchant data or Merchant performance in any way to circumvent VAMP or VIRP, Visa may impose USD 25,000 per Merchant or Sponsored Merchant per month to the Acquirer, and/or permanently disqualify the Merchant and its principals. The assessment lands on the acquirer.
• Right code, no guarantee. Placing yourself correctly doesn't buy you an approval. It buys you a contract that survives an audit.

One note before the detail: where a rule text is public, we quote it, and the §12.5.3.2 language below is quoted from the public Visa Core Rules, 18 April 2026 edition. Where a tier-to-MCC list is relayed by Visa regional material rather than lifted from rule text, we say so in the sentence.

What an MCC is, and how to find yours

An MCC is a four-digit number assigned to your merchant account that classifies what you sell. It's not a tax code and it isn't marketing - it's the data field that drives interchange rates, fraud scoring, brand program eligibility and, for high-risk merchants, whether your account exists next quarter.

Merchant category code high risk classification comes from two directions. The card brands publish MCC definitions and flag certain codes for integrity risk programs. Acquirers and processors layer their own underwriting appetite on top, which is why one processor quotes supplements and another won't.

To find your code, work through these in order:

1. Your merchant portal or MID setup sheet. Log into the processor dashboard and look for "MCC," "category code" or "SIC/MCC." If it's not visible, open a ticket and ask for the MCC on file plus its exact description string in writing. That one sentence is the whole exercise.
2. Your application packet. The signed merchant application or terms schedule usually lists the MCC the acquirer assigned. What you wrote on the form and what got assigned are sometimes two different numbers - that gap is worth finding.
3. Your monthly acquirer statement. Some acquirers print the MCC; many don't. Don't assume a missing MCC means none was assigned.
4. Your statement descriptor does not carry the MCC. It identifies your MID and your DBA to the cardholder. Useful for confirming which MID processed a transaction, useless for reading your code.
5. Card brand lookup documents. The Visa Merchant Data Standards Manual contains the full MCC list with descriptions; Mastercard's Quick Reference Booklet, Merchant Edition does the same on its side. Third-party lookup tools exist, but they're secondary sources and drift out of date.

One trap: acquirers sometimes derive the MCC from a broad SIC mapping rather than your actual checkout. A telehealth platform selling GLP-1 subscriptions can land in a general healthcare code instead of 5122 or 5912 - a code that looks cleaner and behaves worse the moment a brand program audit runs.

The high-risk MCC list, in Visa's and Mastercard's own terms

Two separate structures exist, and conflating them is where most merchant confusion comes from. Visa's VIRP uses risk tiers. Mastercard's Specialty Merchant Registration Program (SMRP) works off a named MCC list. Both feed the same outcome: registration obligations, extra fees, and tighter monitoring.

Visa's published high integrity risk MCCs. Per the October 2026 Merchant Data Standards Manual, these are high integrity risk for all card-absent merchants: 5122, 5912, 5966, 5967, 5993, 7273, 7995. A second set applies only in certain card-absent scenarios: 4816 (cyberlockers), 6211, 5968, 5816 (skilled game wagering), and 6051/6012 (crypto). Footnote 1 in the same manual says that in the Asia Pacific, Canada, CEMEA, Europe and LAC regions, the high integrity risk designation for 5912 and 5993 applies only if the merchant conducts transactions other than domestic transactions.

VIRP tiers. The tier-to-MCC mapping below comes from Visa's own VIRP guide dated April 6, 2023 - the program that replaced the Global Brand Protection Program. Visa's public rule text describes the tiers and approval requirement; this mapping is relayed from the guide rather than from Core Rules, so read it as reported:

Tier	MCC	Category
Tier 1	5967	Adult content and services
Tier 1	7273	Dating services
Tier 1	7995	Betting, casino, gambling
Tier 1	5122 / 5912	Pharmacies and drugs
Tier 2	6051 / 6012	Crypto and quasi-cash
Tier 2	4816	Cyberlockers
Tier 2	5816	Digital goods - games of skill
Tier 3	6211	Securities and trading platforms
Tier 3	5966	Direct marketing - outbound telemarketing
Tier 3	5968	Direct marketing - continuity/subscription
Tier 3	5993	Tobacco

Tier 1 is the expensive place to be. The acquirer needs separate Visa approval for each Tier 1 merchant category and must hold High Integrity Risk Acquirer Registration before soliciting or processing. Merchants are registered by their acquirer.

MCC 5967 adult got broader in October 2026. The manual's summary of changes states that escort services moved from MCC 7273 into MCC 5967, and the 5967 description now covers adult content, escort services, website subscriptions, video streaming and audio-text. MCC 7273 dating is now limited to "dating services, including online services." If you run an escort directory and your file still says 7273, the code is stale.

MCC 5968 negative option sits in Tier 3 for Visa and is a named Mastercard specialty code. Mastercard bulletin AN 4654 is explicit: "An Acquirer must use MCC 5968 (Direct Marketing - Continuity/Subscription Merchants) and TCC T to identify all non-face-to-face high-risk negative option billing Transactions." It took effect 19 January 2021. Ask for 5968 and TCC T, and ask to see the bulletin.

Mastercard's specialty registration MCCs, per the same bulletin and Mastercard's SPME manual: 5967 and 7841 (adult), 7801, 7802 and 7995 (gambling), 7800 and 9406 (lottery), 7994 (games of skill), 4816 (cyberlockers), 6211 (securities), 6051 (crypto), 5968 (negative option), 5122 and 5912 (pharma), 5993 (tobacco), plus cannabis merchants in Canada. Bulletin 12568.1 sets the annual registration fee at $1,000 per merchant, effective May 1, 2026, billed to the acquirer - whether it reaches you depends on your pricing terms, so ask.

Why the code drives fees, reserves and which processors will take you

Three cost lines move when your MCC changes, and they move fast.

Interchange and assessments. The card brands price by risk. A gambling or adult transaction carries a different base cost than a retail one, and registration fees, brand program assessments and monitoring charges stack on top. The difference is enough that merchants sometimes shop for a "cheaper" code. Don't. The assessments cost less than the exposure.

Reserves. Reserve decisions are usually framed by underwriters as chargeback-driven, but in practice a Tier 1 code triggers the conversation before a single chargeback exists. The code puts rolling reserves on the table for adult, dating, negative option and supplement programs; the terms vary by acquirer, not by code alone, and the code is what puts you in the room.

Access. This is the part merchants underestimate. Processors often decline a merchant not because of its business type but because their acquiring bank's appetite list doesn't include that MCC. A dating app that files under 5999 looks like a low-risk software merchant on paper and gets approved in a day - then gets terminated at the first brand audit when the code and the website don't match.

What happens when the MCC is wrong

Miscoding is a common self-inflicted wound in high-risk payments. It usually starts with a well-meaning ISO "helping" an application through by choosing a softer code. The bill arrives later.

The multi-line-of-business rule is now explicit. The October 2026 Merchant Data Standards Manual, under Mandatory Multiple MCCs, headed "Multiple lines of business, one or more of which is considered 'high integrity risk'," states:

"A Merchant that has multiple lines of business in the same location must assign a high integrity risk MCC to the line of business that is considered high integrity risk and another MCC to other businesses that are not considered high integrity risk."

Read that against a real file: a supplement brand that also sells a coaching subscription, or an adult platform running a mainstream dating product on the same MID. One MID, one blended code, no split - that's the setup the rule is written against. The fix is a second MID, not a new code.

Core Rules §12.5.3.2 exposure. The public Visa Core Rules, 18 April 2026 edition, state that if Visa determines an Acquirer, Merchant, Sponsored Merchant or Third Party Agent changed, modified or altered the Merchant name, Merchant data or Merchant performance in any way to circumvent VAMP or VIRP, Visa may impose USD 25,000 per Merchant or Sponsored Merchant per month to the Acquirer, and/or permanently disqualify the Merchant and its principals from the Visa system. The assessment is levied on the acquirer, not the merchant - which is why it comes back to you as a reserve, a re-price or an exit. Visa "may" act, so disqualification isn't automatic, but it is on the table, and it follows principals, not just the entity.

How MCC miscoding gets a merchant account terminated in practice. In order, the sequence usually looks like this:

1. A brand or acquirer audit matches your website's product list against your code.
2. The acquirer requests a code correction and a business model review; the processor freezes payouts pending the review.
3. Underwriting re-prices you at high-risk rates or exits the relationship, with a reserve held against future chargebacks.
4. The termination is reported, and your next application has to disclose it. That's when MCC miscoding merchant account terminated becomes a long-term problem.

The aggravating factor is intent. A merchant who self-corrects before an audit has a compliance story. A merchant whose application says 5999 and whose checkout sells subscriptions with negative option renewal has a misrepresentation finding.

Can you change your MCC?

Yes, and it's usually the right move - but it's a request, not a setting. Your acquirer holds the field, and the card brands require it to be accurate.

How to ask, in order of what actually works:

1. Write to your processor's risk or merchant support team and request a specific MCC change, quoting the code you want and the manual's description for it. Vague asks get vague answers.
2. Send evidence of what you sell, not what you'd like to sell. Underwriters want the checkout flow, the product pages, the terms of service, and the pricing page - screenshots with URLs visible, dated.
3. Explain the recurring revenue model explicitly if any part of your checkout is a subscription, free trial or auto-ship. That single sentence decides whether you land in 5968.
4. Expect re-underwriting, not a toggle. A move into a high integrity risk code triggers registration, possible fee changes, and a new reserve discussion. A move out of one triggers a review of whether you ever belonged there.
5. Get the confirmation in writing, with the effective date and the new code, and keep it with your application file.

What evidence carries weight: live product URLs, a screen recording of checkout including the renewal disclosure, your refund and cancellation policy, sample customer communications, and recent processing statements. What doesn't: a cover letter asserting you're "low risk."

And the honest version of the limits. Underwriters will not move you down out of a high-risk code just because your volume is small or your chargebacks are low. Codes describe what you sell, not how well you behave. They will move you if the description genuinely doesn't fit.

A pre-application MCC checklist

Run this before you sign anything:

• Identify every line of business you actually sell, including the side product and the subscription tier. If more than one is high integrity risk, plan for separate MIDs.
• Match your code to your checkout, not to your marketing. If a free trial converts to a paid subscription, that's continuity/subscription, full stop.
• Confirm the exact description string, not just the number. 7273 and 5967 both sit near "dating" in a lookup and behave nothing alike.
• Check regional footnotes. In AP, Canada, CEMEA, Europe and LAC, 5912 and 5993 count as high integrity risk only if the merchant conducts transactions other than domestic ones.
• Ask about both registrations - Visa VIRP and Mastercard SMRP - and who pays the fees, you or the acquirer.
• Disclose prior terminations and prior MCCs on the application. Underwriters find them; the only variable is whether you told them first.
• Get the MCC, the reserve terms and the registration obligations in writing before the first transaction.

How Find a Processor helps

We match high-risk US merchants - supplements, dating, CBD, adult, crypto, travel, telemedicine and the rest - with processors whose underwriting actually fits the business model, the geography and the checkout, instead of a list of who claims to "support high risk." Then we walk you through the application, the pricing, the reserves and the contract terms, in that order, before you sign anything.

The service is free to merchants. The processors pay us, so you're not buying advice from someone who earns on the reserve.

Get matched with a processor that fits your MCC →

FAQ

What is a high risk MCC code? It's a merchant category code that the card brands or acquirers associate with elevated integrity, fraud or chargeback risk - typically adult (5967), dating (7273), gambling (7995), crypto (6051/6012), tobacco (5993), telemarketing (5966), negative option continuity billing (5968), and pharmacy (5122/5912). Visa calls these high integrity risk MCCs in its October 2026 Merchant Data Standards Manual.

Does a high-risk MCC mean I can't get a merchant account? No. It means you need an acquirer whose appetite includes that code and, in most cases, brand registration before you process. Plenty of processors fund adult, dating and supplement programs. Fewer will touch them at mainstream pricing. The code limits your options; it doesn't close them.

What's the difference between MCC 5967 and MCC 7273? 5967 is adult content and services; 7273 is dating services, including online. Since October 2026, escort services belong in 5967, not 7273. Both sit in Visa's Tier 1 for VIRP, so the approval burden is similar - but a mismatch between your site and the code is an easy audit finding.

Which MCC is used for negative option billing? 5968, with TCC T, for non-face-to-face high-risk negative option transactions - that's straight from Mastercard AN 4654.

Can my processor change my MCC without telling me? They can correct a code without asking, and they should notify you - but you often find out when pricing changes or a review lands. Check the MCC on file at onboarding and again after any re-underwriting, rate change or acquiring bank migration.

What happens if my account is terminated for miscoding? Expect a reserve held, a reported termination, and disclosure obligations on your next application. Reapply with the correct code, the checkout evidence to support it, and a written explanation of what changed. The merchants who recover fastest are the ones who lead with the miscoding rather than letting an underwriter discover it.

Is this legal advice? No. This is general information about card network rules and nothing more. Whether your code, your reserve or a termination opens up an actual claim is a question for a payments attorney or your acquirer - ask them before you act on anything here.

Useful sources

• Visa Merchant Data Standards Manual, October 2026 - usa.visa.com
• Visa Integrity Risk Program guide, April 6, 2023 - visa.cl
• Visa Core Rules (public) - usa.visa.com
• Mastercard Security Rules and Procedures (SPME) manual - mastercard.com
• Mastercard AN 4654 attachment on MCC 5968 and specialty registration MCCs - aibms.com mirror
• Mastercard Quick Reference Booklet, Merchant Edition - mastercard.com