Mastercard is retiring the Acquirer Chargeback Monitoring Program and replacing it with a single framework: the Global Merchant Audit Program, or GMAP. It takes effect April 1, 2027, and for the first time, Mastercard scores Acquirers on the same fraud-and-dispute calculation it uses for Merchants. If you’ve worked through Visa’s VAMP rollout already, the shape of this will look familiar.

Mastercard announced the change through bulletin GLB 14127.1 — “Revised Standards for the Acquirer Chargeback Monitoring Program (ACMP), the Global Merchant Audit Program (GMAP), and the Questionable Merchant Audit Program (QMAP)” — published July 28, 2026, on Mastercard Connect, the portal Mastercard uses to communicate directly with Acquirers. That’s why you won’t find a press release on Mastercard’s public site: network bulletins go straight to the member institutions they govern, not the open web. If your team has portal access, it’s worth pulling the bulletin directly; everything below reflects how the industry has interpreted and corroborated it since.

What GMAP Replaces

GMAP folds three existing Merchant categories under one roof and adds four new ones, two at the Merchant level and two at the Acquirer level for the first time.

Excessive Fraud Merchant (EFM) — 1,000+ e-commerce transactions, $50,000+ in fraud chargebacks, 0.5%+ ratio all measured on a monthly basis. Excessive Chargeback Merchant (ECM) keeps its structure but tightens on a schedule. High Excessive Chargeback Merchant (HECM) holds steady at 300+ chargebacks and a 3%+ ratio. Remember that unlike Visa, MasterCard uses transactions from the previous month as the denominator in the current month’s calculation.

The chargeback floor stays fixed at 100 while the ratio band keeps shrinking through 2031 — a 40% cut from where it starts. A Merchant sitting comfortably under the line today can breach it in four years without changing a thing.

One change matters more for payment facilitators and marketplaces than the headline thresholds: starting April 1, 2027, EFM, ECM, and HECM monitoring shifts from the Merchant ID (MID) to the sub-merchant ID wherever one is populated. That closes the long-standing loophole of diluting one bad-acting sub-merchant into a healthy aggregate MID average.

New at the Merchant level: High Dispute Merchant (HDM) and Excessive Dispute Merchant (EDM) — this is the real headline of the framework.

HDM and EDM: One Combined Ratio

The structural shift is combining two signals Mastercard used to track separately: fraud reported to the Fraud and Loss Database (FLD, the successor to SAFE) and non-fraud chargebacks. No transaction counts twice — it’s either fraud or a chargeback, never both.

GMAP ratio = (FLD fraud reports + non-fraud chargebacks) ÷ prior month’s sales

Take a Merchant that processed 8,000 transactions last month and generates 60 fraud reports plus 20 non-fraud chargebacks this month. That’s 80 against 8,000 — a 1% ratio. The dollar floors below matter just as much as the ratio itself.

Five transactions is a low floor — a slow month can be enough to trip HDM if the dollar and ratio tests both clear.

Assessments climb the longer a Merchant stays flagged, and HDM and EDM escalate on different clocks:

This ladder is one of the most consistently corroborated figures across the industry.

HDM alone doesn’t trigger automatic liability — Mastercard notifies issuers, who typically pull back approval rates in response. EDM is sharper. After two months over threshold, the Merchant becomes liable for fraud chargebacks going back three months before identification and forward six months after — a nine-month exposure window. Mastercard publishes the identified Merchant, and issuers can invoke reason code 4849, the same “Questionable Merchant” code from Mastercard’s original fraud-monitoring framework, to recover 100% of the disputed amount without needing supporting documentation.

Where It Bites Hardest: Acquirer-Level HDA and EDA

Merchant thresholds are the warm-up. The part that should get an Acquirer’s full attention is portfolio-level scoring at the ICA level, measured separately for card-present and card-not-present activity.

Read that ratio again: 0.5% at the portfolio level versus 5% for an individual Merchant. A book can look clean Merchant by Merchant and still breach HDA in aggregate — the same bet Visa already built into VAMP’s Acquirer-level thresholds.

A minority of vendor write-ups list $10,000 for HDA’s 19+ tier, which is lower than the preceding tier and doesn’t hold up mathematically. We’re going with $50,000, which matches the sources that cross-check cleanly.

Twelve months of noncompliance triggers a self-funded Franchise Management Program review. Past 19 months, restrictions, suspension, or license termination are on the table. Three consecutive clean months resets the counter across all four new categories.

QMAP Gets a Lower Bar and a Shorter Clock

The same bulletin revises the Questionable Merchant Audit Program, Mastercard’s tool for collusive or fraudulent Merchant activity, on the same April 2027 timeline.

Five transactions totaling $10,000 will be enough to open a case, and a Merchant’s approval rate now doubles as compliance evidence. A lower floor and a shorter window mean QMAP will catch smaller, newer Merchants that the current rules let slide.

GMAP vs. VAMP: Same Playbook, Different Network

If you’re thinking that GMAP feels familiar, you’re correct. — it’s the same bet Visa already made with VAMP.

The math differs in the details — see our VAMP threshold breakdown for Visa’s exact bands — but the direction is identical: fraud and disputes converge into one score, and Acquirers own the portfolio result. If your team already built a VAMP prep checklist, you’re most of the way to GMAP-ready.

What Acquirers Should Do Before April 2027

1. Get FLD fraud data flowing to your risk team monthly — GMAP counts fraud the moment it’s reported, whether or not it ever becomes a chargeback.
2. Re-segment your portfolio by the combined ratio, not chargebacks alone. A Merchant refunding pre-dispute alerts still has an active fraud record underneath.
3. Model your book against the 0.5% Acquirer-level line, not just Merchant thresholds — that’s where breaches surface first.
4. Flag new, seasonal, and low-volume Merchants early; five transactions can trigger HDM.
5. Revisit underwriting for Merchants near the new $10,000/30-day QMAP standard, especially newer businesses the current age exemption currently screens out.
6. If you run a PayFac or marketplace model, audit sub-merchant IDs now — averaging a bad actor into a blended MID stops working April 1, 2027.
7. Build three consecutive clean months into every remediation timeline.

The Bottom Line

GMAP moves Mastercard’s compliance model in the same direction Visa already moved with VAMP: fraud that never shows up on a chargeback report now counts against the whole portfolio, and Acquirers carry a threshold significantly tighter than the one their Merchants face. That’s the blind spot SLYCE360 was built for — unifying Acquirer payments data with Merchant CRM data so you can see combined fraud-and-dispute drift months before an audit opens, not after the first assessment lands.

 GMAP FAQs

What does GMAP stand for?
Global Merchant Audit Program — Mastercard’s replacement for the Acquirer Chargeback Monitoring Program, effective April 1, 2027.

Where did Mastercard announce GMAP?
In bulletin GLB 14127.1, published July 28, 2026, on Mastercard Connect — the portal Mastercard uses to communicate directly with member Acquirers, not a public press release.

What’s the GMAP ratio formula?
(FLD fraud reports + non-fraud chargebacks) ÷ prior month’s sales.

How is GMAP different from VAMP?
Both score Acquirers and Merchants on combined fraud-and-dispute ratios with a lower bar for Acquirers than Merchants. VAMP is Visa’s version and has been live since October 2025; GMAP is Mastercard’s parallel framework, effective April 1, 2027.

When do the ECM ratio changes take effect?
Thresholds hold steady through 2028, then step down each January from 2029 through 2031.

Sourcing note: GMAP’s effective date, thresholds, and assessment schedule are drawn from Mastercard bulletin GLB 14127.1 as corroborated across multiple independent payments-compliance sources and direct industry commentary. The bulletin itself is distributed to Acquirers via Mastercard Connect and is not publicly posted, so figures should be confirmed against your own Mastercard Connect access before final publication decisions.