And How LegitScript Can Help You Accurately Assign Them
Merchant category codes (MCCs) are critical codes that categorize and describe a merchant's business, and in rare cases, a merchant may have multiple MCCs to separate transaction types.
In this article, we’ll explore the role of MCCs in the larger payments ecosystem, visit Visa and Mastercard’s rules surrounding them, and provide a comprehensive list of high-risk MCCs.
Then we invite you to talk to an expert and learn how LegitScript MCC Detection can help your business optimize how you assign and track MCCs — and better prevent compliance issues and potential penalties.
What Are Merchant Category Codes — or MCCs?
Merchant category codes (MCCs) are four-digit numbers assigned to merchants so that card networks, acquiring banks, payfacs, processors, and ISOs can define what types of businesses are processing transactions within their payments ecosystem. This enables networks to clearly track and report on the use of their services. And that ensures they can take enforcement action when a merchant is incorrectly coded.
Enforcement actions include per-transaction monetary penalties — better known as card network fines, and, in extreme cases, can also take the form of restricted or removed processing privileges.
The Role of MCCs in the Broader Payments Ecosystem
MCCs are officially defined by the International Organization for Standardization (ISO), and payment processing providers such as Visa and Mastercard use the standardized definitions.
According to the Visa Merchant Data Standards Manual, MCCs are “assigned to describe a Merchant’s primary business based on annual sales volume measured in local currency.”
Visa confirms some MCCs identify the type of transaction while clarifying, “Visa and its members use MCC data for a range of purposes, including activity tracking, reporting, and risk management.”
Mastercard takes a slightly different approach. They utilize MCCs but organize them by separating businesses and industry — referred to in the Merchant Edition of Mastercard’s Quick Reference Booklet as “Industry Card Acceptor Business (CAB) Programs.”
CAB programs are categorized by (merchant category) code and include a description of the industry. “Each card acceptor business code (MCC) is associated with a particular industry and, therefore, belongs to one, and only one, industry CAB program.”
How MCCs Impact Fees and Rates in the Larger Payments Ecosystem
MCCs affect fees and rates in a myriad of ways. Let’s explore the various types below.
- Interchange Rate: This is a fee businesses must pay to accept card payments.
- Cardholder Fees: Select businesses are legally allowed to charge customers a service fee on card payments — depending on the type of MCC.
- High-risk Merchant Identification: Acquirers and payment processors use the MCC to assess the relative risks associated with the merchant.
- Chargeback Protection: Certain MCCs receive more scrutiny due to the nature of the business as some industries experience higher rates of fraud and/or higher chargeback ratios. This makes accurately assigning MCCs a critical component of any bank, payfac, or ISO’s risk management strategy.
- Taxes: MCCs indicate to the IRS if a transaction needs to be reported to them.
These Are Visa’s Six Core Rules Surrounding MCCs
According to the Visa manual linked above, there are six general rules for assigning MCCs.
- “Select the MCC that most accurately describes the Merchant’s business,” meaning the MCC should accurately reflect the type of business the merchant engages in.If there is more than one line of business that could qualify for multiple MCCs, the merchant must either:
-
- “Use the MCC that describes the business with the highest sales volume (measured in local currency) to process all Visa sales.”
- “Use different MCCs for each line of business.”
2. This rule cautions banks, payfacs, and ISOs to use the miscellaneous category sparingly and only in times “when no other MCC applies to its Business.”
3. “Merchants with multiple Merchant outlets must choose the appropriate MCC for each
individual outlet.” Although e-commerce merchants exist in the online space across multiple jurisdictions, each website is considered a location, and there is generally one e-commerce website per country. Visa also states, “Acquirers may have multiple websites in the same country if there are different Merchant names or check-out processes.”
“If there are different businesses operating on the same Merchant premises, each
business must be assigned its own MCC if any of the following apply.”
-
- If the business operates beneath a different merchant name.
- If it operates in a distinct area or location.
- Or if it has separate points of sale.
4. “When applicable, use the unique Merchant-specific MCCs that have been designated for major travel and entertainment [merchants].” Furthermore, “if an airline, car rental, or lodging Merchant has a Merchant-specific MCC, it must be used for all transactions related to the Merchant’s core business.”
5. “Direct marketing and wholesale club MCCs describe how the Merchant conducts its business rather than what the Merchant sells or provides.”
This Is How Mastercard Defines the Required Use of Card Acceptor Business Codes (MCCs)
Although Visa and Mastercard use and define MCCs similarly, the Mastercard documentation linked above calls them Card Acceptor Business Codes and clarifies that MCCs are an essential component in “all authorization and clearing messages initiated at a point of interaction location.”
This ensures the MCC accurately reflects the merchant’s business and helps Mastercard “facilitate risk management.”
“Acquirers must provide a valid and accurate MCC recognized by Mastercard in Data Element (DE) 26 (Card Acceptor Business Code [MCC]) of the IPM First Presentment /1240 message.
An accurate MCC is defined as a valid MCC that most reasonably and fairly describes the merchant’s primary business.”
Mastercard Establishes a Process for Determining New MCCs
With the exception of travel and entertainment industry MCCs — here is Mastercard’s established process for determining new, generic MCCs.
These criteria should be reviewed when determining if a merchant qualifies for a new card acceptor business code (MCC).
- “Projected annual bankcard volume for the MCC must equal at least USD 10 million,” AND “the new merchant type must be distinct and separate from other industries.”
- OR “industry transaction characteristics require that the transactions must be identified specifically in the authorization and clearing systems to maximize Mastercard opportunities.”
What Are High-risk MCCs?
According to Payment Cloud, “When a business applies for a merchant account, a four-digit merchant category code (MCC) is attached to the account accompanied by a merchant identification number (MID).
While the MID identifies an individual merchant, the MCC refers to a merchant’s industry type.” And high-risk MCCs are defined as those that “correspond to industries carrying an elevated risk of payment processing liability.”
What is High-risk Registration?
Card networks have identified certain MCCs as presenting high integrity risk and maintain special registration requirements for merchants operating in these categories. Acquirers must register these merchants with the applicable card networks before enabling processing activity.
The lists of MCCs requiring high-risk registration vary slightly between Visa and Mastercard, as do the ways in which these two card networks refer to their respective registration programs. Visa's is called High Integrity Risk Registration, while Mastercard's is the Specialty Merchant Registration Program.
A List of MCCs That Require High-risk Registration
Below is a comprehensive list of the MCCs that Visa and/or Mastercard deem high-risk and therefore may be subject to the special registration requirements. Please note, this particular high-risk designation typically applies to merchants that are processing card-not-present transactions in these categories.
- 4816 - Computer Network/Information Services
- 5122 - Drugs, Drug Proprietaries, and Druggist Sundries
- 5816 - Digital Goods – Games
- 5912 - Drug Stores and Pharmacies
- 5966 - Direct Marketing – Outbound Telemarketing Merchant
- 5967 - Direct Marketing – Inbound Teleservices Merchant
- 5968 - Direct Marketing – Continuity/Subscription Merchant
- 5993 - Cigar Stores and Stands
- 6012 - Financial Institutions – Merchandise, Services, and Debt Repayment
- 6051 - Non-Financial Institutions – Foreign Currency, Liquid and Cryptocurrency Assets (for example: Cryptocurrency), Money Orders (Not Money Transfer), Account Funding (not Stored Value Load), Travelers Cheques, and Debt Repayment
- 6211 - Security Brokers/Dealers
- 7273 - Dating Services
- 7800 - Government-Owned Lotteries (US Region only)
- 7801 - Government Licensed On-Line Casinos (On-Line Gambling) (US Region only)
- 7802 - Government-Licensed Horse/Dog Racing (US Region only)
- 7841 - DVD/Video Tape Rental Stores
- 7994 - Video Game Arcades/Establishments
- 7995 - Betting, including Lottery Tickets, Casino Gaming Chips, Off-Track Betting, Wagers at Race Tracks, and games of chance to win prizes of monetary value
- 9406 - Government-Owned Lotteries (Non-U.S. region)
How to Ensure Your Business Has the Right MCC
LegitScript MCC Detection helps acquirers, payfacs, and ISOs precisely assign MCCs as part of the underwriting and/or onboarding process, as a way to identify and correct miscodings, or as a tool to identify businesses whose MCCs need to be updated.
Our solution is AI-powered and trained on 15+ years of merchant risk data. Accurately assign MCCs in 30 seconds or less and receive primary as well as alternative MCC recommendations. Each set of recommendations includes a clear explanation, confidence rating, and any detected high-risk or mismatch flags.
Stay compliant and attuned to the risk within your merchant portfolio with LegitScript MCC Detection.
