High Risk Merchant Category Codes: What Each MCC Covers and Why It Matters

Quick answer: A merchant category code (MCC) is the four-digit number an acquiring bank assigns to your business to describe what you sell. Visa currently names a short list of "high integrity risk" codes for online sales, including 5122, 5912, 5966, 5967, 5993, 7273 and 7995. Land in one of them and expect extra underwriting, reserves and fewer willing banks.

If a processor has ever told you "we can't support your MCC," this guide explains what that means, which codes trigger it, and where your vertical usually lands.

What is a merchant category code?

An MCC is a four-digit code that classifies a merchant by its main line of business. Your acquiring bank (or the payment facilitator that boards you) picks it when your account is set up, and it travels with every card transaction you process. Card networks use it for pricing, reporting, rewards categories and risk rules.

The code is not your choice. Visa's Merchant Data Standards Manual (October 2026 edition) sets out how acquirers must pick it, and it is specific: a merchant with several lines of business at one location has to put any high integrity risk line on its own high-risk code rather than hide it under a safer one.

Getting the code wrong is not a paperwork slip either. Mastercard's Security Rules and Procedures (Merchant Edition, 4 August 2026) lists "Violation of Standards" as MATCH reason code 10, and it says this includes inaccurate transaction data the merchant controls, with the MCC named as an example. Miscoding can end with a listing on the MATCH list.

Which merchant category codes are high risk?

Visa's manual names the codes it treats as "high integrity risk." For all card-absent (online, phone, mail order) transactions, the list is:

Visa adds a second group that is high integrity risk only for certain card-absent transactions:

A detail worth knowing: in Visa's regions outside the US, codes 5912 and 5993 count as high integrity risk only for non-domestic transactions. For US merchants, the online rule applies across the board.

What do MCC 5993, 5967, 7995, 5122 and 5912 mean in practice?

MCC 5993 is where vape shops end up. Visa's description names electronic cigarettes directly, next to tobacco and smokers' supplies. A vape store coded under general retail instead is at risk of being recoded, or worse, flagged for inaccurate data.

MCC 5967 covers adult content sold remotely. Visa's listing names website subscriptions, video streaming and audio-text, so a subscription site or a fan platform sits here.

MCC 7995 is the betting code. Visa's manual says merchants that cannot separate a betting transaction from other transactions must code all of them 7995, and that any merchant running online gambling must use 7995 for every online transaction, even if gambling is not its main business.

MCC 5122 is wholesale. Visa describes it as business-to-business or wholesale distribution of drugs, pharmaceuticals and biological or related products.

MCC 5912 is the retail pharmacy code. It is high integrity risk for card-absent sales, which is why online pharmacies face a tougher path than walk-in drugstores.

Where do CBD, supplements and firearms land?

Visa's manual has no CBD-specific code. The acquirer picks the closest description, which for CBD often means a general specialty retail code such as 5999 (Miscellaneous and Specialty Retail Shops) or a food and vitamin code such as 5499, whose listing includes vitamin stores. Which one you get depends on the bank and on how your product line reads.

Supplements usually sit near 5499 too. If you sell them on a recurring plan through direct marketing, Visa's 5968 (Continuity/Subscription) description mentions "nutraceuticals" by name, and negative-option billing under 5968 is on the high integrity risk list.

Firearms have their own code, 5723 (Guns and Ammunition Shops). Visa's manual says it should be used only where legally required, and a footnote says acquirers must assign it to retailers in California, Colorado and New York that meet those states' definition of a firearms merchant. Our gun shop merchant category code piece covers that history.

Why does the MCC drive processor risk?

Because it changes what the bank has to do before and after it signs you.

• Registration and underwriting. Visa's Ecosystem Risk Programs Guide describes the Visa Integrity Risk Program as including a registration process for acquirers in high integrity risk processing. Merchants in those categories must be underwritten to confirm, among other things, that they operate in allowed jurisdictions and that their location is not misrepresented.
• Fewer banks in the pool. Only acquirers set up for these categories can sign you, so a high-risk code shrinks your options before anyone reads your application.
• Reserves and holds. Banks price the extra work and exposure in. That usually shows up as a rolling reserve, slower payouts, or higher rates.
• Dispute monitoring. Your dispute ratio is watched under network programs like the one in our Visa VAMP threshold guide. A high-risk code plus a bad month is the usual path to a frozen account.

None of this says your business is illegal. It says the card network has decided your category needs more checks, and every bank in the chain passes that cost to you.

Can you change your MCC to a lower-risk code?

Not by asking. The acquirer assigns the code based on what you actually sell, and the Visa manual requires the high-risk line of a mixed business to carry the high-risk code. Pushing for a softer code is how merchants end up terminated for inaccurate data. If your code is genuinely wrong (for example you stopped selling the product that earned it), give your processor the evidence and ask for a review.

How does ePayVista work regardless of your MCC?

ePayVista does not ask an acquiring bank to board your store under a category code, so there is no merchant account underwriting for a high-risk MCC to block. Your customers still pay by card, Apple Pay or Google Pay at checkout.

Here is the honest part. ePayVista is not the card processor. The card step runs through Stripe ("Pay by card", US cards) or Coinbase ("Pay with Coinbase", card, Apple Pay or bank), and those providers apply their own rules and the card networks' rules. They alone decide approvals, declines, 3D Secure and ID checks. We do not control that step and do not claim to.

What changes is everything on your side of it:

Settlement runs over our managed, non-custodial settlement layer, so we never hold merchant funds. ePayVista is built for US merchants selling to US customers; card payments outside the US are not guaranteed. Your business still has to be legal where you sell, and licensing stays your responsibility. More detail is in our FAQ.

FAQ

Take payments without a category code fight

If your MCC is the reason banks keep saying no, skip the application. Download the WooCommerce plugin or connect through the API and start taking card payments, settled to an account only you control, at a flat 1%.