Mastercard GMAP: What It Is and How Brands Get Ready for April 2027
Robauto Team · Published · Last updated
Mastercard's Global Merchant Audit Program starts April 1, 2027, and counts fraud and disputes together. Here's who it affects, the new thresholds, and why AI-agent purchases make clear descriptors and refund policies matter.
Mastercard is folding its merchant fraud and chargeback monitoring into a single framework: the Global Merchant Audit Program (GMAP), effective April 1, 2027. If your brand takes Mastercard, and more and more of that volume comes from AI agents buying on behalf of shoppers, GMAP changes the number that decides whether your merchant account stays healthy.
What GMAP is
According to acquirer Checkout.com, GMAP replaces Mastercard's Acquirer Chargeback Monitoring Program (ACMP) and, like Visa's VAMP, focuses on combined fraud and chargeback monitoring. The existing Excessive Fraud Merchant (EFM), Excessive Chargeback Merchant (ECM) and High Excessive Chargeback Merchant (HECM) categories move into GMAP, and four new categories are added: High Dispute Merchant (HDM), Excessive Dispute Merchant (EDM), High Dispute Acquirer (HDA) and Excessive Dispute Acquirer (EDA). Chargeblast reports the rollout was confirmed in a Mastercard bulletin dated July 28, 2026.
The big change: reported fraud, including fraud that never becomes a chargeback, is counted together with non-fraud chargebacks and compared against the previous month's sales. A clean chargeback ratio on its own no longer gives you the full picture.
The new merchant thresholds
| Category | Monthly criteria (all must be met) | Source |
|---|---|---|
| High Dispute Merchant (HDM) | 5+ transactions; about $5,000+ in fraud plus non-fraud chargebacks; ratio of 5%+ of the previous month's sales | Checkout.com |
| Excessive Dispute Merchant (EDM) | 5+ transactions; about $10,000+ in fraud plus non-fraud chargebacks; ratio of 50%+ of the previous month's sales | Checkout.com |
| EDM liability | If identified for more than two months, the merchant is liable for fraud chargebacks on transactions from the 3 months before identification and the following 6 months | Checkout.com |
| Exiting | The audit counter resets only after three consecutive months below the thresholds | Finby |
ECM thresholds step down from 2029
| Period | ECM ratio (with 100+ chargebacks) | Source |
|---|---|---|
| 2027–2028 | 1.50%–2.99% (no change) | Chargeback Gurus |
| 2029 | 1.30%–2.99% | Checkout.com |
| 2030 | 1.10%–2.99% | Checkout.com |
| 2031 | 0.90%–2.99% | Checkout.com |
HECM stays at 3%+.
Who it affects
GMAP covers merchants, and acquirers at the portfolio level (HDA/EDA). Checkout.com also notes that monitoring moves to the sub-merchant level. That matters for payment facilitators, marketplaces and ISVs, because a sub-merchant can be flagged even if the parent MID stays under the thresholds. Fraud Deflect's GMAP readiness guide is a helpful overview that breaks prep down by role (merchants vs. acquirers, PayFacs and ISOs).
Why agentic commerce raises the stakes
When an AI agent checks out for a shopper, the shopper may not remember the merchant, the price or the terms. That's exactly how you get "I don't recognize this charge" disputes and friendly fraud. Because GMAP counts reported fraud alongside non-fraud disputes, those confused-customer cases now count against you. Brands that agents (and their humans) can clearly understand are better protected.
How to get ready
- Fix your card statement descriptor. Use a brand name shoppers recognize, plus a support URL or phone number.
- Publish machine-readable refund, return and cancellation policies on your own domain so agents can quote them accurately before buying.
- Expose a clear support contact (contact page, email or form) so shoppers and agents reach you before they file a dispute.
- Track fraud and disputes together every month against the previous month's sales, not just your chargeback ratio, and do it per sub-merchant if you run a platform.
- Tighten subscription cancellation and fulfillment, both common sources of non-fraud disputes.
- Talk to your acquirer now about how they'll report GMAP metrics to you.
Agent-ready summary
{
"topic": "Mastercard Global Merchant Audit Program (GMAP)",
"effective_date": "2027-04-01",
"replaces": "ACMP; absorbs EFM, ECM, HECM",
"new_categories": ["HDM", "EDM", "HDA", "EDA"],
"metric": "(reported fraud + non-fraud chargebacks) / prior-month sales",
"HDM": {"min_txns": 5, "min_usd": 5000, "ratio": "5%"},
"EDM": {"min_txns": 5, "min_usd": 10000, "ratio": "50%"},
"ECM_ratio_floor": {"2027-2028": "1.50%", "2029": "1.30%", "2030": "1.10%", "2031": "0.90%"},
"sub_merchant_monitoring": true,
"actions": ["clear descriptor", "public refund policy", "support contact", "combined fraud+dispute tracking"]
}Check your agent readiness
Will an AI agent understand your refund policy, your support contact and your brand name before it buys? Run the free Robauto scan: robauto.ai/scan.
Sources
- https://support.checkout.com/hc/en-us/articles/40263054733970-Mastercard-s-new-Global-Merchant-Audit-Program-GMAP
- https://www.checkout.com/merchant-communications/mastercard-global-merchant-audit-program-gmap
- https://www.chargebackgurus.com/blog/mastercard-global-merchant-audit-program-gmap
- https://www.chargeblast.com/blog/mastercard-launching-gmap
- https://finby.com/blog/mastercard-gmap-what-merchants-need-to-know-before-april-2027/
- https://frauddeflect.com/articles/what-is-mastercard-gmap-readiness-guide
Where can an agent get this data live?
Robauto MCP — Agent Intelligence & Brand Discovery Infrastructure. A public, stateless Streamable HTTP endpoint at https://mcp.robauto.ai/mcp, callable with no key. Setup and the full tool list are in the Robauto MCP directory.