Mastercard SMMP: 72 hours to investigate, document, and decide

What SMMP is

The Scam Merchant Monitoring Program (SMMP) is Mastercard's scam-focused monitoring regime for card-not-present merchants, published in the July 2025 update of the Security Rules and Procedures and in full effect since July 24, 2026. It applies globally, and it explicitly includes payment facilitators and their sponsored merchants. When Mastercard or an approved monitoring provider flags a merchant for suspected scam activity, the acquirer must investigate and reach a decision within 72 hours. If the merchant is confirmed to be running a scam, Mastercard and Maestro processing is terminated immediately, and the merchant may be placed on the MATCH list.

The one-sentence version: SMMP is an investigation mandate with a 72-hour decision deadline, and the penalty for a confirmed scam is termination, not a fine.

Not another ratio program

The programs risk teams already track, the excessive chargeback and excessive fraud programs, are ratio machines: cross a monthly threshold, enter the program, accrue fines, remediate over months. SMMP runs alongside them and works differently. It is triggered by scam signals, not by breaching a ratio, so a sub-merchant can sit comfortably under every chargeback and fraud threshold and still draw an SMMP flag. And where the ratio programs price bad behavior, SMMP removes it: the consequence of a confirmed investigation is immediate loss of processing.

One detail worth internalizing from the dispute side: winning a chargeback at representment does not reduce the count for SMMP or the ratio programs. Once filed, it counts, regardless of who eventually wins.

What starts the clock

The published triggers:

• A combined refund plus chargeback rate above 5% of total transactions over a rolling 30-day period, with a 500-transaction minimum.
• An authorization approval rate that drops more than 50 percentage points within 72 hours, or falls below 30%.
• Fraud reports citing manipulation of the cardholder (reason code 56) from two or more issuers.
• Chargebacks from two or more issuers whose documentation references a scam.
• Multiple MID requests without business justification.
• Alerts from Mastercard's own intelligence or from approved Merchant Monitoring Service Providers (MMSPs).

New merchants get extra attention: anything with under six months of Mastercard acceptance history sits in a heightened-scrutiny window. For a PayFac boarding hundreds of sub-merchants a month, that means a standing slice of the portfolio is always inside the sensitive period.

Why 72 hours is the hard part

None of the individual obligations here is new to a risk team. Investigating a flagged merchant, deciding, and documenting the decision is the job. What is new is the clock. The evidence a defensible scam call needs, the boarding file and KYB result, the beneficial owners, the dispute and refund trend, the authorization pattern, prior alerts and how they were resolved, lives in five or six different vendor consoles plus the processor's reporting. Assembling that picture is routinely a multi-day job on its own, before anyone has made a judgment.

The 72-hour window also has an asymmetry built in. Terminate too eagerly and you have killed a legitimate sub-merchant's business on a false positive, with the MATCH consequences that follow. Clear a real scam and the next flag arrives with your name on the earlier decision. Either way, the acquirer will eventually ask the same question: what did you look at, and why did you decide the way you did? A verdict without the assembled evidence behind it is not an answer.

Deciding inside the window: one record per sub-merchant

FinQub is the single source of truth for your risk decisions. It sits alongside the KYB, sanctions, fraud, and monitoring tools you already run, and lands every signal they produce on one record per sub-merchant. For SMMP, that changes the shape of the 72 hours.

Before the flag. The boarding decision, every monitoring signal since, every prior alert and its resolution are already on the record. The investigation starts from an assembled picture, not a scavenger hunt.

Inside the window. Your policy makes the call on the full signal set. Vendor outputs are signals, not decisions; the rule that decides, and any human override with its rationale, is captured on the record at decision time.

After the decision. When the acquirer, or Mastercard through the acquirer, asks how the call was made, one query produces the packet: the flag, every signal reviewed, the policy version that applied, the decision, and who signed it, as it stood inside the window. That holds whether the answer was terminate or clear.

An SMMP readiness checklist for PayFac risk teams

• Confirm with your acquirer how SMMP flags will reach you, and how much of the 72 hours is left by the time they do.
• Know your current refund-plus-chargeback rate per sub-merchant on a rolling 30 days, not just the monthly program ratios.
• Watch authorization approval rates for cliff drops; a 50-point fall inside 72 hours is itself a trigger.
• Map your under-six-month cohort. That slice of the book is in the heightened-scrutiny window by definition.
• Be able to assemble a sub-merchant's full history, boarding decision, signals, alerts, resolutions, in minutes, not days.
• Write down the decision every time, including the clears. The flag that matters is the second one on the same merchant.

Frequently asked questions

SMMP is one clock among several now running on PayFac portfolios: the Visa VAMP thresholds tightened in April, and MATCH placement decisions carry their own documentation burden. The common answer is the same record: continuous sub-merchant monitoring landing on the single source of truth for fintech risk decisions. Book a short walkthrough below to see it on your stack.