GuideSeptember 2026 · 11 min read

Mastercard GMAP Guide 2027: The Global Merchant Audit Program Explained

Source note: Mastercard's original bulletin (GLB 14127.1) announcing GMAP is closed and not publicly available. This guide summarises industry analyses of that bulletin (Chargeback Gurus, SLYCE360, FunnelFox), which agree on the figures below but diverge on some mechanics. Verify with your acquirer before relying on any number here for compliance planning — including in our own GMAP calculator.

Quick answer

Mastercard's Global Merchant Audit Program (GMAP) launches April 1, 2027. It merges fraud monitoring and chargeback monitoring into one combined ratio — fraud reported to the Fraud and Loss Database counts even without a chargeback. It replaces ECM, EFM, HECM and ACMP, introduces new HDM/EDM merchant tiers and HDA/EDA acquirer tiers, and moves monitoring to the sub-merchant ID level.

Check your GMAP exposure

Free calculator — see your combined ratio and projected fines.

Open GMAP calculator →

What GMAP Changes

Mastercard's Global Merchant Audit Program (GMAP) is a new merchant and acquirer monitoring system launching April 1, 2027. It replaces four existing programmes in one move: the Excessive Chargeback Merchant (ECM), Excessive Fraud Merchant (EFM) and High Excessive Chargeback Merchant (HECM) programmes for merchants, and the Acquirer Chargeback Monitoring Program (ACMP) for acquirers.

The headline change is what counts toward your ratio. Today's programmes count chargebacks. GMAP counts fraud and disputes together — a transaction reported as fraud to Mastercard's Fraud and Loss Database counts against you even if the cardholder or issuer never files a formal chargeback.

GMAP at a glance

  • Launches April 1, 2027 — Mastercard systems update in October 2026
  • Merges fraud monitoring and chargeback monitoring into one ratio
  • Fraud counts even without a matching chargeback
  • Replaces ECM, EFM, HECM (merchant programmes) and ACMP (acquirer programme)
  • New merchant tiers: HDM (High Dispute Merchant), EDM (Excessive Dispute Merchant)
  • New acquirer tiers: HDA (High Dispute Acquirer), EDA (Excessive Dispute Acquirer)
  • Monitoring moves to the sub-merchant ID level, not the MID level

The New Combined Fraud + Dispute Metric

GMAP's ratio combines two things that used to be tracked separately:

Ratio = (Fraud reported to the Fraud and Loss Database + Non-fraud chargebacks) ÷ Sales in the prior month

Two things make this different from today's ECM/HECM calculation. First, fraud is counted even when no chargeback was ever filed — a merchant who identifies and voluntarily refunds fraudulent orders (or whose issuer flags fraud without disputing) still has that fraud counted here. Second — and this is where industry sources disagree — some analyses describe the ratio as calculated by transaction count, others by dollar amount. Neither interpretation has been confirmed against an official Mastercard source, since the original bulletin isn't public.

Our GMAP calculator lets you check your ratio both ways, side by side, so you have both numbers ready when you confirm methodology with your acquirer.

New Merchant Categories: HDM and EDM

To land in a GMAP merchant tier, all three conditions must be met in the same month — a minimum transaction count, a minimum dollar amount, and the ratio threshold:

CategoryMin. transactionsMin. amountRatio threshold
HDM5+$5,000+5%
EDM5+$10,000+50%

Fine schedules

HDM fines

  • Months 1–6$0
  • Months 7–11$5,000/month
  • Months 12–18$10,000/month
  • Month 19+$25,000/month

EDM fines

  • Month 1$5,000
  • Month 2$25,000
  • Months 3–11$100,000/month
  • Months 12–18$200,000/month
  • Month 19+$300,000/month
Retroactive fraud liability: a merchant that spends two consecutive months in EDM becomes liable for fraud-related chargebacks going back 3 months before entering the programme and for 6 months after. This is on top of the monthly fines above.

To exit HDM or EDM, a merchant needs three consecutive months below the applicable threshold — one month longer than the two-month exit requirement under today's ECM programme.

New Acquirer Tiers: HDA and EDA

GMAP also replaces the Acquirer Chargeback Monitoring Program (ACMP) with two new acquirer-level tiers, applying once an acquirer processes 1,500+ transactions for a merchant relationship:

CategoryThresholdFines
HDA0.5%Escalating, per acquirer
EDA0.7%Up to $100,000/month

These thresholds are far below the 5% HDM trigger — and that gap matters. Because an acquirer faces its own fines for its merchant portfolio's combined ratio, acquirers are likely to start limiting volume, tightening reserves, or offboarding risky merchants well before those merchants individually reach the 5% HDM threshold. If your ratio is climbing, don't wait for the merchant-level trigger — your acquirer is watching a lower number.

How ECM, EFM and HECM Fold Into GMAP

The current chargeback-only programmes don't disappear so much as get absorbed. Two structural changes matter beyond the merger itself:

  • Monitoring moves to the sub-merchant ID level. A platform or marketplace with many sub-merchants under one MID can no longer dilute one bad sub-merchant's ratio across the whole portfolio — each sub-merchant is watched individually.

  • The legacy ECM ratio threshold steps down over several years, while the 100-chargeback monthly minimum stays in place.

YearsECM threshold
2027–20281.5%
20291.3%
20301.1%
20310.9%

A minimum of 100 chargebacks per month continues to apply throughout — a merchant with a high ratio but low absolute chargeback volume stays outside this particular gate, though the combined GMAP metric above has its own, separate 5-transaction/$5,000 gate that catches smaller merchants differently.

Key Dates

October 2026

Mastercard systems update ahead of launch

April 1, 2027

GMAP officially launches, replacing ECM, EFM, HECM and ACMP

May 2027

First violation invoices expected

One more related change: the Questionable Merchant Audit Program (QMAP) is also being tightened alongside GMAP — its minimum volume trigger drops from $50,000 to $10,000, and its case review period shortens from 120 days to 30 days. Smaller and faster-moving cases will qualify for QMAP review than do today.

What This Means If You're Building or Using a Ratio Calculator

The single most important adjustment: fraud without a chargeback now counts. A calculator or internal spreadsheet that only tracks confirmed chargebacks will understate your real GMAP ratio — potentially significantly, for merchants with meaningful fraud-detection or voluntary-refund activity that never reaches a formal dispute.

Because sources disagree on count-based vs. amount-based calculation, the safest approach is to track both. Our GMAP calculator computes your ratio both ways side by side, so you can compare against whichever methodology your acquirer confirms.

ChargeMate

Get ahead of GMAP before it launches

ChargeMate generates network-compliant dispute responses for Mastercard and every other network — helping reduce both your chargeback count and your reported fraud exposure. No API integration required.

Try the GMAP calculator →

Frequently Asked Questions

What is Mastercard GMAP and when does it launch?
GMAP (Global Merchant Audit Program) is a new Mastercard monitoring programme launching April 1, 2027. It merges the current chargeback monitoring programmes (ECM, EFM, HECM) and the acquirer programme (ACMP) into a single combined fraud-and-dispute ratio, monitored at the sub-merchant ID level. Mastercard's systems update in October 2026, and the first violation invoices are expected in May 2027.
Is this information official from Mastercard?
No — Mastercard's original bulletin (GLB 14127.1) announcing GMAP is closed and not publicly available. This guide is compiled from industry analyses that reviewed the bulletin (Chargeback Gurus, SLYCE360, FunnelFox), which broadly agree on the numbers below but diverge on some mechanics, including whether the ratio is calculated by transaction count or dollar amount. Confirm the exact figures and methodology with your acquirer before making compliance decisions.
What is the biggest change from current Mastercard chargeback monitoring?
Fraud counts even without a chargeback. Under GMAP, any transaction reported to Mastercard's Fraud and Loss Database counts toward your ratio, whether or not the cardholder or issuer ever filed a formal dispute. Today's ECM/HECM programmes only count actual chargebacks. A merchant with low chargeback volume but high reported fraud could be well below today's 1.5% ECM threshold and still land in GMAP's HDM tier.
What are the HDM and EDM thresholds?
High Dispute Merchant (HDM): a combined fraud + non-fraud chargeback ratio of 5% or higher, with at least 5 transactions worth $5,000 or more in the month. Excessive Dispute Merchant (EDM): a ratio of 50% or higher, with at least 5 transactions worth $10,000 or more. All three conditions — count, dollar amount, and ratio — must be met to trigger either tier.
What fines does GMAP carry?
HDM: $0 in months 1-6, $5,000/month in months 7-11, $10,000/month in months 12-18, and $25,000/month from month 19 onward. EDM: $5,000 in month 1, $25,000 in month 2, $100,000/month in months 3-11, $200,000/month in months 12-18, and $300,000/month from month 19 onward. Acquirers face their own fines of up to $100,000/month under the new HDA/EDA tiers.
Will my acquirer restrict me before I hit 5%?
Very likely. GMAP introduces acquirer-level thresholds — 0.5% (HDA) and 0.7% (EDA) — that apply once an acquirer processes 1,500+ transactions for a merchant. Because acquirers face fines up to $100,000/month for breaching these, most are expected to start limiting volume or offboarding risky merchants well before those merchants individually reach the 5% HDM threshold.
What happens to the ECM threshold for merchants not yet in HDM/EDM?
The legacy Excessive Chargeback Merchant threshold folds into GMAP and steps down over several years: 1.5% in 2027-2028, 1.3% in 2029, 1.1% in 2030, and 0.9% in 2031, with a 100-chargeback monthly minimum still applying. Monitoring also moves from the merchant ID level to the sub-merchant ID level, so one bad sub-merchant can no longer be diluted across a larger portfolio.

Related Guides

Worried about your Mastercard dispute exposure ahead of GMAP? ChargeMate handles responses for $10/case.

Talk to us about outsourcing →