Green Sheet interviews RPY Innovation's Emily Baxter

In October 2024, Visa replaced its Global Acquirer Risk Standards (GARS) with the Visa Acceptance Risk Standards (VARS), updating the risk control framework to protect the integrity of Visa's global payment system. The Green Sheet discussed the new program and its impact on merchant acquirers with Emily Baxter, security consultant at RPY Innovations. Following are interview highlights.

What notable differences have you seen between GARS and VARS?

VARS represents a broad shift in tone and scope – three key differences from GARS are:

• VARS is a global standard, dropping the US-centric callouts found in GARS
• VARS introduces a modular framework, organized by archetypes and risk domains
• VARS follows a linguistic shift also seen in PCI, with a focus on the objective rather than the steps taken to get there. 

You mentioned the Visa Fraud Monitoring Program (VFMP) and Visa Acquiring Monitoring Program (VAMP) will be rolled into the Visa Dispute Monitoring Program (VDMP). How will this change the look and feel of monitoring for ISOs, merchant acquirers and third-party agents (TPAs)? 

The merging of VFMP and VDMP, along with the removal of the Early Warning Program, simplify compliance: there is now a single metric for disputes, regardless of their classification of fraud or not.  For merchant acquirers and TPAs, we anticipate many parties will implement internal early warning programs to ensure their portfolio doesn't fall under VAMP monitoring.  VAMP also introduces a new metric: enumeration attacks.

This refers to repeated card not present transactions targeting a single card or BIN, by cycling values such as DVV or expiry to obtain the correct values.  This will impact providers of online payment forms, as fraud monitoring tools and processes to handle enumeration attacks will need to be implemented if they haven't already been. 

What specific guidance by Visa applies to payment facilitators, with greatly reduced references to "PayFacs" in VARS?

Third Party Agents are a key focus of VARS, and Payment Facilitators are placed squarely in this category. Merchant Acquirer obligations shift from "ensure" third-party agents are aware of the acquirer's policies and requirements to remain in compliance with Visa Rules" (GARS) to "verifying the TPA's compliance" (VARS) which will greatly expand the ongoing audits and due diligence required to run a compliance TPA program.

What are some key differences in VARS requirements and controls, which are based on each party's business type, affiliations, and transactions? 

Introducing archetypes sets VARS apart – acquirers undergo a "choose your own adventure" by evaluating their solution against the possible archetypes. This allows acquirers to understand the obligations of current state more deeply and its impact, should they expand program offerings. 

All acquirers are subject to the core requirements, with additional requirements broken out by acquirers sponsoring third party agents, processing for High Integrity Risk Transaction Merchants, processing for ATMs, or Money Movement Entities. 

What are some key considerations for complying with the 3 risk domains of VARS – business risk, operational risk, and legal and regulatory risk? 

One great thing about the risk categories in VARS is a more explicit definition of risk and the very real impact risks can have on an organization. When implementing the mandatory controls required, organizations should ensure they are meeting both the letter of the control and the spirit of the risk statement to provide a compliant program.  

What additional advice do you have for preparing to meet these enhanced new standards? 

With the standards already in effect, it's key for acquirers to update their policies and procedures. The first step is to compare the acquirer business against the new controls to understand the applicable archetypes; updates to underwriting and onboarding will impact all acquirers, with broad updates to a TPA program for those who sponsor TPAs. 

Internal audits against the VARS controls are a great way to prepare for future reviews. 

Whether you want to upgrade your POS offerings, find a payment gateway partner, bone up on fintech regs or PCI requirements, find an upcoming trade show, read about faster payments, or discover the latest innovations in merchant acquiring, The Green Sheet is the resource for you. Since 1983, we've helped empower and connect payments professionals, starting with the merchant level salespeople who bring tailored payment acceptance and digital commerce tools, along with a host of other business services to merchants across the globe. The Green Sheet Inc. is also a proud affiliate of Bankcard Life, a premier community that provides industry-leading training and resources for payment professionals.

Notice to readers: These are archived articles. Contact information, links and other details may be out of date. We regret any inconvenience.