Visa shook up the payments landscape earlier this year with its Integrity Risk Program (VIRP) rollout, replacing the older Global Brand Protection Program. While VIRP might sound like just another update, it is a significant shift, bringing Visa more in line with Mastercard’s existing program – and introducing some fundamental changes that high-risk merchants need to know.

What is the Big Deal?

• Age verification is now mandatory: VIRP is cracking down on merchants who fail to verify the age of their customers properly. This is no longer optional if your business falls into a high-risk category.
• Registration fees have soared: Get ready to pay more for compliance. Visa’s registration fees have jumped from $500 to a hefty $950 per year.
• Transaction fees are here to stay: Visa is not just targeting registration fees. They’ve also introduced new transaction fees, adding 10 basis points plus $0.10 per transaction in the U.S. and 10 basis points plus $0.02 in Europe.

Why the Sudden Changes?

We went straight to the source to find out and, in order to share this directly with our merchants, we hosted a VIRP-info webinar to give our comprehensive analysis of VIRP. In this analysis, we shared how Visa told us they wanted to invest in a larger team to provide more oversight and engagement, especially for small businesses in high-risk sectors.

VIRP Deep Dive: Consumer Age Verification and Content Moderation

Visa is not pulling punches with its Integrity Risk Program (VIRP). Two areas where they are demanding serious attention from high-risk merchants are consumer age verification and content moderation. Let’s break down what this means for your business:

1. Consumer Age Verification: A New Level of Scrutiny

Visa is the first card brand to get granular about age verification. They want to know precisely how you comply with the laws in your jurisdiction. This is not just a suggestion; it’s a requirement. You will need a detailed policy outlining the following:

• Your verification process: How do you confirm a customer’s age? Are you using third-party tools? (If so, list them!)
• Regional compliance: How are you addressing age verification laws that vary by state or country?

Some Strategies to Consider

• Blocking access: Restrict access to certain content or regions based on age.
• “Safe for work” previews: Offer a preview of your content before requiring age verification and purchase.
• Age verification gates: Age verification is required before users can access content.

2. Content Moderation: The Rules Have Changed

While Mastercard’s 2020 regulations focused heavily on user-generated content (UGC), Visa’s VIRP casts a more comprehensive network. Even studio-produced content is under scrutiny now.

Here’s What You Need:

• Adequate content controls: You must have systems to monitor and block inappropriate content.
• Detailed UGC policy: If you allow UGC, you need a clear policy on how it is moderated (ideally, before it is posted).
• Third-party tools: You can not rely on human moderation alone. Use tools to help you catch non-compliant content.
• CAM site rules: You will need tools to verify users’ ages and detect inappropriate activity for live stream content.
• Internal policies for subscription sites: Even if you produce your content, you need internal guidelines about prohibited content, review processes, and model verification. Consider an on-set code of conduct for best practices.

Don’t Get Caught Off Guard

The message from Visa is clear: high-risk merchants must up their game regarding age verification and content moderation. VIRP is a wake-up call for anyone who’s been lax in these areas. Get your policies and procedures now to avoid penalties and protect your business.

---

VIRP Compliance for Merchants: Protecting Creators, Models, and Your Business

Visa’s Integrity Risk Program (VIRP) strongly emphasizes protecting vulnerable individuals online and offline. Let’s explore two critical policy areas that high-risk merchants must address to stay compliant:

1. Content Creator/Model Age Verification Policy

For sites that allow user-generated content (UGC), a robust age verification policy is non-negotiable. This policy should detail:

• Your verification process: Explain how you verify the age of content creators and models.
• Staffing and tools: Specify the number of review staff you have dedicated to this task and any third-party tools you utilize to streamline the process.
• Verification before posting: Make it clear that all creators/models must be verified before posting content or performing on your site.
• Third-party consent: If other individuals appear in the content, ensure the creator has obtained their consent and identification. Be prepared to provide this information if requested.
• Studio-produced content guidelines: For studio content, outline a clear code of conduct, best practices, and production rules. Be ready to provide a sample model release form and identification to demonstrate compliance.

2. Human Trafficking, Sex Trafficking, and Prostitution Policy

VIRP demands that merchants take a proactive stance against exploitation. Your policy should outline:

• Prevention measures: Detail the controls you have in place to prevent your platform from being used to promote or facilitate trafficking or abuse. This could include:
  • Rigorous age verification processes
  • Content monitoring and moderation
  • Reporting mechanisms for suspicious activity
• Participation in anti-trafficking organizations: To show commitment to combating exploitation, consider joining organizations like the ASACP (Association of Sites Advocating Child Protection) or the NCMEC (National Center for Missing & Exploited Children).

Why This Matters

Beyond compliance, these policies serve a higher purpose: safeguarding individuals and upholding ethical standards. By prioritizing age verification and taking a stand against exploitation, you protect your business and create a safer online environment for everyone.

---

VIRP Compliance for Merchants: Takedowns, Affiliate Marketing, and Policies

Visa’s Integrity Risk Program (VIRP) leaves no room for ambiguity. Merchants must have clear policies and procedures for takedown requests, affiliate marketing, and more. Here is what you need to know:

1. Takedown Request/Complaint Link

• Visible link: Every page of your website must feature a visible takedown request or complaint link in the footer.
• Clear policy: You must have a written policy stating that complaints will be addressed within seven days and illegal content removed immediately.
• Monthly reporting: Unlike Mastercard, Visa requires monthly reporting of all complaints/takedowns, even if there were none (NIL report).

2. Affiliate Marketing Policy

The core principle here is simple: know and trust your affiliates. Your policy should detail:

• Vetting process: Explain how you thoroughly vet affiliates before partnering with them.
• Creative guidelines: Specify the types of creatives (ads, banners, etc.) affiliates can use when promoting your site.
• KYC (Know Your Customer): Outline the information you collect from affiliates to ensure their legitimacy and compliance with your standards.

3. We’ve Updated Our Adult Content Checklist

To help you navigate VIRP compliance, we’ve updated our comprehensive Adult Content Checklist. This checklist, emailed on May 20, 2024, via HelloSign, walks you through each VIRP requirement.

Please upload your policies to the merchant portal so we can review them and address any questions. These policies are mandatory and demonstrate how you’re managing your business.

Reminder to Make These Changes 

1. Content Management Policy & Procedures
   • Content Creator Age Verification
   • Content Moderation Policy
   • Produced-Content Provider’s policy (prohibited content and age verification)
2. Consumer Age Verification
3. Complaint and Content Removal Policy & Procedures
4. Sample Copy of Written Agreement with Third Party Content Providers
5. Chargeback-Fraud Mitigation Policy

By adhering to these policies and procedures, you’ll be well on your way to complying with Visa’s Integrity Risk Program and ensuring the safety and security of your platform.

The information in this blog post is for general informational purposes only and should not be considered financial, legal, or professional advice. While the content is based on the author’s expertise and knowledge, it has not been reviewed by legal or financial professionals.

Any reliance you place on the information presented in this post is strictly at your own risk. The author and publisher of this blog will not be held liable for any errors or omissions in the content or for any losses, injuries, or damages arising from its display or use.

Always consult with a qualified professional before making any financial decisions or taking any action based on the information provided in this blog post.

By continuing to read this blog post, you acknowledge that you have read and understood this disclaimer.