You know now about the Visa Integrity Risk Program (VIRP), which was announced and rolled out in the spring of 2023. The program is designed to strengthen the integrity and security of the Visa payment system and ensure that acquirers and their designated agents, payment facilitators, independent sales organizations (ISO), and wallets maintain proper controls and oversight to prevent illegal transactions from entering the Visa payment system. Over a year later, Visa added new fees and conducted regular audits. With all of us having a magnifying glass focused on our business practices, how can we best prepare? Here, we share some tips to get your business ready.
VIRP Expansion, Reinforcement & Fees
Visa has expanded high-risk verticals to adult sites, dating sites, negative option subscription sites, gaming sites, cyberlockers, and financial trading platforms. VIRP also now includes expanded and new fees, including the registration fee, which increased from $500 to $950. An additional Visa Integrity Risk Fee was introduced, increasing processing fees in the U.S. by ten basis points and ten cents per transaction. In the EU/UK, ten basis points and two cents per transaction. VIPR also reinforced the rules associated with the following:
- User-generated content: Focusing on content moderation, age verification, and consent of all parties in the images.
- Live stream programs: Must have age verification of models and show they have control of the platform.
- Content compliance: You must keep CSAM, bestiality, incest, and nonconsensual content off the internet.
- Takedown requests: Merchants must have the ability for users to report non-compliant content models and to ask for the content in which they are depicted to be removed. Merchants must also provide monthly reports to their service providers.
- Marketing: Merchants cannot market based on non-compliant search terms or affiliate marketing promotions.
- Human trafficking: The merchant must have adequate policies in place that prohibit the use of its website in any way that promotes or facilitates human trafficking, sex trafficking, or abuse. Having an active membership and participation in an anti-trafficking organization is highly recommended.
- Age verification of consumers: The merchant must comply with any applicable law requiring viewers of its website to be a certain age and ensure that age verification of the content’s viewer takes place before providing access to its site’s content.
Visa’s VIRP Crackdown: Why Increased Fees and Stricter Enforcement Are Shaking Up High-Risk Merchants
The rules and pricing changes have been written about extensively, but we are now seeing how this program is moving into enforcement by Visa. Likely, you’re already feeling it. So why the changes? Visa stated that the increase in the fee was to help build a team that would provide more oversight to high-risk verticals offering Visa products. Visa provides oversight through our acquiring partners. Many acquirers are going through Visa audits, with Visa digging into their high-risk portfolios and looking at how adult merchants are managing to the VIRP standards. We had one EU bank go through a Visa audit, and unfortunately, they did not perform well. They ended up re-underwriting their entire portfolio. This led to many account terminations for merchants not meeting the new standards. We are getting word from our U.S. acquiring partners about similar audits and to be on standby for reviews of our existing merchants.
From Panic to Preparedness: How to Successfully Navigate Visa’s VIRP Audits and Fee Increases
When an audit rolls around, there is very little time given to anyone to respond. This is why you should always be ready. We created this cheat sheet that looks at each policy, who it applies to, and what you need to do to be prepared.
Content Moderation Policies: A comprehensive content moderation policy is mandatory if your platform facilitates User-Generated Content (UGC), encompassing Content Aggregation and Monetization (CAM) sites and fan sites. This policy should detail the technological solutions employed to identify non-compliant content, the number of human moderators assigned to review escalated content, and the training protocols for those moderators. Sharing your training documentation can further demonstrate your commitment to maintaining a compliant environment. Ensuring all UGC is reviewed and approved before publication is crucial.
For CAM programs, it’s imperative to delineate the technology used to manage live streams, including mechanisms to detect and immediately remove unverified users. Your program should also have robust safeguards to prevent non-compliance, such as unauthorized offline interactions between models and customers.
Whether utilizing third-party producers or generating their own content, subscription-based platforms must have internal policies outlining prohibited content categories, pre-posting review processes, and stringent age/ID verification procedures for models.
Age Verification Policies: For sites allowing user-generated content, you must provide a detailed overview of your age verification process and third-party tools used to verify content creators. For studio-produced content, you could likely be asked for a policy, a code of conduct, best practices, and rules for the production. Also, be ready to provide a sample model release agreement.
Human Trafficking Policy: To demonstrate compliance with Visa’s Human Trafficking Policy, establish and document robust procedures for screening and verifying all individuals involved in your platform, including age and identity checks. Implement regular training on identifying and reporting suspicious activity and maintain clear policies for handling potential trafficking reports. Show your commitment to combating human trafficking by actively participating in recognized and trusted organizations like ASACP (Association of Sites Advocating Child Protection) or NCMEC (National Center for Missing & Exploited Children).
Affiliate Marketing Policy: It’s essential to have a detailed affiliate marketing policy outlining how you vet affiliates, including what type of creative they can use to promote your site and the data you collect on each affiliate. Like merchants, go through the Know Your Customer (KYC) process to set up a payment service provider. KYC should also be done on the affiliates you bring on board.
Consumer Age Verification: This has been off the radar for card brands, but Visa wants to understand how merchants comply with jurisdictional age verification requirements. It’s important to have a detailed policy in place and show how you address the countries and states, such as Texas, Louisiana, Utah, etc., requiring age verification before accessing adult content.
Takedown or Complaint Process: Every website should have a takedown or complaint process link visible and accessible for consumers or models to identify any content that might not be compliant or allow a model to request their content be removed. Each merchant must have a policy outlining how a complaint is handled and that it is addressed within seven days. If content is identified as illegal, it must be removed immediately. Each month, the merchant must report the takedown request or complaints received and the disposition of that request to their provider. Even if you have no complaints, a report should be filed stating no complaints. Check with your payment service provider on how to report. For example, at Segpay, our merchant portal offers a specified format and a way for our merchants to upload monthly. Routinely, acquirers have asked for a sample of a merchant’s monthly takedown request report.
Updated KYC: If requested to answer an audit, you might be asked to provide updated KYC documentation. If your directors or UBOs have changed, let your payment service provider or acquirer know. Other items that could be requested are lease agreements confirming that you are meeting merchant location requirements, updated ID documents for Directors and UBOs, a recent utility bill for Directors and UBOs, and a recent bank statement.
While an audit or review of your program can always sound a little scary, being prepared and being able to answer audit questions in a timely manner helps show your payment provider and Visa that you are on top of it. Stay in the driver’s seat and be prepared in case the spotlight shines on your business practices.
Have additional questions? Don’t hesitate to reach out to us at [email protected].
