Card processing
High-risk credit card processing for merchants others decline
Boldrails is a licensed principal payment provider that acquires and settles card payments for high-risk merchants: iGaming, forex, crypto and other verticals most acquirers decline. Card acceptance is available at onboarding, with EUR settlement first. We hold the necessary licences required in the markets we serve, and onboarding takes 3 to 14 days, depending on your case.
- 18 providers' acceptance policies compared
- Visa's high-integrity-risk MCC list, in full
- EUR settlement first
Onboarding in 3 to 14 days, depending on your case.
Last updated: 2 August 2026
The basics
What is high-risk credit card processing?
High-risk credit card processing is card acquiring for merchants classified as high risk under card-scheme merchant category rules and acquirer underwriting. The payment flow is identical to standard processing. What changes is underwriting, pricing, and the reserve an acquirer holds against future chargebacks.
Here is what most merchants never get told. "High risk" is not a bank's opinion of your business. It is a classification the card schemes encode in your merchant category code, and your acquirer applies it. Visa publishes the codes it treats as high integrity risk in card-absent environments in its Merchant Data Standards Manual, April 2026, which also places the job of assigning that code on the acquirer rather than on you.
Boldrails acquires and settles card payments for businesses in those categories, through our own payment gateway. We underwrite the business rather than reading the category and declining.
The information gap
Which MCC codes are high risk?
Visa classifies specific merchant category codes as high integrity risk when the transaction is card-absent. Every vertical on that list is one a majority of the 18 largest published payment providers either prohibit outright or gate behind prior approval, from adult content at 100% to crypto at 78%.
Most operators look up the MCC code list only after an account has already closed. A chargeback lands, a portfolio review matches the code to a prohibited-business policy, and the payouts stop. The code was assigned at onboarding, and the policy that acted on it was published the whole time.
The first column is Visa's own published rule. The second is based on 18 published acceptable-use policies reviewed on 17 July 2026, 16 of them read first-hand from the provider's own site, and kept in our acceptance index.
| Vertical | Visa high-integrity-risk MCC (card-absent) | Of 18 published providers |
|---|---|---|
| iGaming and betting | 7995 | 14 prohibit, 3 restrict, 1 allows. 94% closed or gated |
| Adult | 5967 | 16 prohibit, 2 restrict, 0 allow. 100% closed or gated |
| CBD and vape | 5993 | 10 prohibit, 6 restrict. 89% closed or gated |
| Crypto | 6051 or 6012, plus Special Condition Indicator 7 | 7 prohibit, 7 restrict, 1 allows. 78% closed or gated |
| Forex and CFD | 6211, High Integrity Risk Financial Trading Platforms | 10 prohibit, 1 restricts, 7 do not publish. 61% closed or gated |
| Nutra and supplements | 5122, 5912 | 7 prohibit, 3 restrict, 8 do not publish. 56% closed or gated |
| Dating | 7273 | not covered by our dataset |
| Subscription, negative option billing | 5968 | not covered by our dataset |
| Skilled game wagering | 5816 | not covered by our dataset |
The last three rows are not in our dataset. We track seven verticals across those 18 providers, and dating, subscription billing and skilled game wagering are not among them. The seventh we track, marketplace, has no row here because Visa does not put it on the high-integrity-risk list.
Three of Visa's rules are worth knowing before you pick a processor, all from the Merchant Data Standards Manual, April 2026, read 2 August 2026. An online gambling merchant must use MCC 7995 for all transactions, even where gambling is not the primary business. Crypto purchases must carry Special Condition Indicator 7 and the quasi-cash indicator. And the acquirer assigns the code, so a full MCC code list is a description of your options, not a menu you choose from.
Source: Visa Merchant Data Standards Manual, April 2026, read 2 August 2026
How we work
How Boldrails handles card acceptance
Card acceptance is available at onboarding, with EUR settlement first. Further currencies are confirmed for your account during onboarding.
| Boldrails | |
|---|---|
| Model | Licensed principal provider, we acquire and settle directly |
| Underwriting | Per business, not per category |
| Card brands | Visa and Mastercard, confirmed at onboarding |
| Settlement currency | EUR first, further currencies at onboarding |
| Onboarding | 3 to 14 days, depending on your case |
| Fraud screening | At authorisation, before a transaction becomes a dispute |
| Billing descriptor | Set with you, not defaulted |
| Card data | Processed under PCI DSS controls |
| Pricing | Quoted at onboarding, based on vertical and volume |
We hold the necessary licences required in the markets we serve, we underwrite your business ourselves, and we settle to you. You are not passed down a chain of banks to see who says yes.
That matters more here than in most categories, because card acquiring is a regulated payment service in its own right. PSD2 names it in the EU, and the Payment Services Regulations 2017 name it in the UK. It is why acquirers underwrite the way they do.
Two details the rest of the category rarely mentions. Your billing descriptor, the text a cardholder sees on a statement, is the cheapest chargeback control there is, and a vague one generates disputes on legitimate sales. And fraud screening belongs at authorisation, because a declined transaction costs you nothing while a dispute costs you the goods, the fee and the ratio.
Been declined or offboarded on your category alone? That is the case we underwrite rather than auto-decline.
Pricing
What does high-risk card processing cost?
High-risk card processing runs 2.5% to 5% per transaction against 1.5% to 2% for standard processing, with setup fees of £100 to £500 where a provider publishes them at all. Most of this category publishes nothing.
| Cost line | Standard processing | High-risk processing | Boldrails |
|---|---|---|---|
| Processing rate | 1.5% to 2% per transaction | 2.5% to 5% per transaction | Quoted at onboarding |
| Setup fee | Commonly none | £100 to £500 one-time, where published | Not published |
| Rolling reserve | Typically none | Published ranges disagree: 5% to 10%, 5% to 15%, 10% to 20% of each batch | Not published |
| Reserve hold period | Not applicable | 90 to 180 days | Not published |
| Approval time | 24 to 48 hours | Up to 2 weeks | 3 to 14 days, depending on your case |
Ranges are published figures read on 2 August 2026.
Those ranges come from Decta's published pricing page and TechnologyAdvice's provider comparison, both read on 2 August 2026, cross-checked against the figures Google's AI Overview cites on this query. Three of the five sources we researched publish no rate whatsoever, and the two that do are one acquirer and one comparison site. That is why this is market data rather than a price list, and it is also why we publish it. Our own rate depends on your vertical and volume, so we quote it rather than print it.
Underneath all of it sits interchange. EU consumer interchange is capped at 0.2% on debit and 0.3% on credit, under Articles 3 and 4 of Regulation (EU) 2015/751, the Interchange Fee Regulation. Everything above that line is scheme fees, acquirer margin and risk pricing. Risk pricing is the part that moves when your MCC changes.
On instant approval: nobody in the researched set delivers it. Published approval times run from 24 hours to six business days, and up to two weeks at the high-risk end. Anything advertised as instant is a pre-approval, because the KYB checks still have to happen.
Compliance
How do 3D Secure and SCA apply to high-risk merchants?
If you take cards from cardholders in the EEA or the UK, strong customer authentication applies to your remote payments. If every cardholder you have is in the United States, the EEA and UK SCA rules do not reach you, though your own market's fraud and authentication obligations still do. Check where your cardholders are before you change anything at checkout.
The terms get conflated constantly, so worth separating: PSD2 is the directive, strong customer authentication is the obligation it creates, and 3D Secure 2 is one technical means of meeting that obligation. They are not three names for the same thing.
The regulatory technical standards applied from 14 September 2019 and require two elements out of knowledge, possession and inherence, under Article 4 of Commission Delegated Regulation (EU) 2018/389. In the UK the obligation sits in regulation 100 of the Payment Services Regulations 2017, which the FCA applies.
For a high-risk merchant the commercial point is sharper than compliance. Authenticating a transaction shifts fraud chargeback liability away from you, and you carry more chargebacks than a low-risk merchant does. The transaction risk analysis exemption is tiered too: the Annex to Regulation 2018/389 sets thresholds of EUR 500, EUR 250 and EUR 100 against reference fraud rates of 0.01%, 0.06% and 0.13%. A lower fraud rate buys a higher exemption threshold, so your fraud performance sets how much friction your checkout carries.
Note that Visa's high-integrity-risk list is scoped to card-absent transactions. Remote payments are where the fraud and the rules both concentrate.
Primary sources
Risk terms
Rolling reserves and chargeback thresholds
A rolling reserve is a percentage of each settlement batch that your acquirer holds back against chargebacks that have not happened yet. It is released on a schedule.
Published ranges disagree, and that disagreement is the useful part:
- 5% to 10% of each batch, per one published acquirer
- 5% to 15%, per one AI Overview citing its own sources
- 10% to 20%, per another
- Hold period of 90 to 180 days, which every published source agrees on
Anyone quoting you a single industry-standard reserve percentage is quoting one source and calling it the market.
On thresholds, check the date on whatever you are reading. Visa consolidated its separate dispute and fraud monitoring programmes into the Visa Acquirer Monitoring Program, effective 1 April 2025, with an advisory period running to 30 September 2025, as Visa set out in its own announcement and the Merchant Risk Council covered in its member assessment. Merchant dispute-ratio figures still quoted across this category predate that consolidation and describe programmes that no longer operate. Visa publishes no threshold number on that page, so we print none. Thresholds are set at acquirer level and revised on a published schedule, which means the number that binds you is the one in your own contract.
Mastercard's MATCH list works differently again. It records terminated merchants and follows you from one acquirer to the next, which is why an acquirer that underwrites rather than auto-declines is worth the search. Your reserve terms are set at underwriting, alongside your high-risk merchant account.
Source: Visa, Introducing the Visa Acquirer Monitoring Program
Which do you need
Card processing or a high-risk merchant account?
These get used as synonyms and they are not the same thing. Card processing is the acquiring and authorisation of the transaction, meaning the part that decides whether a payment goes through. A high-risk merchant account is where the settled funds land afterwards.
Most merchants need both, which is why we publish them as two pages rather than competing with ourselves for your attention. If checkout is what keeps declining, start here. If the problem is that nobody will hold the money once it settles, the account page will serve you better than this one.
On working with non-US companies, a question that comes up constantly: we onboard businesses incorporated outside the United States, and the corridor matters more to underwriting than the country of incorporation does.
FAQ
High-risk card processing questions
Last updated: 2 August 2026