Merchants usually hear both terms in the same termination call, and most treat them as one thing. They are not. A BRAM violation is the offense. A MATCH listing is the record that follows you afterward. Confusing the two means negotiating with the wrong party about the wrong problem, and losing five years to it.
BRAM punishes your acquirer, not you
BRAM is Mastercard’s Business Risk Assessment and Mitigation program, the network’s enforcement regime for illegal and brand damaging activity: unlawful pharma, counterfeit goods, miscoded gambling, banned adult content, transaction laundering. Visa runs the equivalent Visa Integrity Risk Program, which replaced the Global Brand Protection Program in 2021.
Here is the part merchants miss: a BRAM fine is not addressed to you. Mastercard fines the acquiring bank that let the activity onto the network, and those assessments can reach six figures per transaction. Your acquirer then does two things in quick succession: passes the fine down to you under the indemnity clause you signed, and terminates the account to stop the bleeding. You never deal with Mastercard directly. Your entire BRAM problem runs through the acquirer’s contract with you.
That is also why acquirers act so fast on suspected violations. Mastercard mitigates fines for acquirers who catch problems through their own monitoring programs, so a merchant reported by the acquirer is cheaper than a merchant Mastercard finds first.
MATCH is the record that outlives the account
MATCH, the Member Alert to Control High-risk Merchants database, is not a punishment program. It is a registry of terminated merchants that every acquirer queries during underwriting. When an acquirer terminates you for cause, it must add you within one business day, under one of 14 reason codes, and the entry stays for five years before Mastercard purges it automatically.
The listing covers the business and its principals. Change the company name and the owner’s details still match. And the reason code matters more than the listing itself: code 04 for excessive chargebacks reads as a fixable operations problem to the next underwriter, while code 13 for illegal transactions reads as a reason to decline on sight. If nobody told you which code you carry, here is how to find out.
A BRAM violation ends one account. The MATCH entry it triggers decides the next five years of applications.
One creates the other, and the order tells you what to fight
The chain runs one direction. Mastercard or the acquirer detects prohibited activity, the acquirer eats or passes on the fine, the account dies, and the termination generates a MATCH entry, typically under code 10 (violation of standards) or code 13. The BRAM event is over in weeks. The MATCH consequence is the durable damage.
That order dictates strategy. The fine is a contract dispute with your acquirer, and it is usually settled or absorbed quickly. The MATCH entry is the thing worth fighting, and only the acquirer that listed you can amend or remove it. Removal succeeds in narrow cases, mainly listings made in error or corrected PCI lapses under code 12; we cover the realistic paths in how merchants actually get off MATCH.
Before you reapply anywhere
If your termination letter mentions BRAM, assume a MATCH entry followed it. Do not apply anywhere until you know your reason code. A declined application creates its own paper trail.
| BRAM violation | MATCH listing | |
|---|---|---|
| What it is | An enforcement action under Mastercard’s brand protection program | An entry in the terminated merchant database |
| Who it hits | The acquirer, who passes it to you by contract | You and your principals, by name |
| Trigger | Illegal or brand damaging activity on the network | Termination for cause under any of 14 reason codes |
| The damage | Fines and immediate termination | Five years of near automatic underwriting declines |
| The way out | Stop the activity, settle with the acquirer | Aging off, or removal by the listing acquirer in narrow cases |
Source: LegitScript, BRAM and VIRP overview and Stripe, MATCH documentation.
The practical takeaway: BRAM is about what you sell, MATCH is about what your file says. You prevent the first with honest coding and content controls before the network looks. Once the second exists, the only leverage you have left is knowing your code and picking underwriters who will read past it.
- LegitScript, “Mastercard and Visa Rules (BRAM and VIRP),” legitscript.com/bram-virp.
- Stripe, “High risk merchant lists (MATCH),” docs.stripe.com/disputes/match.
- Ballerine, “Mastercard BRAM: Business Risk Assessment and Mitigation,” ballerine.com glossary.
