In an era of increasing cyber threats and complex regulatory expectations, understanding the difference between mandatory and recommended controls is pivotal. Compliance with mandatory requirements is non-negotiable, but leveraging recommended controls can elevate a business’s risk management strategy. By integrating both sets of controls, merchants underscore their dedication to a safer transaction environment—ultimately benefiting their brand, their customers, and the broader payments ecosystem. In the future, the payments industry that adopt recommended measures will be better positioned to adapt to evolving threats and maintain trust across the digital commerce landscape. An integrated approach ensures businesses remain resilient in an evolving ecosystem.

Visa’s recent update to require an Acquirer to check the Terminated Merchant File (TMF) before onboarding a new merchant signals a significant change in the payments industry. The TMF contains merchants who have been flagged for violations or fraudulent activity in the past, serving as a safeguard against risky partnerships. By making this check mandatory, Visa aims to foster a more secure ecosystem, reduce financial fraud, and protect both the Acquirer and its broader network.

Visa’s retirement of the Global Acquiring Risk Standards (GARS) and introduction of the new Visa Acceptance Risk Standards (VARS) signals a significant shift in how acquiring banks, payment facilitators, and other stakeholders manage risk and ensure compliance. The overarching goal remains to protect the payments ecosystem from fraud and reputational harm, but VARS introduces a more dynamic framework that places a stronger emphasis on third-party oversight.

What is the new VARS Assessment of Merchant Credit Worthiness?

By combining Archetypes and Risk Domains, Visa Acceptance Risk Standards offer a more granular and proactive approach to safeguarding payment ecosystems. This new framework not only empowers acquirers to tackle emerging threats with precision, but also fosters greater trust and transparency among consumers, merchants, and the broader financial community. The result is a streamlined, future-ready standard that underpins resilience in a rapidly evolving payments landscape.

The payment industry’s rapid growth has ushered in new complexities, especially around risk management. In response to evolving threats, in October 2024, Visa retired its Global Acquirer Risk Standard (known as GARS) and replaced it with the Visa Acceptance Risk Standards (now known as VARS). While both sets of guidelines aim to maintain trust and security, the changes reflect how Visa is adapting to new market conditions, regulatory demands, and expanding digital transactions. This article explores why Visa implemented this transition, what the new standards entail, and how they will affect acquirers, merchants, and the broader payment ecosystem.