Mastercard MATCH List Explained for iGaming Operators

Losing a merchant account is bad. Landing on the Mastercard MATCH list is worse, because it follows the business to every acquirer it applies to next, for five years, whether the original problem was fixed the same week or not.

For iGaming operators, this is not a rare edge case. Gambling is high-risk to begin with, chargeback pressure is constant, and a single termination filed under the wrong reason code can shut a company out of card acceptance across the market.

This guide covers what the MATCH list is, all 14 reason codes, how long a listing lasts, how a business gets off it, and where iGaming operators tend to trip up. Facts verified as of August 2026.

What is the Mastercard MATCH list?

The Mastercard MATCH list is a database of merchants whose card processing accounts were terminated for cause. Acquiring banks and payment facilitators add terminated merchants to it and check it before boarding new ones.

Term: MATCH. Definition: Member Alert to Control High-risk Merchants, a Mastercard-run database that records merchants terminated by an acquirer for a defined risk reason, used to screen new merchant applications.

The mechanics matter here. When an acquirer terminates a merchant for one of the listed reasons, Mastercard's Security Rules and Procedures require it to add that merchant to MATCH, usually within five business days. Every acquirer with merchant activity is also required to query MATCH during underwriting. So a listing isn't a note in one bank's file. It's a flag every other bank sees.

You can't check it yourself. There's no public lookup, and a merchant has no way to query its own status. Most operators only discover a listing when applications keep getting declined and an honest acquirer tells them why.

MATCH list vs Terminated Merchant File: what's the difference?

There is no difference. The Terminated Merchant File (TMF) is the older name for the same database, and the two terms are used interchangeably. Being "TMFd" and being MATCHed are the same event.

The industry kept the old name alive long after Mastercard rebranded it, which is why underwriters, brokers and lawyers still say TMF. If a payments contact warns you about the TMF, they mean MATCH. Don't waste time treating them as two separate risks.

What are the MATCH reason codes?

MATCH uses 14 reason codes to record why an acquirer terminated a merchant. Each listing carries one code, and the code shapes both how serious it looks and, in one case, whether it can be removed early.

• 01 - Account Data Compromise: cardholder data was exposed through the merchant's systems.
• 02 - Common Point of Purchase: the merchant was the shared source of card data later used in fraud elsewhere.
• 03 - Laundering: the merchant processed transactions for another business, or for an activity its account didn't cover.
• 04 - Excessive Chargebacks: chargebacks breached Mastercard's monthly monitoring thresholds.
• 05 - Excessive Fraud: fraudulent transactions ran well above Mastercard's fraud-to-sales limits.
• 06 - Reserved: not currently assigned.
• 07 - Fraud Conviction: an owner or principal was convicted of fraud.
• 08 - Questionable Merchant Audit Program: the merchant was judged questionable under a Mastercard audit.
• 09 - Bankruptcy, Liquidation or Insolvency: the merchant couldn't cover its obligations.
• 10 - Violation of Standards: a breach of card scheme rules.
• 11 - Merchant Collusion: the merchant took part in fraud with others.
• 12 - PCI DSS Non-compliance: failure to meet data security standards.
• 13 - Illegal Transactions: the merchant processed unlawful transactions.
• 14 - Identity Theft: the account was opened using a stolen identity.

Code 12 is the one worth remembering, because it's the only reason code with a built-in exit: fix the PCI DSS problem and the listing can come off. Every other code runs its full term unless it was filed in error. Our guide to PCI DSS for iGaming payments covers what compliance actually requires.

Why do iGaming operators end up on MATCH?

Three codes do most of the damage in gambling: excessive chargebacks (04), laundering (03) and illegal transactions (13). All three are easy to trigger in a high-risk vertical, and two of them can happen without any intent to break the rules.

Chargebacks are the obvious one. Gambling carries higher dispute rates than almost any other sector, and a run of friendly fraud or a fraud spike can push a merchant past scheme thresholds fast. Once the acquirer terminates for excessive chargebacks, the MATCH listing follows. Our guide to iGaming chargebacks and the piece on Visa's VAMP programme both cover how to keep the ratio down before it gets there.

The laundering code is the trap most operators don't see coming. "Laundering" here doesn't mean money laundering in the criminal sense. It means processing gambling transactions through an account that wasn't approved for gambling, or running one brand's volume through another's account. Miscoding gambling under a non-gambling MCC is exactly this, and it ends in a code 03 listing.

Illegal transactions (13) catch operators selling into markets where their licence doesn't cover them. From the scheme's point of view, an unlicensed transaction is an illegal one, regardless of how the operator sees it.

How long do you stay on the MATCH list?

Five years from the date the listing was added. Mastercard removes the record automatically at the end of that period, and the clock doesn't reset because you fixed the underlying issue.

This is the part operators struggle with. You can clean up chargebacks, pass every audit, and rebuild the business, and the listing still sits there for the full term. The retention period is tied to the date of the listing, not to whether the problem still exists.

There's one detail worth knowing: the record shows which acquirer added it and under which code. A newer acquirer looking at a five-year-old code 04 listing from a bank you've long since left will read it differently from a fresh code 13. The listing isn't the whole story, but you don't control how it's read.

How do you get off the MATCH list?

In most cases, you don't. There are only two routes to early removal, and both are narrow: the listing was filed in error, or it was a code 12 PCI listing and you've since restored compliance.

• Filed in error. If the acquirer added you by mistake, or the reason was factually wrong, you go back to that acquirer with evidence and ask it to remove the record. Only the acquirer that filed it can remove it. Mastercard won't do it for you.
• Code 12, now compliant. A PCI DSS non-compliance listing can be lifted once you've fixed the security gap and can prove it.

Outside those two, if the reason was accurate, there's no appeal and no buy-out. The businesses selling "MATCH removal" services can only help where one of these routes genuinely applies. Where the listing is correct, most operators wait it out, which is the honest answer even if it's not the one anyone wants to hear.

How does a MATCH listing affect a new merchant account?

It makes mainstream acquiring almost impossible and pushes the business toward specialist high-risk acquirers on worse terms. A MATCH hit during underwriting is a hard stop for most banks.

Some high-risk acquirers will still take a listed merchant, but they price the risk in: higher rates, a rolling reserve, tighter monitoring, and a requirement to show the original problem is resolved. That's a workable path for a legitimate operator that got caught by a chargeback spike, and a dead end for one that was terminated for fraud.

If you're rebuilding after a listing, provider selection is the whole game. The iGamingPayments.ai directory lists acquirers and PSPs by region and risk appetite, including the ones that genuinely underwrite high-risk gambling traffic rather than reselling a licence they'll pull at the first sign of trouble.

MATCH vs VMSS: does Visa have its own list?

Yes. Visa runs the Visa Merchant Screening Service (VMSS), its own version of a terminated-merchant database. MATCH is Mastercard's; VMSS is Visa's, and most acquirers screen against both.

The practical upshot is that you can't route around a listing by switching card brands. An acquirer that terminates you for cause can report to the relevant scheme database, and the next acquirer's underwriting checks both. Treat MATCH and VMSS as one combined barrier, because from where you're standing, that's how they behave.

How do iGaming operators avoid MATCH?

The short version: keep chargebacks under control, code transactions correctly, and only process where you're licensed. Every common MATCH reason for a gambling business traces back to one of those three.

• Manage chargebacks before they breach thresholds. Clear billing descriptors, working dispute-response tools, and issuer-level tracking keep the ratio down. This is the single biggest risk.
• Never miscode gambling. Running gambling volume through a non-gambling account is the laundering code waiting to happen.
• Only sell where your licence covers you. Unlicensed volume reads as illegal transactions to the scheme.
• Keep PCI DSS current. It's the one code you can recover from quickly, but avoiding it entirely is cheaper.
• Spread volume across more than one acquirer. A single termination shouldn't be able to end your card acceptance overnight.

Most of this is covered in more depth across the site. The high-risk merchant account guide explains how acquirers assess gambling businesses, and the payments glossary defines the surrounding terms.

Frequently asked questions

How do I know if I am on the MATCH list?

There's no public lookup and no way for a merchant to query MATCH directly. Only acquirers and payment facilitators can search it. Most businesses find out because merchant account applications keep getting declined during underwriting, or an acquirer tells them a MATCH hit is the reason.

How long does a MATCH listing last?

Five years from the date it was added. Mastercard removes the record automatically after that. There's no general early-removal process unless the listing was filed in error or was reason code 12 for PCI DSS non-compliance that has since been fixed.

Can I get a merchant account while on the MATCH list?

It's very hard through mainstream acquirers, because their rules require them to review a MATCH hit before boarding. Some high-risk acquirers will still underwrite a listed business case by case, usually with higher fees, a rolling reserve, and evidence that the original problem is fixed.

Is the MATCH list the same as the TMF?

Yes. Terminated Merchant File, or TMF, is the older name for the same Mastercard database. The industry still uses both terms interchangeably, and being TMFd means being added to MATCH.

Does the MATCH list affect Visa transactions too?

MATCH is Mastercard's database, but acquirers use it to screen merchants across their whole portfolio, so a listing affects your ability to accept every card brand. Visa runs its own screening tool, the Visa Merchant Screening Service (VMSS), and most acquirers check both.

Can a business dispute a MATCH listing?

Only the acquirer that added the record can remove or amend it, and only where the listing was inaccurate or the reason code no longer applies. There's no appeal to Mastercard itself. If the underlying reason was correct, the record runs its full five years.

Find the right payment provider for your operation

Browse 342+ vetted PSPs, crypto processors, open banking providers and fraud vendors - filtered by region, vertical and payment method. Or run the numbers before your next PSP negotiation.