Visa's Integrity Risk Program: what actually decides how closely your processor watches an escort directory
The paperwork that never used to be there
A directory gets approved for card payments, runs for a year or two without incident, and then the processor calls asking for a written content moderation policy, a description of how advertisers are identity checked, and a monthly report of what got taken down. Nothing about the account changed. Chargebacks are low, volume is steady, nothing was ever flagged. The operator's first read is usually that the processor is being difficult, tightening the screws for no reason, or preparing to drop the account quietly.
That reading is almost always wrong, and the actual reason is worth knowing because it changes how you respond. The request is not the processor's opinion of your business. It is Visa's own compliance framework working its way down the chain, and it applies to a directory of escort and dating listings by name, in Visa's own rulebook, regardless of how clean the account has been.
The program is called the Visa Integrity Risk Program, VIRP for short. It replaced an older framework called the Global Brand Protection Program on May 1, 2023, and at the same time Visa renamed the merchant category it used to call High-Brand Risk to High-Integrity Risk. If anyone on your team, or at your processor, still uses the old terminology, that alone is a sign the account has not been reviewed against the current rule.
Understanding what VIRP actually asks for, and why it treats a dating or escort listings site differently from an ordinary online shop, is the difference between reading the next document request as an attack and reading it as a box you can simply check.
Two boxes, not one: escort listings and adult content are separate categories
VIRP sorts merchants Visa considers higher risk into three tiers. Tier 1 is reserved for business types where the concern is harm to a person's health, safety, or wellbeing rather than ordinary financial risk, and it names its categories by merchant category code: adult content under MCC 5967, gambling under MCC 7995, pharmacies under MCC 5122 and 5912, and, separately, dating and escort services under MCC 7273.
The detail that catches most operators off guard is that adult content and escort or dating services are not the same box under this rule. They sit under different codes, and an acquirer needs its own approval for each Tier 1 category it wants to process, not one blanket clearance for anything Visa considers adult in nature. A processor cleared to handle escort and dating listings is not automatically cleared to handle explicit adult content, and the reverse is equally true.
This matters directly for a classifieds directory, because many of them sit closer to the line than the operator assumes. A site that is purely text listings and headshots is a clean fit for MCC 7273. A site where advertiser photos run toward explicit, or where a companion service beyond listings is sold, starts to look like it also needs the adult content code, and processing it under only the escort and dating code is exactly the kind of mismatch this rule exists to catch.
The category a merchant is coded under is not paperwork trivia. Compliance monitors that work with card networks have publicly described flagging merchants for using the wrong code, or none at all, as a rule violation in its own right, independent of whether the underlying business was doing anything illegal. Getting the code right, and keeping it right as the site's content changes, is worth an actual conversation with your processor rather than a box ticked once at onboarding and never revisited.
None of this is unique to escort and dating listings, and it is worth saying so plainly. The same Tier 1 sits gambling operators and online pharmacies selling prescription drugs alongside adult content and escort or dating services, each under its own code, each carrying the same separate-approval requirement. A directory sits in that bucket for the same structural reason every category in it does: not because Visa has singled the industry out, but because the tier exists for any business where a card network wants a documented, ongoing answer for what is actually being sold, to whom, and under what controls.
The public record on this has also moved recently, not just in principle. Reporting from a compliance monitoring firm that works directly with card networks described an update to Visa's guidance on adult, dating, and escort merchants at the start of 2026, tightening exactly the expectation described here: correct use of MCC 5967 for adult content and MCC 7273 for escort, dating, and matchmaking services, with merchants using the wrong code, or none, reported as a standing violation. If your account was set up before that update, or before any update, it is worth checking rather than assuming the original classification still fits.
Two different exams, and passing one says nothing about the other
The second thing worth understanding is that VIRP is not the only card network program an escort directory's account sits inside, and the two do not measure the same thing. Visa also runs a separate program, aimed at fraud and dispute performance, that tracks chargeback and fraud ratios against monthly thresholds. Call that the dispute-ratio side of the relationship: clean statements, low chargebacks, an account that looks boring in the best way.
VIRP asks a completely different question: is this business legal, correctly categorized, and properly controlled, independent of how its dispute numbers look. A directory can carry a spotless chargeback record for years, the kind of account a processor would ordinarily leave alone, and still get flagged under VIRP because the merchant category code is wrong, or because Visa cannot see evidence of the moderation and verification controls a Tier 1 escort or dating merchant is expected to run.
The reverse also holds. A site that has done the VIRP paperwork properly, correct code, documented moderation, a working complaint process, is not thereby protected from a dispute-ratio problem if its actual chargeback rate climbs. These are two separate exams graded on different criteria, and an operator who only tracks one of them, usually the dispute rate, because it is the number that shows up on a monthly statement, is flying blind on the other.
That is the real reason the document request lands the way it does. A processor watching only the numbers on a statement has no way to answer a Visa audit about moderation policy or identity checks. The paperwork it is now asking for is the evidence it needs to answer that separate, non-financial exam on your behalf, and on its own.
Why the request comes from your processor and not from Visa directly
Visa's rulebook places the formal registration and compliance obligation on the acquiring bank and its payment facilitators, not on the individual merchant. In practice this means Visa's own enforcement action, if there is ever a finding, lands on your processor first. That does not make it your processor's problem alone. Card acquiring agreements are written so that obligations imposed on the acquirer by the card networks pass down to the merchant contractually, which is exactly why the request for documentation shows up in your inbox rather than staying inside your processor's compliance department.
Seen from the processor's side, an escort or dating classifieds merchant that resists providing a moderation policy or verification process looks identical to a merchant that does not have one. Since the consequence of a finding against the account eventually reaches the processor's own standing with Visa, the safer move for them is always to over-collect documentation rather than under-collect it, and to do it on a schedule rather than once. That is not the processor being adversarial. It is the shape the incentive takes once you see where the obligation actually starts.
One thing worth resisting, because it tends to backfire badly: softening how the business is described to Visa or to the processor in the hope of landing in a lower-scrutiny bucket. A dating and escort listings business coded as something vaguer to avoid the Tier 1 conversation is not avoiding scrutiny, it is creating the exact mismatch between declared category and actual activity that compliance monitoring is built to catch, and it reads worse than simply being correctly coded as high-integrity-risk in the first place.
This is also why the underwriting conversation you had when the account first opened was never really the finish line for a Tier 1 merchant. VIRP's registration is not a one-time clearance; it is a category your processor has to keep defending on your behalf for as long as the account is open, which is the actual reason the questions keep coming back.
What to actually put on file
Start by confirming, in writing, exactly which Tier 1 category your processor has you registered under, and whether it matches everything the site actually does today, not what it did when the account was opened. If listings have drifted toward more explicit content, or the site now sells anything beyond advertising space, that conversation is overdue, not optional.
Keep a written content moderation policy that describes who reviews a listing before it goes live, what gets rejected, and how fast a complaint gets acted on. This does not need to be elaborate, but it needs to exist as a document your processor can actually hand over, not as a set of habits that live only in one moderator's head. If you are still deciding how that review function should be staffed, the cost comparison between doing it in house and outsourcing it is worth reading before you commit to either.
Keep records of the identity checks run on advertisers, separate from any age verification run on visitors: they answer different questions, and Visa's framework expects evidence for both. A timestamped log of what check ran, on whom, and what the result was, is worth more than a policy document that merely says checks happen.
Do not wait for an audit to assemble any of this. The operators who struggle are the ones who have the right practices in their heads but nothing written down when the request lands, and end up scrambling to reconstruct a policy under a deadline instead of handing over one that already existed. Building the file before it is asked for is the entire difference between this being routine and this being a crisis.
Finally, treat the correct merchant category code as a business decision worth revisiting, not a form filled in once. A site's content and offerings shift over time in ways that can quietly move it from one Tier 1 category into needing a second one, and catching that drift yourself, before your processor or Visa does, is the cheapest version of this problem you will ever get to solve.
The same file matters again the day you shop for a new processor, not only with the one you already have. Moving your account does not reset the classification: any acquirer that takes on an escort and dating directory has to register it under the same Tier 1 category and answer for it the same way. A documented moderation policy and a clean verification log make that conversation shorter and the account easier to place, while an operator who cannot answer the classification question on the spot reads, to a new processor, exactly like the risk this whole framework exists to catch.
