Your processor has terminated your account. Or a new provider has declined your application and mentioned the TMF, or the MATCH list. Either way, you need answers.
Being listed is serious, but it is not the end of your business. The terms TMF and MATCH are used interchangeably, which adds to the confusion. This guide explains what the two names mean, how Visa’s equivalent works, how long a listing lasts, and how removal really works.
Key takeaways
- MATCH and TMF are the same list. TMF, the Terminated Merchant File, is the older name for what Mastercard now runs as MATCH.
- Listings are filed by the acquiring bank, last five years, and follow both the business and its principal owners.
- Visa runs a separate database, the Visa Merchant Screening Service (VMSS). A merchant can be on one, both or neither.
- Early removal is rare and limited mainly to listings filed in error or cured PCI DSS non-compliance. Only the acquirer that listed you can request it.
- No third party can remove a valid listing for a fee. Be wary of anyone who promises to.
MATCH vs TMF: are they the same thing?
Yes. TMF, the Terminated Merchant File, is the older name. MATCH, which stands for Member Alert to Control High-risk Merchants, is the current Mastercard system. Whether someone says “TMF list” or “MATCH list”, they mean the same database.
Mastercard moved away from the TMF name years ago, but many people in payments still use it out of habit, so “TMF” still turns up in emails, contracts and termination letters. There is no separate TMF database running alongside MATCH. A “TMF check” today is a MATCH inquiry run by an acquirer, and if a provider tells you that you are “on TMF”, they mean a MATCH listing exists. The current version of the platform is called MATCH Pro.
For the basics of how MATCH works, read our guide to the MATCH list.
Visa’s equivalent: VMSS (formerly VMAS)
Visa runs its own terminated merchant database, separate from MATCH. It has been known as VMAS, the Visa Merchant Alert Service, and Visa now operates it as the Visa Merchant Screening Service (VMSS). As with TMF and MATCH, both names are still in use.
- Visa acquirers must list terminated merchants and agents in VMSS and must check it before signing a new merchant.
- Visa says acquirers cannot refuse to sign a merchant based solely on VMSS information, but in practice a listing still makes underwriting harder.
- Being on MATCH doesn’t automatically mean being on VMSS, and the other way round. It depends on which networks and acquirers were involved.
Who files a listing, and what it records
Mastercard maintains MATCH, but it does not add merchants itself. The acquiring bank that terminated the account files the listing. Only acquirers and registered service providers can query MATCH, so you cannot log in and check your own status.
A listing records far more than a business name: legal and trading names, website addresses, business addresses, tax IDs, and details of directors and principal owners. That is why changing a trading name rarely hides a listing.
The MATCH reason codes
Every listing carries a reason code that tells future acquirers why the merchant was terminated. Your exact code decides your removal options and how underwriters read your application.
- 01 Account data compromise. Cardholder account data was accessed or disclosed without authorisation.
- 02 Common point of purchase. Card data was stolen at your business and then used for fraud elsewhere.
- 03 Laundering. You processed transactions for another business, or submitted transactions with no genuine cardholder behind them.
- 04 Excessive chargebacks. Mastercard’s rules describe chargebacks above 1% of sales transactions in a month and totalling at least 5,000 USD.
- 05 Excessive fraud. Mastercard’s rules describe a fraud-to-sales ratio of 8% or more in a month, with at least 10 fraudulent transactions totalling at least 5,000 USD.
- 06 is not in use.
- 07 Fraud conviction. A principal owner or partner was convicted of criminal fraud.
- 08 Mastercard Questionable Merchant Audit Program. Mastercard identified the business under its audit programme.
- 09 Bankruptcy, liquidation or insolvency.
- 10 Violation of standards. For example, misrepresenting what you sell or using the wrong merchant category code.
- 11 Merchant collusion. Taking part in fraudulent activity with others.
- 12 PCI DSS non-compliance.
- 13 Illegal transactions.
- 14 Identity theft. The account was opened using stolen or false identity information.
The thresholds under codes 04 and 05 define when an acquirer may list a merchant; they are not an automatic trigger. PCI non-compliance under code 12 is curable. Excessive chargebacks under code 04 still leave room for specialist underwriting. Laundering, illegal transactions and fraud convictions make recovery very difficult.
How long does a listing last?
Five years. Records stay in MATCH for 60 months from the date of listing and are then removed automatically. The clock does not pause or reset, even if you only discover the listing years later. A merchant listed in June 2024, for example, would expect to drop off around June 2029, as long as no new listing is filed in the meantime.
Listings apply to both the business and its principal owners. Setting up a new company with the same directors, or reusing the same bank details, will usually be detected. Selling the business does not clear the listing either, because it stays tied to the principals named at the time.
How to get off the MATCH list
Early removal is possible, but only in narrow situations. The decision sits with the acquiring bank that filed the listing, not with Mastercard.
Valid grounds for removal
- The acquirer accepts that the listing was filed in error, such as the wrong merchant, wrong data or wrong reason code.
- You were listed for PCI DSS non-compliance under code 12 and have since become fully compliant, with the right compliance documentation.
How to request removal
- Confirm your exact reason code and listing date. They are usually in your termination letter, or you can ask the acquirer’s risk or compliance team in writing.
- Gather evidence for your specific code: proof of PCI compliance for code 12, proof that you were the victim for identity theft, a forensic report for a data compromise.
- Send a clear, dated written request to the acquirer that listed you, asking it to review the listing and submit a removal if appropriate.
- Keep copies of everything, and expect a response to take several weeks.
For most codes, especially genuine fraud or serious rule breaches, early removal is unlikely. The realistic plan for most merchants is to fix the underlying problems, rebuild a clean processing record, and work with specialist providers while the five years run out.
Beware of removal services
No third party can remove a valid MATCH listing if the acquirer that filed it refuses. Treat services promising guaranteed removal for an upfront fee with extreme caution, particularly if they won’t explain in writing how removal works under Mastercard’s rules. Outside help is useful when it is advisory, such as compliance consulting or advice from a lawyer who specialises in payments. It cannot be a shortcut off the list.
What a listing means for your business
- Mainstream processors and aggregators usually decline the application as soon as they see the listing.
- Underwriting with any provider takes longer, needs more documents, and comes with higher processing fees.
- A rolling reserve becomes standard and ties up working capital.
- Providers you already use may review their exposure if they learn about the listing.
Specialist high-risk acquirers look at context: your industry, your history before and after the termination, whether the problem is under control, and how strong your compliance is today. Our guide to getting approved after a MATCH listing covers what they look for.
How to avoid ending up on the list
- Keep your chargeback ratio well below card scheme thresholds. Refund early where appropriate, use a billing descriptor customers recognise, and handle disputes quickly.
- Use fraud screening and fraud prevention suited to high-risk sectors, including device checks, velocity rules and 3D Secure.
- Stay PCI DSS compliant to avoid both code 01 and code 12 listings.
- Make sure the products, terms and business classification you give your acquirer match what you actually sell.
- Never process transactions for another business or let anyone else use your merchant account.
Frequently asked questions
What is the TMF or MATCH list?
They are the same thing. MATCH is Mastercard’s database of merchants whose accounts were terminated by an acquirer for specific reasons, and TMF (Terminated Merchant File) is its older name. Acquirers check it when a business applies for a merchant account.
What does TMF mean?
TMF stands for Terminated Merchant File, the former name of Mastercard’s MATCH system. A “TMF merchant” is a merchant with a MATCH listing.
How do I get off the TMF or MATCH list?
Ask the acquirer that listed you for the reason code, then request removal with evidence that the listing was a mistake or that PCI non-compliance has been fixed. Otherwise the listing is removed automatically after five years.
How do I know if I am on the MATCH list?
You can’t check MATCH yourself. Confirmation usually comes from the acquirer’s termination letter, from a provider that declined your application, or from asking your former acquirer in writing.
Is there a Visa version of the MATCH list?
Yes. Visa runs the Visa Merchant Screening Service (VMSS), previously known as VMAS. It is separate from MATCH, so a merchant can be on one, both or neither.
Can opening a new company hide a MATCH listing?
Rarely. MATCH tracks both the business and its principal owners. Changing the trading name or forming a new company with the same people seldom fools underwriters, and it can raise fresh compliance concerns.
Should I hire a lawyer if I think my listing is unfair?
If a listing looks clearly mistaken or is causing serious harm, a lawyer who specialises in payments can review your merchant agreement and correspondence and help you challenge it with the acquirer. This article is not legal advice.
Next step
Fasto works with adult, subscription, nutraceutical, gaming, dating and hospitality merchants. Approval typically takes two to three weeks.
Get a free quote, or read more about our high-risk merchant accounts.
