How LegitScript Complies with Mastercard’s Merchant Monitoring Program (MMP)

Starting January 1, 2026, newly onboarded merchants must undergo a website scan before their first transaction. In addition, persistent monitoring thereafter must include restricted, members-only areas of merchant websites.

We see the update as part of a larger shift in payments: stricter oversight, more proactive monitoring, and zero tolerance for surface-level checks. Compliance is no longer a checkpoint — it must run across the lifecycle of a merchant relationship.

Noncompliance can expose payments companies to brand risk, regulatory action, and reputational harm. Our expectation is that Mastercard will enforce the rules firmly and without long grace periods. Historically, card networks set clear deadlines and expect acquirers to comply. LegitScript is helping customers prepare now to avoid last-minute disruption.

Not with LegitScript. Our AI-powered scans deliver results in minutes, so you can stay compliant without delaying merchant approvals.

Approval rates may shift slightly, but the bigger impact is improved visibility. By surfacing risks earlier, acquirers can make smarter decisions and reduce costly fraud or compliance issues down the line.

Yes, the Content Scan module of our Merchant Onboarding scans merchant websites and returns actionable risk intelligence in minutes.

Our Merchant Monitoring combines automation with human expertise to uncover risks even in password-protected environments. Competitors often stop at surface-level automation.

We have systems and processes in place to securely handle IDs and passwords provided by clients. These credentials are managed under strict security protocols to ensure both compliance and data protection.

Our solutions are purpose-built to handle large onboarding volumes and persistent monitoring at scale. We support some of the world’s largest payment facilitators, ISOs, and acquirers today.

Because we’ve done this before. For nearly 20 years, payments leaders have trusted LegitScript to meet card network rules, adapt to new standards, and protect their portfolios at scale.