The MATCH List: How Merchants Get Blacklisted
The MATCH list (formerly the TMF) is the card industry's blacklist for terminated merchants. Here is how you land on it, how to tell if you're on it, and how to get off.
You apply for a new merchant account. Solid business, real product, the works. A few days later the application comes back declined, and nobody will tell you why. You try a second processor. Same thing. A third. Declined. At some point it stops feeling like bad luck and starts feeling like a door that has been locked from the inside.
It probably has. There is a decent chance you are on the MATCH list, and the cruel part is that nobody is required to tell you. So let me walk you through what this thing actually is, how people end up on it, and what your real options are once you’re there. I deal with this list constantly, so no fairy tales. Just the mechanics.
What MATCH actually is
MATCH stands for Member Alert to Control High-risk merchants. It is a database Mastercard runs, and it is exactly what it sounds like: a list of merchants who have been terminated by an acquiring bank. You may also hear it called the TMF, the Terminated Merchant File. Same thing, older name. People in the industry use them interchangeably, so if you see “TMF” in a forum, read it as MATCH.
Here is the structure that matters. You do not have an account with Mastercard. You have an account with an acquiring bank, the institution that actually moves money between the card networks and your processor. When that bank decides you are too much risk and terminates you, Mastercard’s rules say the bank is required to report you to MATCH within 5 business days of the termination, if the reason is one of the listed codes.
Then, when you go shopping for a new account, the next acquirer runs your details against MATCH before they approve you. They see you’re listed, they see the reason code, and most of them simply pass. Not because they investigated you. Because you showed up on a shared blacklist and you’re not worth the diligence.
That is the whole machine. One bank lists you, every other bank sees it, and the lights go out across the industry at once.
How you actually find out
This is the part that makes people furious, and rightly so. There is no portal. You cannot log in somewhere and check whether you’re on MATCH. There is no letter that arrives saying “congratulations, you have been listed.” Mastercard maintains the database for acquirers, not for merchants, and you are not the customer here.
So the way nearly everyone discovers they’re on it is the way I described at the top: a new application gets declined, then another, then another, with no clear reason given. The denials feel random until you connect them. If you’ve been terminated by a processor and now cannot open anything new anywhere, you should assume you’re listed until proven otherwise. That assumption will save you weeks of confused reapplying.
The reason codes
Every MATCH listing carries a reason code, and the code matters because it shapes both how other banks read you and what your path off looks like. You don’t get to pick it. The bank that terminated you does. These are the ones I see most:
- Code 04, Excessive Chargebacks. The big one. This triggers when your chargebacks cross 1% of your Mastercard sales in a single month and total $5,000 or more. If you’ve read the piece on chargeback ratios, you already know how quietly you can drift into this.
- Code 05, Excessive Fraud. Your fraud-to-sales ratio hits 8% or more in a month, with at least 10 fraud transactions totaling $5,000 or more.
- Code 03, Laundering. Processing transactions that aren’t yours, or running someone else’s volume through your account.
- Code 12, PCI non-compliance. Failing the card-data security standards.
- Code 13, Illegal Transactions. Selling something the bank decided it shouldn’t be touching.
- Code 01, Account Data Compromise. A breach exposed cardholder data tied to your account.
Most legitimate high-risk merchants who land on MATCH get there on Code 04. They weren’t running a scam. They were running a supplements store or a rebill funnel in a category that produces disputes, and one bad month pushed the ratio over the line. The system does not distinguish between “fraudster” and “ordinary merchant in a flagged vertical who had a rough November.” The code looks the same to the next bank either way.
How long you’re stuck
A MATCH record stays on the list for five years. After that it auto-purges. Mastercard runs a monthly cleanup that drops records once they age out, so there’s no need to do anything for the clock to run, but five years is effectively forever in this business. Most stores cannot pause for five years and survive.
And here is the wrinkle that trips people up: only the acquiring bank that listed you can remove you early. Not Mastercard. Not the new bank you’re applying to. Not you, through some appeal portal that doesn’t exist. The exact institution that put you on has to be the one to take you off, and they have very little incentive to do you that favor.
The three ways off
I wish there were more, but there are genuinely only three.
1. Wait it out. Five years, then the record purges on its own. This is the default and for a lot of merchants it is the only realistic one, which is a brutal thing to tell someone whose business is alive right now.
2. Prove you were listed by mistake. If the termination was an error, wrong identity, a clerical mix-up, a reason that doesn’t hold up, you go back to the acquiring bank that listed you and make your case. If they agree, they remove the entry. This works only when there’s a genuine mistake to point at, and only with the bank that did the listing. It is worth pursuing if you have a real argument, and a waste of breath if you don’t.
3. Fix PCI non-compliance. This is the one exception where you can sometimes go to Mastercard directly. If you were listed under Code 12 for PCI failures and you’ve since become compliant, there’s a path to getting removed once you can prove you fixed it. It’s the cleanest route off, but it only applies to that specific code.
That’s it. Anyone promising you a fourth way, a guy who can “wipe” you off MATCH for a fee, is selling you something that does not exist. The database doesn’t work like that, and the only legitimate early removal runs through the bank that listed you.
What this means if you’re high-risk
Step back and look at what MATCH really is. It is a shared blacklist that lets every acquirer screen you using a decision a single other acquirer made, often automatically, often over one bad month of chargebacks. You don’t get a trial. You get a code.
Some high-risk processors will still onboard MATCH’d merchants, particularly on Code 04, because they’ve decided excessive chargebacks is a manageable risk at the right price. But “the right price” means worse rates, bigger reserves, and tighter terms. You can sometimes keep processing. You just pay for the privilege of being on the list, indefinitely.
The honest takeaway is that MATCH is not really a punishment for fraud. It is a structural feature of how card processing manages risk, and ordinary merchants in spicy verticals get caught in it all the time. Which is exactly why the smart move is to never bet your whole operation on a single account that, if terminated, can quietly lock you out of the entire industry for five years. That fragility is the actual problem. The list is just where it shows up.
If you think you’re on MATCH and want to figure out which path actually applies to your situation, I’m on Telegram at @lucimornens.