Sign In Get Started
High-Risk Merchant Program

Card-brand compliance.
Run all year.
Ready on review day.

A structured program for adult content platforms processing Visa and Mastercard. Numbered controls, a compliance calendar and an evidence register — with ProntoID handling identity, consent and record-keeping natively.

Start a Readiness Check See the Controls
Mapped to Visa & Mastercard
Annual compliance calendar
One-click review pack
The Problem

The rules are public.
The structure isn’t.

Mastercard’s AN 5196 standards and Visa’s Integrity Risk Program tell acquirers what adult merchants must have in place. Acquirers certify and audit their merchants — and most platforms rebuild their evidence from scratch every year.

Scattered Requirements

Two card brands, acquirer checklists, MCC rules and local age-verification laws — each worded differently, none written as a to-do list.

Evidence Built in a Hurry

Agreements, IDs and takedown logs get hunted down in the weeks before the review instead of being filed as the work happens.

Monitoring Keeps Tightening

Since January 2026, Mastercard’s revised merchant monitoring reaches into members-only and paywalled areas. Gaps surface between reviews, not only at them.

How It Works

Four layers.
One evidence trail.

Built like an ISO management system: you run the program, and the evidence files itself as you go.

1

Control Framework

Card-brand requirements rewritten as 19 numbered controls, each with a plain-language explanation, a policy template and the evidence it needs.

2

Compliance Calendar

Monthly, quarterly and annual tasks scheduled automatically. A task closes only when its evidence is attached.

3

Native ProntoID Tools

ID and age checks, signed releases, consent records and encrypted storage — filed against the right control as they happen.

4

Review Pack

One export, organised by control and timestamped, ready to hand to your acquirer at the annual review.

Native ProntoID performs the control and records the evidence automatically.
Supported The program provides the template, schedule and log. Your team does the work.
Platform Fully your responsibility. The program defines what to record.
Control Framework

19 controls,
mapped to the card brands

Each control lists the requirement it answers. MC = Mastercard AN 5196 / MMP, V = Visa VIRP.

A · Governance
HRM-01
Program owner & charter
Name a compliance owner with the authority to remove content and suspend accounts, and adopt the program charter.
Evidence: Signed charter, named owner, org chart
Program foundation
Platform
HRM-02
Correct MCC & card-brand registration
Process adult content under MCC 5967, including AI-generated adult content, and confirm with your acquirer that you are registered with each brand.
Evidence: Acquirer confirmation of MCC and registration status
V: VIRP Tier 1 · MC: Specialty merchant registration
Platform
HRM-03
Content & prohibited-content policy
A published policy defining allowed and prohibited content, applied to everyone who supplies content.
Evidence: Versioned policy, publication date, provider acknowledgements
V: Content management policy · MC: AN 5196
Supported
HRM-04
Marketing & search-term controls
Titles, tags, marketing and search terms must never suggest minors, non-consent or other prohibited themes. Keep a blocked-terms list.
Evidence: Blocked-terms list, quarterly review record
MC: AN 5196 · V: VIRP
Platform
B · Identity & consent
HRM-05
Age & ID verification of everyone depicted
Every person appearing in content is age- and identity-verified before publication.
Evidence: ProntoID verification record per performer, linked to each content item
MC: AN 5196 · V: VIRP creator age verification
Native
HRM-06
Age & ID verification of uploaders
Every account that can upload content is verified before its first upload.
Evidence: ProntoID verification record per uploader account
MC: AN 5196
Native
HRM-07
Written agreement with each content provider
A signed agreement with every content provider covering prohibited content and verification duties.
Evidence: ProntoRelease signed agreement, timestamped
MC: AN 5196 · V: Produced-content provider policy
Native
HRM-08
Documented consent to record & publish
Consent from every depicted person to being recorded and to publication and distribution, tied to specific content.
Evidence: Signed release plus ProntoMint consent attestation per item
MC: AN 5196 · V: VIRP
Native
HRM-09
Secure record retention & retrieval
Identity and consent records stored encrypted, retained per policy, and retrievable when the acquirer or a card brand asks.
Evidence: Encrypted storage log, retrieval test result
V: Acquirer must be able to demonstrate compliance
Native
C · Content controls
HRM-10
Pre-publication review
All content is reviewed before it goes live. The platform reviews; the program provides the procedure and a decision log.
Evidence: Review log: item, reviewer, decision, timestamp
MC: AN 5196 · V: Content moderation policy
Supported
HRM-11
Live-stream controls
Real-time monitoring of live streams with the ability to stop a stream and remove violating material.
Evidence: Monitoring procedure, incident log
MC: AN 5196 revisions
Platform
HRM-12
AI-generated content policy
Rules for synthetic or AI-assisted content, including a ban on depicting real people without verified consent.
Evidence: AI content policy, labelling rules, consent records where real people are depicted
V: MCC 5967 includes AI-generated content
Supported
D · Complaints, appeals & reporting
HRM-13
Complaint & takedown process
A public channel to report illegal or rule-violating content, with complaints resolved within seven business days.
Evidence: Complaint log with received and resolved dates
MC: AN 5196 · V: VIRP
Supported
HRM-14
Appeals for depicted people
Anyone depicted can request removal. ProntoID verifies the requester and checks the request against stored consent. Content is removed if consent can’t be verified.
Evidence: Verified requester record, consent check, outcome
MC: AN 5196 · V: VIRP appeals
Native
HRM-15
Monthly acquirer report
A monthly report of flagged content, complaints and takedown requests, sent to the acquirer.
Evidence: Report sent each month, with delivery confirmation
MC: AN 5196 · V: VIRP
Supported
E · Consumer access
HRM-16
Consumer age verification
Viewers are age-verified wherever the law requires it, with a jurisdiction map kept up to date.
Evidence: Jurisdiction map, ProntoID age-check records
V: VIRP consumer age verification
Native
HRM-17
Reviewer access to restricted areas
Give the acquirer, card brands and their monitoring agents access to members-only and paywalled areas on request.
Evidence: Test-account procedure, quarterly access test
MC: AN 5196 · MC: MMP 2026
Platform
F · Evidence & review
HRM-18
Annual policy review & training
Review every policy and train staff on the controls once a year, and whenever card-brand rules change.
Evidence: Review minutes, training attendance
Program foundation
Supported
HRM-19
Mock review & review pack
A full internal check against every control 60 days before the acquirer review, then a structured evidence export.
Evidence: Mock review report, exported review pack
Program foundation
Supported
Compliance Calendar

A rhythm,
not a scramble

Recurring tasks with owners and due dates, counted back from your review date. A task closes only when its evidence is attached.

Continuous

As the work happens
  • ID-verify every new performer and uploader HRM-05/06
  • Signed agreement and consent before publication HRM-07/08
  • Log every pre-publication review decision HRM-10
  • Resolve complaints within 7 business days HRM-13

Monthly

First 10 days of the month
  • Send flagged content, complaints and takedowns report to acquirer HRM-15
  • Check complaint resolution times HRM-13
  • Review open appeals from depicted people HRM-14

Quarterly

Sample-based checks
  • Sample 25 published items: ID, agreement and consent on file HRM-05–09
  • Review marketing copy and search terms HRM-04
  • Test reviewer access to paywalled areas HRM-17
  • Re-check consumer age-verification laws HRM-16

Annual

Counted back from review date
  • T−90: policy review and staff training HRM-03/18
  • T−60: mock review against every control HRM-19
  • T−30: close gaps from the mock review
  • T−14: export the review pack HRM-19
Program Tiers

Scoped to how
your platform works

A single studio, a creator platform and a cam site carry very different obligations. Each tier adds controls on top of the one before.

Studio Creator Platform Live & Cam
Built for Own productions, known performers Third-party uploads, fan and clip sites Real-time streams and private shows
Governance & policies (01–04) Included Included Included
Performer ID, agreements, consent (05, 07–09) Included Included Included
Uploader verification (06) Not needed Included Included
Pre-publication review (10) Included Included Included
Live-stream controls (11) Not needed Not needed Included
Complaints, appeals, reporting (13–15) Included Included Included
Consumer age verification (16) Included Included Included
Controls in scope 16 17 18

HRM-12 (AI-generated content) adds one control to any tier that hosts or generates synthetic content.

Clear Boundaries

What the program
is — and isn’t

Your acquirer certifies you, and you stay in charge of your content. The program makes sure the work is structured, scheduled and provable.

The program is

  • A structure, templates and a calendar
  • Native identity, consent and storage tools
  • An evidence register and review export
  • Updated when card-brand rules change

The program isn’t

  • Content moderation or monitoring
  • A certification — only your acquirer certifies
  • Legal advice
  • A guarantee of approval
FAQ

Common
questions

Everything you need to know about the High-Risk Merchant Program. Can’t find the answer? Email us.

No program can do that on its own. Your acquirer certifies you to Visa and Mastercard, and the card brands set the rules. The program gives you the structure, tools and evidence to meet those rules and to show your acquirer that you do.
No. Content review, live-stream monitoring and decisions about what stays up remain your responsibility. The program gives you the procedures and the logs to record that work, and ProntoID handles the identity, consent and record-keeping controls natively.
The controls are mapped to Mastercard’s AN 5196 specialty merchant standards for adult content, Mastercard’s revised Merchant Monitoring Program (effective 1 January 2026), and the Visa Integrity Risk Program for MCC 5967 merchants. Each control lists the requirement it answers.
We update the control framework and notify every program member, with a note on what changed and which controls are affected. Your calendar picks up any new recurring tasks automatically.
Yes. Acquirer checklists are built on the same card-brand rules. The review pack is organised by control, and each control carries its card-brand reference, so it maps cleanly onto most acquirer questionnaires.
No. The program is an operational framework and toolset. For questions about your specific obligations, speak to your acquirer and your own legal counsel.
Related Services

The tools behind the program

KYC Verification

Document capture, biometric liveness and age verification for every performer and uploader — controls HRM-05, 06 and 16.

Learn More

Release Forms

Signed agreements and model releases, timestamped and tied to each piece of content — controls HRM-07 and 08.

Learn More

Swiss Privacy Vault

Encrypted, Swiss-hosted storage for identity and consent records, retrievable when your acquirer asks — control HRM-09.

Learn More

Know where you stand
before your next review

The readiness check walks you through every control, one question each, and shows your gaps before your acquirer does.

Request a Readiness Check See the Controls

Questions? hello@prontoid.com

Brooks & Keitt Sàrl  ·  Place du Midi 30, 1950 Sion, Switzerland

Requirements are summarised from public card-brand and acquirer communications on Mastercard AN 5196 (2021), Mastercard’s revised Merchant Monitoring Program (effective 1 January 2026) and the Visa Integrity Risk Program (2023, updated 2024). Card-brand rules change; always confirm current requirements with your acquirer. The High-Risk Merchant Program does not certify compliance and is not legal advice.