$200,000
Per bad merchant, Mastercard
For each merchant caught selling illegal or brand-damaging goods. Up to 100% off if the payment company found it first.
Mastercard SPME §8.8.3, §8.9.3
AI agents for merchant risk
Find the problem merchant before Visa or Mastercard does.
Mastercard takes up to 100% off a merchant fine when you found the problem first. Meerkat's agents check every site a merchant runs in under three minutes, tie each finding to the rule it breaks, and hand your team a signed file that holds up in an audit.
Merchant website
- Web agent
- Catalogue agent
- Registry agent
- Registry agent
- Screening agent
- Reviews agent
HIGH8 of 10 products are research peptidesMastercard BRAMYour policy: Block
MEDIUMHealth claims on 6 productsVisa VIRPYour policy: Condition
MEDIUMSells into the pharmacy category, not health and beautyCategory codeYour policy: Ask merchant
Run time 0m 00sEvidence hashed as collected
Under 3 minutesper merchant, not 3 to 7 days
14 checkson every merchant
Every URLcheckout and members area included
Sealed fileanyone can verify
The problem in 30 seconds
1
Someone vouches for every shop
Before a shop can take Visa or Mastercard, a payment company (an acquirer, a PSP or a payment facilitator) has to approve it. That company carries the risk.
2
Bad shops cost them, not the shop
If the shop sells something it shouldn't, or turns out to be a scam, Visa and Mastercard fine the payment company. Up to $200,000 per merchant.
3
Checking is still done by hand
An analyst with a browser and a spreadsheet. It takes days, most of the site never gets read, and the file rarely shows why a merchant was approved.
Why now
The rules got stricter. The checking didn't.
Both schemes raised the stakes in 2026, and EU law follows in 2027. Payment companies need more checks on more merchants, more often, with a record of who decided.
$100,000/month
Unregistered high-risk merchants, Visa
For processing gambling, pharmacy, crypto or adult merchants without registering them, plus $2,000 per merchant per month.
Visa Core Rules §12.5.5.1
72 hours
To investigate a suspected scam
Since July 2026, Mastercard expects an investigation within 72 hours of the first warning signs.
Mastercard SPME §7.2.1
10 Jul 2027
EU anti-money laundering rules
Every merchant file gets an expiry date, across the whole existing book, and AI-made decisions need a person to review them.
AMLR (EU) 2024/1624 Art. 26(2), 76(5)
How it works
From a list of merchants to a signed, sealed file.
Upload a file of merchant IDs with every website each merchant uses, or send a single application. Nothing for the merchant to fill in.
- Works on new applications and on merchants you already have
- Every URL a merchant runs gets its own file and its own monitoring
Upload your bookportfolio.csvExample Peptides · 2 sitesqueuedExample Teas · 1 sitequeuedExample Nutrition · 3 sitesqueuedExample Shoes · 1 sitequeuedSpecialist agents work in parallel, the way a team of analysts would, and finish in under three minutes.
- Read the site, the checkout and a sample of products
- Pull the company, its owners and the directors' other companies
- Check sanctions lists, news and what customers say
- Save every page and record as evidence
Set each rule to block, add a condition, ask the merchant or just note it. Accept a known exception once, with the reason, and it stays accepted.
- Your acceptance policy, not a vendor score
- The policy in force is sealed with every decision
Your acceptance policyBRAM-02 Research chemicalsBlockVIRP-01 Health claimsConditionWEB-02 No refund policyAsk merchantKYB-05 Virtual officeNoteException: KYB-05 accepted up to low for marketplaces. Reason kept with the version.
Every finding comes with its evidence and the rule it breaks. Your analyst confirms or dismisses each one, then approves, adds conditions, declines or escalates.
- A person makes every decision, as EU law requires
- Switch on four-eyes and a second reviewer signs high-risk files, or every file
- Every dismissal needs a reason, so the agents learn
Evidence and decision are locked together with one fingerprint. Change a byte and it no longer matches.
- Hand it to an auditor or a card scheme as is
- Anyone can check it without asking us
evidence40 items, each SHA-256 hasheddecisionDecline, signed by analystpolicyVersion 3, sealed with the decisionrulesMastercard BRAM-02 · Visa VIRP-01fingerprint0e07f8dcc56ad6cb405456e8…verifymatch ✓After boarding, Meerkat re-checks every site on a schedule set by its risk, including the payment page and the members area, and raises an alert when something material changes.
- Catches the shop that switches products after approval
- Counts down Mastercard's clocks on every alert
- Builds Mastercard's monthly monitoring report from the files
- Flags every file a new scheme rule affects
example-teas.co.ukNo material changeexample-peptides.co.ukNew product: tirzepatideexample-nutrition.comRefund window cut from 30 to 14 daysexample-nutrition.com · members areaLogged in: no material changeexample-shoes.co.uk · payment pageSame provider as at boardingRe-checks run weekly, monthly or quarterly, set by risk.
The file
Read a file in ten seconds. Defend it for five years.
The verdict, the dispute outlook and every check sit on one screen, flagged checks first. Each finding shows the page it came from, the words that triggered it and the rule it breaks.
- Draft and dispute outlook, before you scroll.The agents' draft, the risk tier against Visa and Mastercard dispute limits, and the evidence count.
- 14 checks, flagged first.Catalogue, claims, scheme category, directors, policies. What passed is one glance away.
- The storefront as captured.Not as described. Home, product and checkout, saved the moment the agents read them.
- Signed by a named person.Anyone with the file can check it was not changed, without asking us.
What we check
Everything an underwriter checks by hand. And what they never have time for.
Visa and Mastercard tell payment companies what to review before approving a merchant: the website, what it sells, who owns it, whether anyone is on a list. Meerkat does all of it on every merchant, then goes further: the domain's past, the directors' other companies, the shops they run elsewhere.
Is the business real?
Company and owners
The registry record, and who really controls it.
Directors' track record
Their other companies, and how those ended.
Domain history
What the website sold before, from the web archive.
Registered address
Formation agents, virtual offices and mail-forwarding addresses.
What does it actually sell?
Website and checkout
Every page a customer sees, including the checkout.
Product sample
What is really for sale, item by item.
Category check
The MCC it declared against the one it should have.
Subscriptions
Recurring billing that is hard to see or hard to cancel.
Is anyone behind it a problem?
Sanctions and watch lists
Sanctions, politically exposed people, regulator warnings.
Adverse media
News about the company and the people behind it.
Linked sites
Other shops run by the same people.
Your own lists
Your do-not-board list, and the MATCH result your team records.
Will it cost you later?
Customer complaints
Goods that never arrive, refunds refused.
Refund and terms
Missing or misleading policies that drive disputes.
Dispute outlook
A risk tier against Visa and Mastercard dispute limits.
Application check
Does what the merchant told you match what the agents found?
The rules
Every finding points to the rule it breaks.
Meerkat tracks every Visa, Mastercard and EU rule change with its source and start date. When a rule changes, it tells you which of your merchants are affected, without running the checks again.
Mastercard BRAM
Business Risk Assessment and Mitigation
- What it is
- Mastercard's program against merchants selling illegal or brand-damaging goods: counterfeits, illegal drugs, unlicensed pharmaceuticals and more.
- What it costs you
- Up to $200,000 per merchant, charged to the acquirer that signed it. Up to 100% off if the acquirer found the merchant first.
- What Meerkat does
- Samples what the site actually sells and flags BRAM categories before the merchant is boarded. Builds the BRAM response pack from the sealed file if a letter ever arrives.
Mastercard monitoring
Complete monitoring, the way the rule reads.
Mastercard asks for every merchant URL to be monitored completely, including the payment page and members-only areas, with violations reported on a clock. Meerkat is built to do that job end to end.
Every URL.A merchant holds all its websites. Each one gets a file and its own monitoring.
The payment page, every cycle.Meerkat goes to the checkout each time and records who really takes the money.
The members area.The merchant gives a test login through a secure link. Meerkat logs in on schedule and shows what changed.
Alerts on the clock.72 hours to investigate, 5 business days to report, 15 days to resolve, counted down on every alert.
The monthly report.Mastercard's monitoring report, built from the files, in the scheme's columns.
Built around you
Your rules. Your people. Your systems.
Your policy
Your acceptance policy, not a vendor score.
Per rule: block, add a condition, ask the merchant or note it. Exceptions carry a reason and are sealed with the decision.
Your team
One signer, or four eyes.
A solo admin signs alone. A team adds a second signer on high-risk files or on every file. Viewers read, reviewers decide, admins run the workspace. Everyone signs in with two-factor, and people only see what they can use.
Your stack
Fits between onboarding and monitoring.
Upload your book in one file. Start reviews and get results through the API, with webhooks when a review completes or a merchant changes. MATCH results and your do-not-board list live in the same file.
Works with
The sources your team already trusts.
Official registries, scheme lists, sanctions data and the open web, read by agents and saved as evidence. Meerkat sits after your identity checks and before your transaction monitoring, and hands both a better file.
Company registries
Handelsregister
Card scheme lists
Mastercard MATCHVisa VMSSMastercard Fraud Loss Database
Sanctions, PEPs and regulators
OFAC
Office of Financial Sanctions Implementation
Web, domains and reviews
Founder
Twenty years inside payments. Now building the agents.
For two decades Dwayne Gefferie has worked at the frontier of data, analytics and machine learning inside financial services. He was the first data scientist at Adyen, Head of Data at Dimebox and VP of Data Science and Analytics at Checkout.com, then founded DataBright, a data consultancy that helped more than 50 of the world's top 150 acquirers move from on-premise to the cloud.
As an independent consultant he has helped create more than 20 acquiring and issuing banks, including Buut for ABN AMRO's Tikkie. He is the author of Mastercard's acquiring courses, a sought-after speaker, and publishes the Payments Strategy Breakdown newsletter on Substack, read by more than 8,000 C-level executives and managers. Favikon ranks him among the top 10 payments influencers worldwide.
He has a track record of arriving just as an industry breaks out: Adyen and Checkout.com, then DataBright at the start of the cloud analytics wave, where he helped Snowflake, Looker and Fivetran land their first clients in the Netherlands, Belgium and the UK. As a data scientist and payments strategist, he believes agents will reshape how payments companies work. Meerkat is that idea, built.
Dwayne Gefferie · Founder
Pilot
Start with one merchant. Then test it on a hundred.
- Send one merchant you struggled with. We send back its file.
- Then a six-week pilot on 100 to 200 of your past merchants, including ones you later terminated. Upload them in one file.
- Your analysts compare the files blind against your own decisions.
- Public data only: merchant names and websites. None of your customer data leaves your systems.
- Success criteria agreed in writing before day one. Fixed fee, credited against year one.
The EU rules reach your existing merchants on 10 July 2027. A pilot now gives you a measured baseline before then.
Hosted in Frankfurt. Built for EU data residency.