MCC Drift
MCC drift is when a merchant's actual website content diverges from the Merchant Category Code (MCC) they were approved under. A retailer listed as fashion might pivot to pharmaceuticals, or a restaurant might add gambling content. It is a leading indicator of transaction laundering and compliance risk.
Definition
MCC drift is when a merchant's actual website content diverges from the Merchant Category Code (MCC) they were approved under. A retailer listed as fashion might pivot to pharmaceuticals, or a restaurant might add gambling content. It is a leading indicator of transaction laundering and compliance risk.
How MCC drift happens
MCC drift rarely happens on day one. A merchant onboards with a clean story ("we sell fashion accessories to women aged 25-40") and passes underwriting with an MCC that matches. The problems start later, for any of several reasons:
- Legitimate pivot. The merchant's original business didn't work, so they pivoted to a different product category. They did not notify the acquirer because they didn't know they were required to.
- Line extension. A legitimate business added a new product line that sits in a different MCC, often a higher-risk one. A wellness retailer starts selling kratom, a tobacco merchant starts listing CBD products, a nutrition brand adds unlicensed weight-loss pharmaceuticals.
- Deliberate concealment. A merchant onboards with a clean-looking website and then switches the content after approval, knowing the acquirer rarely re-checks. This is the classic setup for transaction laundering.
Why point-in-time checks miss it
Most acquirers only look at a merchant's website at two moments: during onboarding, and when something goes wrong (excessive chargebacks, a complaint, a Mastercard notification). In between, the website can drift a long way without anyone noticing. A merchant approved three years ago and never re-checked is effectively running on trust.
MCC drift detection closes this gap by treating the declared MCC as a baseline and continuously comparing current content to it. The drift score quantifies how far the merchant has moved. Small drift is normal (product lines change, seasonal inventory shifts). Large drift, especially into a different MCC family, is a signal the acquirer needs to act on.
How Kenal AURA detects MCC drift
Kenal AURA maintains a per-tenant MCC taxonomy (with 17 BRAM families mapped on top) and assigns every merchant a declared MCC at onboarding. Each scan produces:
- A classification of the dominant content category found on the site.
- A match score against the declared MCC family.
- An alert if the match score drops below a configurable threshold.
- An elevated alert if the detected category is in a prohibited BRAM family.
Thresholds are configurable per merchant risk tier. High-risk portfolios can alert at 20% divergence; standard retail portfolios can tolerate 40% before flagging. Analysts then review the alert and decide on action.
MCC drift versus web change detection
These are related but different. Web change detection surfaces any material content change on the merchant's site: a new page, a changed price list, a new hero image. Most of those changes are routine. MCC drift is a specific sub-class of web change: the change moves the merchant into a different category than the one they were approved for. That makes MCC drift a much higher-signal alert class that deserves its own queue and its own SLA.
Frequently asked questions
- What is an MCC?
- A Merchant Category Code is a 4-digit number assigned to every merchant at onboarding that categorizes their business. MCCs drive interchange rates, reporting requirements, and risk-tier treatment. ISO 18245 defines the global MCC list, and card networks maintain their own extensions.
- Why does MCC drift matter for compliance?
- Acquirers approve merchants based on their declared MCC. If a merchant later quietly pivots to a different business type (especially a higher-risk one) the acquirer is processing transactions for a business they never actually underwrote. That is a BRAM issue, a chargeback risk, and in some cases, an indicator of transaction laundering.
- How is MCC drift detected?
- Kenal AURA compares the content of each scan against the merchant's declared MCC family using classification rules and AI analysis. When the content clearly belongs to a different MCC family (especially one in a prohibited or high-risk BRAM category) the system raises an MCC drift alert as a distinct alert class.
- What should happen when MCC drift is detected?
- An investigation case is opened. The analyst reviews the evidence, confirms whether the drift is genuine (the merchant actually changed business) or a false positive, and decides on action: re-underwriting with the correct MCC, warning the merchant, suspending processing, or escalating to termination. Each resolution is recorded with structured reason codes.
See how Kenal AURA handles this in production
Kenal AURA is the merchant lifecycle risk operations platform for acquirers, PSPs, and fintechs across Malaysia and ASEAN.