Hosting is a subscription business. Domains renew, hosting plans auto-bill, free trials convert, and a growing share of providers now run their own embedded-payments arms. Every one of those mechanics runs on accepting a card, and on April 1, 2026 Visa made accepting that card more expensive. Under its Visa Acquirer Monitoring Program, or VAMP, the threshold at which a merchant is flagged for excessive disputes fell from 220 to 150 basis points across North America, the European Union and Asia Pacific, cutting the headroom a business has before it trips a penalty regime by roughly a third. A full quarter into the change, this is a present cost rather than a future risk, with hosting billing already measured against the lower threshold for three monthly cycles. For an industry whose revenue depends on renewals, trials and downstream payments, that is not a back-office detail. It is a tightening, rarely-budgeted cost aimed squarely at the billing patterns hosting relies on.

Why the Squeeze Lands on Hosting Hardest

Dispute-monitoring programs apply to every merchant, but a few features of the hosting and registrar model make VAMP bite harder than it does on a one-time retailer. The first is that the revenue is recurring and, from the customer’s side, largely involuntary. Automatic renewals reliably manufacture a specific kind of dispute. A customer forgets the card on file, misses the renewal notice, or signs up at a low introductory rate and is startled by the full price. Rather than open a support ticket, they call the bank. Each of those is a chargeback, and VAMP counts non-fraud disputes the same as fraud. So a renewal a customer simply regrets pushes toward the 150-basis-point line exactly like a fraud claim does. The aggressive renewal pricing that maximizes revenue is the same mechanism that manufactures the disputes that now trip a lower bar.

The second feature is the free trial and the introductory offer. Free-to-paid conversion generates a dependable stream of “I did not mean to be charged” disputes at the moment of conversion, and card-testing fraud gravitates to any service that accepts a card for a trial or low-value signup, which describes much of shared hosting and domain registration. The billing designs that acquire customers cheaply are the same ones that seed the dispute ratio.

The VAMP Numbers That Matter

Underneath the headline change sits a compact set of thresholds and fees. These are the figures a hosting finance team should have in front of it.

  • Merchant “excessive” threshold: 150 basis points, down from 220, across North America, the EU and Asia Pacific since April 1, 2026, with a minimum monthly count of 1,500 fraud and dispute cases
  • VAMP ratio: fraud reports plus disputes, divided by settled card-not-present transactions, so non-fraud disputes count in full
  • Acquirer thresholds: above standard at 50 basis points, excessive at 70, which forces mandatory risk-mitigation controls
  • Per-dispute fee, reported by payments-industry analysts rather than stated in Visa’s fact sheet: around $8 for each card-not-present dispute, fraud or not, with acquirers billed $4 at above standard and $8 at excessive
  • Timeline: the consolidated program took effect June 1, 2025, and the merchant step-down to 150 basis points followed on April 1, 2026

Visa’s VAMP thresholds in basis points. The merchant “excessive” ratio fell from 220 to 150 on April 1, 2026 across North America, the EU and Asia Pacific, a 32 percent cut in headroom, while acquirer portfolios are policed at 50 and 70. Source: Visa Acquirer Monitoring Program.

The fee is the detail that catches finance teams out. Because the $8 applies whether or not the merchant wins the dispute, the volume of disputes costs money on its own, independent of whether any were valid.

The Payment-Facilitator Trap

The sharpest exposure belongs to the providers that have stopped being ordinary merchants and become payment facilitators. GoDaddy, with nearly $5 billion in annual revenue, is the clearest case. GoDaddy Payments lets its own customers accept cards, which turns the company from one managing its own dispute ratio into one managing the dispute ratios of thousands of downstream merchants and absorbing the settlement losses when those merchants’ transactions go bad. That is a categorically larger risk, and GoDaddy is not alone in taking it on. Embedded payments have become a standard attach for hosting and commerce platforms because they add high-margin revenue, but they quietly import the card networks’ entire penalty and loss regime onto the host’s own balance sheet.

While the Industry Raised Prices, a Few Hosts Promised Never To. Regulation Just Made That a Strategy.

What GoDaddy’s 10-K Discloses

The clearest description of that risk is not an analyst note but the risk-factors section of GoDaddy’s FY2025 annual report, because a public company must disclose what a private one can keep quiet. GoDaddy warns that if a payment acquirer judges a customer to be running excessive chargebacks, it can raise processing fees, establish or increase reserve funds, suspend GoDaddy Payments, or terminate the agreement outright. Each is a distinct margin event: a reserve ties up working capital, a fee increase is a permanent cost step, and termination is existential for a business that cannot accept payment. On the facilitator side, GoDaddy discloses that when its service is used to process illegitimate transactions and the settled funds cannot be recovered, it suffers the loss and the liability, and that as a facilitator it is bound by the operating rules and penalties of Visa, Mastercard and American Express. None of this is unique to GoDaddy. It is the standard shape of the risk for any host that bills on subscription or has added embedded payments, and GoDaddy’s filing is simply where it is written down for investors to read.

The Cost Center Nobody Budgets

For a hosting CFO, the consequence is straightforward. A cost long treated as a flat percentage of revenue is now a variable. It responds to billing design, and the external rule governing it just tightened. The levers that reduce it sit in product and billing, not in the security stack. Clearer renewal notices and honest introductory-to-renewal pricing help, and renewal-notification laws in several jurisdictions are starting to require them anyway. Friction and verification on free-trial and low-value signups blunt the card testing that concentrates there. And every provider now has to weigh whether the high-margin revenue from embedded payments is worth importing the networks’ loss-and-penalty regime. The industry has spent years optimizing one side of recurring revenue, the price, and leaving the other side, the cost of collecting it, unmanaged. The renewal multiplier and the dispute ratio are two outputs of the same billing machine, and as of April 1 the second is penalized at a lower threshold. The providers that treat payments as strategically as they treat renewal pricing will be the ones that keep the margin the renewals were meant to deliver.