Visa's Integrity Risk Program now sits on top of four separate national age-verification laws. Here's what's actually required, what's changed in 2026, and where the two frameworks stop overlapping.
What is VIRP, exactly?
The Visa Integrity Risk Program (VIRP) is Visa’s compliance framework for merchants operating in industries that carry a higher risk of illegal activity — adult content, gambling, and a handful of other verticals. It replaced Visa’s earlier Global Brand Protection Program, and it applies to any merchant accepting Visa payments through their acquirer, wherever that merchant is legally established.
The distinction that trips people up: VIRP is not a checklist merchants fill in once. Visa requires acquirers like Vendo to actively verify — not simply take a merchant’s word for it — that four core controls are in place and stay in place:
- Age verification that prevents minors from accessing adult content
- Performer and content consent, documented and verifiable on request
- A working complaint process for reported content
- Content moderation controls for user-generated and live content
In practice, that means your acquirer reviews these controls on an ongoing basis — not just at onboarding — and needs to be able to produce supporting documentation the moment Visa asks for it.
What you need to do to stay compliant
Here’s the full picture of what Visa expects from adult merchants under VIRP, organized by area.
Website & URLs
Keep your registered URL(s) accurate and active. If your business structure, domains, or affiliated free or paid sites change, tell your PSP — it’s one of the simplest things to get flagged for and one of the easiest to fix. If you run a free site alongside a paid one, VIRP’s requirements apply to the free site too, whenever content is shared between the two or the paid site benefits from advertising revenue the free one generates.
Age verification
Visa requires age verification “where required by law” for the jurisdictions your content reaches — which in 2026 means the UK, France, Germany and Italy all require active, effective checks. Self-declaration is not accepted in any of the four. Where a compliant solution isn’t yet in place for a given jurisdiction, geo-blocking that jurisdiction is the fallback expectation until one is implemented.
Consent & content
- A written agreement with every third-party or user-generated content provider, prohibiting illegal activity and requiring the provider to hold records confirming consent to be filmed, published, and downloaded (where downloading is available)
- Identity and age verification of content providers before upload access — a government-issued ID check, with the ID confirmed as being in that provider’s actual possession. Visa recommends using a specialist third-party vendor for this rather than handling it manually
- Content uploads restricted to verified providers only, with Vendo verifying supporting documentation on at least a sample basis
- Review of all content before publication, and active real-time monitoring — with the ability to remove non-compliant material immediately — for live or streamed content
Marketing & access
Don’t market content, or allow search terms, in a way that implies it contains child exploitation material or non-consensual activity, even inadvertently. Be ready to provide account credentials behind your paywall if PSP or an appointed third party requests them. Maintain policies actively prohibiting your platform’s use for trafficking or abuse — active membership in an anti-trafficking organization isn’t required, but it strengthens your position under review.
Why it matters more in 2026 than it did in 2024
VIRP compliance protects your ability to accept payments, full stop. Visa has been tightening enforcement, not loosening it, and portfolio-level reviews of acquirers’ merchant books are already underway. If gaps surface, the consequences move fast: for the merchant, that’s remediation on a tight deadline, mandatory geo-blocking of non-compliant markets, or account termination in serious cases. For the acquirer, unresolved portfolio gaps can trigger heightened reserves, third-party audits, or a block on boarding new merchants in the category.
The reason it’s escalated in 2026 specifically: VIRP’s age-verification requirement now overlaps with binding national law in several of the largest adult-content markets. The UK, France, Germany and Italy have each passed legislation requiring real, effective age checks — not a tick-box — and their regulators are actively fining and blocking non-compliant sites. Watching those enforcement numbers is a reasonable proxy for how seriously Visa is likely to treat a gap in the same control.
Country-by-country: where age-verification law gets specific
VIRP sets the acquirer-level bar. National law sets the legal one. They overlap heavily but aren’t identical, and each of these four markets now defines “effective” differently.
| Market | Law & regulator | Standard required | Maximum penalty |
|---|---|---|---|
| 🇬🇧 UK | Online Safety Act / Ofcom | “Highly effective” age assurance, mandatory since 25 Jul 2025, no grace period | Up to £18M or 10% of global turnover |
| 🇫🇷 France | SREN Law / Arcom | Session-level checks with at least one “double-anonymity” method — the verifier can’t see the destination site, the site can’t see the identity | €150,000 or 2% of worldwide turnover; blocking within 48 hours of formal notice |
| 🇩🇪 Germany | JMStV / KJM–FSM | “Closed user group” verified by a KJM/FSM-certified system — ID checks, biometric liveness, or approved facial age estimation | Site blocking; payment blocking available to regulators since 1 Dec 2025 |
| 🇮🇹 Italy | Caivano Decree / AGCOM | Same double-anonymity model as France, checked every session — a one-time or “logged in” check isn’t sufficient | Up to €250,000; AGCOM can order blocking until compliance is restored |
The practical checklist: what to actually have on file
Most gaps we see aren’t merchants doing something wrong — they’re merchants doing the right thing without writing it down.
- Content management policy — covering content-creator age verification, your content moderation process, and rules for any produced-content provider you work with
- Consumer age-verification policy — naming your verification method and provider, and how you handle jurisdictions with different legal requirements
- Complaint and content-removal policy — the visible takedown link, your 5-business-day resolution commitment, and monthly reporting (including NIL months)
- A sample written agreement with third-party content providers — the actual template you use, not just a description of your process
- Chargeback and fraud-mitigation policy — plus, if you run an affiliate program, a documented vetting and KYC process for affiliates and the creative guidelines they’re allowed to use
Vendo specializes in high-risk payment processing for CBD, seeds, and other high-risk industries. Our solutions are tailored to meet the unique needs of your business, ensuring seamless transactions and reducing the risk of payment disruptions. Contact our expert team to learn how we can help your business to maximize growth during the festive holidays and beyond.