The MAC List, the MATCH List, and the One Nobody Names
The MAC List, the MATCH List, and the One Nobody Names
Most merchants who get turned down for a merchant account and go looking for an explanation find the same answer: the MATCH list. Some are told something vaguer — that they are on a MAC list, or that an alert came back. It is the one people write about, it has a name, a rulebook and a five-year clock, and for a lot of declines it is the right answer.
But it is not the only file an underwriter checks, and if you assume it is, you will spend weeks working on the wrong problem. There are at least three things being looked at, they are run by three different kinds of organisation, and only one of them has published rules.
The practical consequence is simple. When a processor declines you and mentions an alert, the first question is not “how do I get off the list.” It is “which list, and who put me there” — because the answer changes who you have to talk to, and in every case it is not the processor that just declined you.
MATCH: Mastercard’s File, and the Only One With a Rulebook
MATCH stands for Mastercard Alert to Control High-risk Merchants. Older operators still call it the terminated merchant file, or TMF, and both names circulate. Mastercard operates it; acquirers write to it. The obligation runs both ways — a processor must check the database when it takes on a new merchant, and must add a merchant to it when it closes a qualifying account.
What makes MATCH tractable is that it is governed. A listing carries a numbered reason code. It runs five years from the termination date. And only the acquirer that filed it can remove it early, generally in three situations: it was filed in error, it was the result of identity theft, or it was a data-security listing and compliance has since been proven.
Two things merchants consistently get wrong about it. Mastercard runs the database but does not adjudicate individual entries — nobody reviews whether a listing was fair. And a listing attaches to the principal owner’s name and tax ID, not only the business that was terminated, so it does not stay contained to the one company. We walked through how that plays out in the MATCH list and how an honest merchant lands on it.
You cannot check whether you are on MATCH. There is no public search and nobody is required to tell you. The only reliable route is to ask the acquirer that terminated you whether they filed a record and under which reason code — and to get that answer in writing.
Visa Runs Its Own, and Clearing One Does Not Clear the Other
Visa maintains the Visa Merchant Screening Service, a separate file that acquirers query during onboarding due diligence. It is not MATCH, it is not maintained by Mastercard, and a record in one has no bearing on the other.
This matters more than it sounds. A merchant who does the work to resolve a MATCH listing, and believes the problem is behind them, can still be declined on a Visa record they never knew existed. Two card brands, two files, two separate conversations.
Underwriters rarely volunteer which one produced the decline, partly because their own guidelines often do not distinguish. A hit is a hit.
“Is there a record on us, and is it Mastercard’s or Visa’s?” is a better question than “am I on MATCH.” It also signals to the underwriter that you know the difference, which tends to produce a more specific answer.
The MAC List: a Trade Association, Not a Card Network
The third thing an underwriter may be looking at is not run by a card brand at all, and when someone tells you there is a MAC list entry against your business, this is what they mean.
The Merchant Acquirers’ Committee was founded in 1997 by six people in the payments industry and spent twenty-five years becoming the recognised body for risk, underwriting and compliance in payment processing. On 7 April 2023 it renamed itself the Association of Payment Professionals. Nearly everyone in underwriting still says MAC.
Its membership is the point. Acquiring banks, ISOs, the card brands, NACHA, law enforcement agencies, processors and payment facilitators — roughly two thousand risk and underwriting professionals. And it runs a channel the association describes, in its own words, as a mechanism for members to share fraud alerts. Members receive communications regarding suspicious or problematic merchants.
Read that carefully, because it is doing a lot of work. What gets called a MAC list is members sharing information with each other. It is not a network file with mandatory reporting, numbered codes and a five-year clock. It is a professional community talking about merchants it considers a problem.
A MATCH listing means a specific acquirer terminated a specific account for a coded reason, and Mastercard rules govern what happens next. A MAC list alert can be far broader than that, and there is no published rulebook telling you what qualifies, how long it persists, or how it gets corrected. The looser structure is exactly what makes it harder to resolve, not easier.
An Alert Is Not a Finding, but It Is Treated Like One
Here is the pattern that catches legitimate businesses. A processor declines, and the reason given is something like suspected fraud or identity theft. The merchant, who has done nothing of the kind, goes and proves they exist — pulls their Secretary of State record, confirms the corporation is active, confirms they are the officer of record at the address on the application, confirms the filing date.
All of that comes back clean. And it changes nothing, because it answered a different question than the one underwriting asked.
A state record proves a company exists and that a person is who they say they are. An alert in any of these files is about prior processing history — an account that was closed, a chargeback problem, a loss at a previous acquirer. A perfectly legitimate business that has traded for thirty years and a record of a prior termination are entirely compatible facts. Proving the first does nothing about the second.
That is why a second processor declines after the first one did. Not because the diligence was bad, but because the diligence was pointed at the wrong question.
Not “can I prove my business is real.” That is rarely what is being doubted. The question is: has any merchant account connected to me or to anyone who owns 25% or more of this business ever been closed by a processor? If the answer is yes, that is the thread to pull, whatever the decline letter said.
Four Steps, in This Order
1. Ask the declining processor three questions, in writing. Is the record on the business, on a principal, or on an associated entity? What is the underlying reason? And which member or acquirer contributed it? The third one is the only one that leads anywhere, because in every one of these files the entry belongs to whoever filed it. The processor that just declined you cannot remove someone else’s record, and often genuinely cannot tell you much beyond the fact that a hit came back.
2. Go through your own processing history before you assume it is an error. Any merchant account that was closed by a processor rather than by you, including under a prior business, a partnership, or a company you were an officer of years ago. Owners frequently do not know an account was terminated rather than simply closed — from the merchant’s side those can look identical.
3. Approach whoever filed it, not the network and not the new processor. Mastercard does not adjudicate MATCH entries. A trade association does not arbitrate its members’ alerts. The filing party is the only one who can correct or withdraw a record, which makes step one’s third question the whole game.
4. Stop submitting applications while you work on it. This is the step people skip. Each additional application is another decline on your record, and repeated submissions across processors are themselves visible and read as a warning sign. Two declines on the same stated grounds should end the shopping, not accelerate it. A merchant who applies to six processors in a month has made the problem worse and learned nothing new.
Frequently Asked Questions
No. None of them has a public lookup, and none of the operators is obliged to tell you that you are listed. Most merchants find out when an application is declined without a clear explanation. The practical route is to ask the acquirer that terminated you whether a record was filed and under what reason, in writing.
Because MATCH is not the only thing they check. Visa runs its own screening service, and the channel people call the MAC list circulates alerts among member risk teams. A clean MATCH result says nothing about either. It can also be something else entirely — what the website advertises, a licence the business does not hold, or documents that did not reconcile.
This is the most common idea people arrive with, and it does not work the way it sounds. Ownership thresholds are a disclosure floor, not a shield — an application requires the name, date of birth, address and Social Security number of everyone owning 25% or more, and at least one person with significant management responsibility even if that person owns nothing. Adding a spouse at 25% does not remove the original owner from the form; it adds a second person to be screened. Leaving the original owner off is worse: applications state plainly that failing to provide required owner and control-person information can mean immediate termination and penalties under federal anti-money-laundering rules. Underwriters also compare addresses, phone numbers, bank accounts, websites and merchant category codes, so a new entity at the same address with a relative’s name on it is a familiar pattern rather than a clever one. A genuinely separate business, genuinely owned and run by someone else, is a different situation — but that is a different company, not a workaround.
It can do both. A MATCH listing attaches to the principal owner’s name and tax ID as well as the terminated business, so it travels to the next company that person owns. A MAC list alert can name a principal too. That is why closing one company and opening another rarely solves anything.
What Brookside Does Not Do
We do not remove listings, and nobody outside the organisation that filed one can. We cannot look you up in any of these files — no agent, ISO or processor can, because there is no lookup to run. And if a live record exists against you or your business, the honest expectation is that we will not be able to place the account either.
Anyone promising to get you off one of these lists for a fee is selling something they cannot deliver. The only route runs through whoever filed the record.
One thing worth holding onto if you are in the middle of this. A listing is not a judgment about you or about whether your business is any good. It is a record that one company filed, on one day, about one account — and the system that reads it was never built to be fair, only to be fast. Plenty of capable operators have been on the wrong end of one.
The way through is unglamorous: find out who filed it, ask them directly, and let the clock run if they will not move. In the meantime, keep the business running on whatever rails you can. We hope this saved you a few weeks of chasing the wrong thing.