What is a Merchant Risk Council (MRC)?

Whether you're looking at membership, researching industry associations, or simply trying to understand who shapes the rules around payment security and fraud prevention, this post breaks down what the MRC is, what it does, and why it matters to anyone operating in the online payments space.

How the MRC Got Started and What It Actually Does

The MRC was founded in 2000 by eCommerce pros working at some of the biggest consumer businesses at the time. Online shopping was still new and businesses were running into fraud problems that no one had a playbook for yet. There was no main place to share what was working and what wasn't.

That gap is why the MRC came to be. Payment processing, fraud prevention and risk management were all tangled together in ways that required collaboration to untangle. Individual businesses were figuring things out in isolation when they'd have been better off learning from each other.

The MRC was set up as a nonprofit, which matters more than it might feel. A nonprofit structure means the focus stays on member value instead of on selling products or generating revenue - it exists to serve the people in the room, not to profit from them.

At its core, the MRC connects merchants, payment processors, technology vendors and financial institutions so they can address fraud and payment challenges together. It runs large-scale conferences, working groups and research initiatives that give members access to data and peer experience, with the goal of making the payments ecosystem safer and more efficient for everyone involved in it.

In 2000, the internet was moving faster than the tools and laws designed to protect it. Merchants needed guidance on chargebacks, identity fraud and card-not-present transactions - which were pretty new territory. The MRC stepped in to build a community around those exact pain points.

It's grown considerably since then, expanding its reach across North America, Europe and the Asia-Pacific region. But the foundation has stayed the same: give merchants and their partners a place to share knowledge, set industry standards and work through payment risk challenges together. That original job still drives everything the MRC does.

Who Belongs to the MRC and What Membership Looks Like

The MRC has grown to include more than 750 member organizations, and the combination is wider. There are merchants, payment processors, fraud prevention vendors, and even law enforcement agencies all under the same roof.

That last one tends to raise eyebrows. Law enforcement agencies join because payment fraud is a criminal matter, not just a business one. When investigators and merchants share information directly, it's easier to trace fraud patterns and hold bad actors accountable. The MRC gives you a space where those conversations can happen.

On the merchant side, members range from large retailers to mid-sized e-commerce businesses. Technology vendors who build fraud detection or chargeback management tools also join to stay in touch with the merchants who use their products. This gives you a feedback loop that benefits everyone - merchants shape vendor priorities, and vendors help merchants understand what tools are available.

Membership is structured around the type of organization joining. Merchants and direct sellers fall into one category, while answer providers and vendors fall into another. The fees and access levels can vary between these groups, which makes sense given that vendors have a commercial interest in being visible to merchant members.

The MRC is built for any business that accepts payments online and spends time on fraud prevention or chargeback disputes. Smaller businesses sometimes assume the MRC skews toward enterprise-level players, but the community draws in a number of company sizes. The value comes from access to research, peer networks, and industry events instead of any single product or service.

The diversity of the membership is part of what makes it work. Fraud doesn't stay neatly in one lane, so having merchants, vendors, and investigators in the same conversation gets closer to reflecting how fraud actually operates.

The Research and Data Behind MRC's Industry Influence

One of the most tangible things the MRC produces is research - and not the kind based on a small sample of opinions. Its findings draw from 1,278 merchant pros across 37 countries, which gives the data a level of credibility that's hard to match.

That scale matters because fraud patterns don't look the same everywhere. A benchmark built from thousands of merchants across dozens of markets reflects what's actually happening in the industry - not just what one region or business type experiences.

The MRC publishes reports and benchmarking data that help members see where they stand relative to their peers. Chargeback rates, fraud loss percentages, and authentication adoption are the numbers that fraud and payments teams actually need to make well-informed decisions. If you don't have a reliable point of comparison, it's easy to assume your numbers are normal when they might not be.

Access to that data can change how a team approaches fraud strategy. Instead of relying on internal gut checks or incomplete vendor reports, members get a clearer picture of industry-wide performance. That context shapes better decisions about where to invest, what to flag, and which thresholds to question.

The MRC also tracks upcoming patterns through its research, so members aren't just looking at what happened last year. They get a forward-looking view of where fraud is heading, which is helpful when planning for the next 12 to 18 months.

It's worth asking if the benchmarks your team uses are representative of the industry. If they come from a single vendor's dataset or an outdated report, there's a chance you're missing the full picture. The MRC's research exists to close that gap - and for members, it's one of the most helpful reasons to participate.

The CPFPP Certification and Why It Matters for Fraud Professionals

The MRC offers a credential worth knowing about: the Certified Payments and Fraud Prevention Professional, known as the CPFPP. It's the first industry-standard certification of its kind, which is worth pausing on - this field has operated for decades without a recognized benchmark for expertise.

The CPFPP is built for those who work in payments, fraud prevention, and risk management. That includes analysts, operations staff, and anyone whose job means managing fraud exposure or building out a fraud strategy. It covers the applied knowledge that actually shows up in day-to-day work - things like chargeback management, fraud detection, and the mechanics of payment processing.

A recognized credential matters more than it might appear. Without one, there's no shared standard for what a fraud prevention professional is expected to know. Hiring can become more subjective, and it's harder for practitioners to show their depth of experience to employers or clients. The CPFPP gives the field something it's been missing: a way to validate knowledge in a structured and portable way.

For individuals, it's a tangible way to show that expertise goes beyond general experience. For teams and hiring managers, it gives you a clearer baseline when looking at candidates.

If you are working in this space and are thinking about what the certification process means, it's worth going directly to the MRC's website to get the latest facts on eligibility and the exam structure. The requirements and content are best understood firsthand instead of through a summary.

Those who stand to benefit most from pursuing the CPFPP are those already working in fraud and payments who want to formalize what they know, and those newer to the field who want to build credibility faster. In either case, it fills a gap that practitioners have navigated without an answer for a long time.

What the MRC's Nonprofit Model Means for the Industry

The MRC operates as a 501(c)6 nonprofit, which is the same structure used by trade associations and chambers of commerce- it's not a charity and it's not a business. The distinction matters.

A for-profit association has shareholders or owners who expect a return. A nonprofit like the MRC is built to reinvest what it has back into the work itself. With around $4 million in annual revenue from memberships, events and certifications, the MRC has its focus on serving the membership instead of generating profit for outside stakeholders.

That structure also shapes how members use the organization. Merchants and payment pros are more willing to share sensitive fraud data when they trust that the information stays within a member-governed community. There's no financial incentive for the MRC to monetize that data or use it in ways that could put members at a disadvantage.

Transparency is a natural byproduct of this model. Nonprofit associations are accountable to their members in a way that for-profit groups aren't, and that accountability builds the trust that makes open collaboration possible. When merchants feel safe enough to talk about fraud losses and chargebacks, the whole network gets better.

The question of who this organization actually serves has an answer: the members themselves. There's no outside board of investors waiting on a quarterly report. The goals are shaped by what practitioners in the payments and fraud space actually need- not by what generates the most revenue.

That member-first orientation is what gives the MRC its credibility in the industry. Its neutrality comes not from distance but from the absence of a financial stake in any particular outcome. For an industry that works with billions in transactions and faces non-stop pressure from bad actors, that structural independence carries weight.

Is the MRC the Missing Piece in Your Fraud Prevention Strategy?

Whether the MRC makes sense for you can depend on where your gaps are. If your team doesn't have enough benchmarks to measure performance against, the annual fraud survey alone can change how you prioritize resources. If you're building a career in payments and compliance, the CPFPP has a recognized path to show that expertise. And if the bigger challenge is learning about what others in the industry are doing - and why - membership puts you inside those conversations instead of outside them.

The most helpful next step is not a commitment - it's curiosity. Browse the MRC's publicly available research, look at what the CPFPP covers, or study what membership would cost and cover for your organization. The value becomes clearer when you see it in the context of your own work - not in the abstract. If you're also evaluating tools alongside industry networks, understanding PCI DSS compliance requirements can help frame where those investments fit.